Privacy Policy

1. Introduction

1.1 Who we are

This Privacy Policy (this “Policy”) is issued by Mecavoy LC, a Wyoming limited liability company (Wyoming entity ID 2026-002066107), 5830 E 2nd St, Ste 7000 #38404, Casper, WY 82609, United States (“Mecavoy”, “we”, “us” or “our”). Mecavoy is the controller of the personal information described in this Policy.

1.2 Scope

This Policy applies to personal information that Mecavoy collects through the website at mecavoy.com (the “Site”) and through the emails we send, in connection with:

1. the Mecavoy mailing list, described in Section 2; and
2. applications to the Mecavoy Founding Advisor Program (the “Program”), described in Section 3.

This Policy does not apply to the Mecavoy travel planning and booking service, which is scheduled to launch in January 2027. That service will be covered by a separate privacy policy, and we will email subscribers before it takes effect.

1.3 Definitions

In this Policy, “personal information” means information that identifies, relates to or could reasonably be linked with an identified or identifiable individual, including the hashed values described in this Policy. “Offer Terms” means the Pre-Launch Offer Terms, and “Program Terms” means the Founding Advisor Program Terms.

1.4 How to contact us

Questions about this Policy and requests about your personal information may be sent to privacy@mecavoy.com. Other questions may be sent to support@mecavoy.com.

2. The Mailing List

2.1 Information you provide

1. Email address. Your email address is the only information requested on the signup form.
2. Consent record. The exact wording displayed beside the consent checkbox, the version of that wording, the date and time you submitted the form with the box checked, and the fact that your consent was given through the web form. Consent is given on the form itself; there is no separate confirmation step, except when an address that has unsubscribed rejoins the mailing list, as described in Section 6(b).

2.2 Information collected automatically when you subscribe

1. Hashed IP value. A hashed value derived from your IP address, computed with a secret key that we hold. Without that key the value does not reveal your IP address, but we treat it as personal information. Your IP address itself is not stored in your subscriber record.
2. User agent. The user agent string your browser sends, which identifies the browser and operating system.
3. Source page. The page of the Site from which you subscribed.

2.3 Information we generate

Your subscription status; the date you first subscribed; the date and time we last emailed you, and technical references used to prevent the same email being sent twice; whether the welcome email has been sent; whether a receiving mail server refused an email to you, and the reason it gave; and, if you unsubscribe, the date and time you did so. If you subscribed while subscribing required a confirmation email, or if you rejoined the mailing list after unsubscribing as described in Section 6(b), your record may also show when you clicked the confirmation link and a hashed value derived from the IP address from which you clicked it.

2.4 Server and application logs

1. Web and storage access logs. The content delivery network that serves the Site, and the storage that receives files uploaded through the application form, keep standard access logs. These logs include the IP address from which each request was made, the page or file requested, the date and time, and technical details such as the user agent. We use them only for security and diagnostics. They are not combined with subscriber or applicant records and are not used for marketing. Some of our emails include a countdown image that your email program loads from the Site when it displays the email; that request carries no identifier for you, and it is logged, with the IP address it comes from, like any other request to the Site.
2. Application logs. The systems that handle signups, unsubscribes, applications, emails and staff access to the administration console record events such as a signup, an unsubscribe, a document being opened or an error. Log entries may include IP addresses and hashed values derived from IP addresses and email addresses. We use these logs for security, auditing and troubleshooting.

2.5 Information we do not collect for the mailing list

For the mailing list, we do not collect your name, postal address, phone number, payment details, precise location or advertising identifiers. We do not buy email lists, and we add to the mailing list only addresses submitted through the signup form on the Site or at the request of the person to whom the address belongs.

2.6 How we use this information, and our legal bases

1. To send you the emails you agreed to receive (launch news, occasional updates, and Mecavoy promotions and offers). Legal basis: your consent, which you may withdraw at any time by unsubscribing. Withdrawing consent does not affect processing carried out before you withdrew it.
2. To reserve and apply your Free Year of Mecavoy Plus under the Offer Terms, and to apply the one-per-person limit, for which we treat email addresses that differ only by dots or by a “+” tag as the same address. We continue to do so after you unsubscribe, using the email address kept on the suppression list described in Section 6(b). Legal basis: performance of our agreement with you under the Offer Terms.
3. To detect and prevent automated or abusive submissions and to keep the Site secure, