Your data, plainly explained.

The Overspray Effect™ is operated by Holistic Haven Advisory Group, LLC(“we,” “us,” or “HHAG”). This policy explains what personal information we collect when you use our website, course, assessments, and related services (together, the “Services”), why we collect it, who we share it with, and the choices you have.

Questions or requests about your data? Email info@oversprayeffect.com, or write to us at Holistic Haven Advisory Group, LLC, 9869 Ocean Highway West, Suite 3, PMB 121, Carolina Shores, NC 28467.

We collect information you give us directly, and a small amount collected automatically.

Information you give us

• Contact form: name, organization, role, email, your interest, your message, and how you heard about us.
• Course purchase: your name and email are collected by Stripe at checkout; we receive them back along with your payment confirmation. We never see or store your full card number.
• Ebook/workbook purchase: the same, plus the format(s) you buy. Your downloaded file is personally watermarked with your name, email, and order number.
• Waitlist signup:name and email, and optionally what you’re interested in.
• Advance Reader Copy (ARC) signup: name, email, preferred format, whether you have an eligible Amazon account, and an optional Goodreads username.
• Educator requests: name, institutional email, institution, role, course details, and any notes you provide.
• Website chatbot: if you choose to share your contact details through the chat widget, we collect your name, email, and (for corporate inquiries) company name, plus a short AI-generated summary of the conversation. If you type personal information directly into the chat before that point, it may be included in what the chatbot processes — see AI Chatbot below.
• Assessments (Overspray Audit™ and related instruments): your email, optionally your name, your answers, your computed score and result band, and — only if you choose to share them — your role level, industry, and company size. These last three are always optional.
• Course progress:which lessons you’ve started or completed, and your answers to interactive lesson exercises where a specific exercise is designed to save your input so you can resume later.

Information collected automatically

• A random, non-identifying visitor id (cookie) used to connect a visit to a later conversion, so we know which parts of the site are working.
• Standard hosting/analytics data: pages viewed, general location/device information, and on-site behavior, via Google Analytics and Microsoft Clarity (which also records anonymized session replays/heatmaps to help us improve the site).
• Your theme preference (light/dark), stored locally in your browser only.

• To provide the Services — deliver your purchase, grant course access, score your assessment, and let you resume where you left off.
• To respond to your inquiries and requests.
• To send transactional emails (purchase confirmations, download links, account access).
• To send marketing emails, only where you’ve opted in (see Email Marketing & Unsubscribe below).
• To keep an internal record of leads and customers in our CRM, so our team has one accurate view of who’s reached out and why.
• To understand how visitors use the site and improve it.
• To detect, prevent, and investigate fraud, abuse, or security issues.
• To comply with legal and tax obligations.

We share personal information with the following third parties, each for a specific purpose:

• Twenty CRM — our customer relationship management system, where we keep a record of leads and customers (name, email, and the details relevant to why you reached out) so our team can follow up.
• Stripe — processes all payments. Stripe collects your payment details directly; we receive back your name, email, and payment confirmation.
• Resend — sends transactional email on our behalf (confirmations, downloads, account-related messages).
• Anthropic — powers our website chatbot. See AI Chatbot below.
• Google Analytics and Microsoft Clarity — website analytics, including session recording/heatmap tools, to help us understand and improve the site.
• Cloudflare — stores and delivers purchased digital files, and hosts encrypted infrastructure backups.
• Vercel and Neon — host our website and database.

We don’t sell your personal information, and we don’t share it with third parties for their own independent marketing purposes.

Our website chatbot is powered by an AI model operated by Anthropic. When you chat with it, your messages are sent to Anthropic’s API to generate a response. If you choose to share your contact details through the chat, a short AI-generated summary of the conversation is saved to our CRM so our team has context if we follow up — the full raw transcript is not permanently stored in our CRM, only that summary. Don’t share anything in the chat you wouldn’t want summarized and kept as a note on your CRM record.

We use a small number of cookies and browser-storage items:

• Session cookies — keep you logged into a purchased course, or (for our internal team only) our manuscript-review tools. These are necessary for the Services to work.
• A visitor-id cookie — a random, non-identifying id used to connect an anonymous visit to a later signup or purchase, for our own reporting.
• Local/session storage — remembers your theme preference, lets an in-progress assessment resume after a reload, and briefly holds chatbot conversation state and lead-capture flags in your own browser. This data stays on your device; we don’t collect it directly.
• Analytics cookies — set by Google Analytics and Microsoft Clarity, described above.

You can control cookies through your browser settings. Blocking essential session cookies may prevent parts of the Services (like staying logged into a purchased course) from working.

We only send marketing email to addresses that have opted in. Every marketing email includes an unsubscribe link. If you unsubscribe, we keep your address on a suppression list solely so we don’t email you again — we don’t use it for any other purpose. Transactional email (like a purchase confirmation or a download link) isn’t marketing and doesn’t have an unsubscribe option, since it’s necessary to deliver something you bought.

We keep personal information only as long as we need it for the purposes above, or as required by law:

You can request deletion of your data at any time by emailing info@oversprayeffect.com, subject to records we’re legally required to keep.

We use reasonable technical and organizational measures to protect your personal information, including access controls and signed authentication tokens. No method of transmission or storage is 100% secure, so we can’t guarantee absolute security — but we take it seriously and work to improve it on an ongoing basis.

You can ask us to access, correct, or delete the personal information we hold about you at any time by emailing info@oversprayeffect.com. Because we don’t use a single traditional account system, we’ll locate and act on all records tied to your email address across our systems (course access, assessment results, CRM record, and purchase history), subject to records we’re legally required to keep (see Data Retention above).

The Services are not directed to, and we do not knowingly collect personal information from, anyone under 18. If you believe a child has provided us with personal information, contact us at info@oversprayeffect.comand we’ll delete it.

We may update this policy from time to time. If we make a material change, we’ll update the “Last updated” date at the top of this page. Continuing to use the Services after a change means you accept the updated policy. See also our Terms of Service.