Privacy Policy

1. Overview

This Policy applies to all visitors and registered users of diversuspro.com, including those who submit contact forms, create accounts, make purchases, or book Vent & Reset sessions. It does not apply to third-party websites or services linked from our platform.

By using our services you agree to the collection and use of information as described in this Policy. If you do not agree, please discontinue use of our platform.

2. Data We Collect

We do not collect sensitive personal data such as government ID numbers, racial or ethnic origin, health data, or financial account numbers (payment processing is handled entirely by Stripe; see Section 5).

3. Contact Form Data

When you submit our contact form, we collect your name, email address, the service you inquired about, and your message. This information is:

• Transmitted via TLS-encrypted SMTP to our business email (hello@diversuspro.com).
• Not stored in a database — contact form submissions are delivered by email and not persisted to disk in raw form.
• Used solely to respond to your inquiry and, with your consent, to follow up about DiversusPro services.

We rate-limit contact form submissions to 5 per IP address per hour to prevent spam and abuse. The rate-limit counter itself (IP + timestamp) is stored briefly in our SQLite database and pruned automatically after one hour.

We will never use contact form data for unsolicited marketing or share it with third parties for their marketing purposes.

4. Account & Dashboard Data

When you create a DiversusPro account, the following information is stored in our secure SQLite database:

• Business name and email address — used to identify your account and communicate with you.
• Password hash — your password is hashed using bcrypt (cost factor 12) before storage. We never store your plaintext password and cannot recover it.
• Subscription plan — Starter, Pro, or Enterprise, used to gate feature access.
• Account creation timestamp — for internal auditing and account management.

Dashboard data (sites managed, invoices, uptime statistics) is stored in association with your account and is accessible only to you when authenticated. Demo seed data generated at account creation uses fictional business names for illustration purposes only.

Sessions are managed via secure, HttpOnly, SameSite=Strict cookies with a 2-hour idle timeout and automatic session ID regeneration on login.

5. Stripe Billing & Payments

When you make a payment through DiversusPro:

• Your card details are entered directly into Stripe's secure hosted fields and are tokenized by Stripe before any data reaches our servers.
• We receive a non-sensitive payment token (PaymentIntent ID) and confirmation status from Stripe.
• Stripe may collect and process your payment data per their own Privacy Policy.
• We store your subscription plan, payment status, and billing history (amounts, dates, invoice references) in our own database for account management.

Stripe supports Apple Pay and Google Pay ("Payment Request Button"). Use of those methods is subject to the respective policies of Apple and Google in addition to Stripe's terms.

For billing questions or disputes, contact us at hello@diversuspro.com or manage your payment method directly through your account dashboard.

6. Vent & Reset — Call Confidentiality

6.1 What We DO Collect for Vent & Reset

• Booking information — your name, email, and the date/time you book, collected via the Cal.com booking widget.
• Payment confirmation — processed by Stripe; we receive a booking fee confirmation only.
• Optional intake notes — only if you voluntarily provide them at booking time through the Cal.com booking form. These are used solely to prepare for your session and are not shared.

6.2 What We DO NOT Collect for Vent & Reset

• Audio or video recordings of any kind.
• Transcripts or AI-generated summaries of call content.
• Structured session notes linked to your identity.
• Any medical, diagnostic, or clinical information discussed during a session.

6.3 Confidentiality Limits

While DiversusPro maintains strict confidentiality, please be aware that confidentiality cannot be guaranteed in the following limited circumstances:

• If disclosure is required by applicable law or valid legal process (e.g., court order or subpoena).
• If there is an imminent risk of serious harm to you or others — in which case we may contact appropriate emergency services, though we are not a mandated reporter.

If you need genuinely confidential professional support with legal protections (such as attorney-client or therapist-client privilege), please engage the appropriate licensed professional.

6.4 Cal.com Booking Widget

Our booking interface is powered by Cal.com. When you book a Vent & Reset session, Cal.com collects your name, email, and selected time slot subject to Cal.com's own Privacy Policy. DiversusPro does not control Cal.com's data practices beyond what is disclosed in their policy.

7. Data Storage & Security

All DiversusPro platform data is stored on a dedicated Linux VPS (Virtual Private Server) in the United States. We employ the following security measures:

• Encryption in transit — All connections to diversuspro.com are enforced via HTTPS (TLS 1.2+) with HSTS headers and a 2-year max-age preload.
• SQLite WAL mode — Our database operates in Write-Ahead Logging mode for data integrity and crash safety.
• Bcrypt password hashing — User passwords are hashed with bcrypt at cost factor 12. Plaintext passwords are never stored or logged.
• Secure session cookies — HttpOnly, Secure, SameSite=Strict cookies with automatic session rotation on authentication.
• Security headers — X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy, and Permissions-Policy headers are set on all responses.
• Rate limiting — IP-based rate limiting protects authentication endpoints, contact forms, and the chat interface from brute force and abuse.
• Automated backups — Daily encrypted backups are retained for 7 days and stored on isolated infrastructure.
• Least privilege access — SMTP credentials, API keys, and secrets are injected via server environment variables and are never hardcoded in application source files.

While we implement these measures, no system is 100% secure. In the event of a data breach affecting your personal information, we will notify you and relevant authorities as required by applicable law.

8. Data Retention

You may request deletion of your personal data at any time (see Section 11). We will honor deletion requests within 30 days, subject to retention obligations imposed by law (e.g., financial records).

9. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Stripe — Payment processing. Receives payment method data directly; we share only what is necessary to process your transaction.
• Cal.com — Session booking. Receives name, email, and appointment time when you book a Vent & Reset session.
• SMTP provider (Gmail/Google) — Email delivery of contact form notifications. Messages are transmitted over SMTP TLS.
• Legal obligations — We may disclose information if required by valid legal process, court order, or governmental authority, or to protect the rights, property, or safety of DiversusPro, our users, or the public.
• Business transfers — In the event of a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you via email and provide an opt-out period.

All third-party service providers are required to handle your data in compliance with applicable privacy laws and are prohibited from using your data for their own marketing purposes.

10. Cookies & Tracking

DiversusPro uses a minimal set of cookies:

• Session cookie — An HttpOnly, Secure, SameSite=Strict cookie named PHPSESSID (or equivalent) to maintain your authenticated session. This cookie expires after 2 hours of inactivity or on browser close.
• Cal.com embed cookies — When the Vent & Reset booking widget is open, Cal.com may set its own cookies per their policy. These are set only when you actively open the booking modal.

We do not use advertising cookies, cross-site tracking pixels, Google Analytics, Facebook Pixel, or any third-party behavioral tracking tools. We do not participate in any advertising network.

You may disable cookies in your browser, but doing so will prevent you from logging into your DiversusPro account.

11. Your Privacy Rights

Regardless of your location, you have the following rights with respect to your personal data:

To exercise any of these rights, email hello@diversuspro.com with the subject "Privacy Request." We will respond within 30 days. We may need to verify your identity before processing the request.

12. GDPR — EU & UK Residents

If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies. Our legal bases for processing your data are:

• Contract performance (Art. 6(1)(b)) — Processing your account data, billing information, and service delivery data to fulfill our contract with you.
• Legitimate interests (Art. 6(1)(f)) — Security monitoring, fraud prevention, rate limiting, and product improvement — balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — Retaining billing records for tax compliance.
• Consent (Art. 6(1)(a)) — Where we have asked for your explicit consent (e.g., marketing communications).

Data transfers: If your data is transferred outside the EEA/UK, we ensure appropriate safeguards are in place (Standard Contractual Clauses or equivalent). You have the right to lodge a complaint with your local Data Protection Authority.

13. CCPA — California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights. In the past 12 months, we have:

• Collected the categories of personal information described in Section 2 of this Policy.
• Used this information for the business purposes described in this Policy.
• NOT sold or shared personal information with third parties for cross-context behavioral advertising.

California residents may: (a) request to know what personal information we collect, use, disclose, and sell; (b) request deletion of personal information; (c) opt out of the sale or sharing of personal information (we do not sell data); (d) correct inaccurate personal information; (e) limit use of sensitive personal information. To submit a CCPA request, email hello@diversuspro.com with "CCPA Request" in the subject line. We will respond within 45 days.

14. Children's Privacy

DiversusPro is a business-to-business service intended for adults aged 18 and older. We do not knowingly collect personal information from individuals under 18. If we learn we have collected data from a minor, we will delete it promptly. If you believe we have inadvertently collected data from a minor, please contact us at hello@diversuspro.com.

15. Policy Changes

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify registered users via email at least 14 days in advance. Your continued use of DiversusPro after the effective date constitutes acceptance of the updated Policy.

16. Contact Us

For any privacy questions, concerns, or requests: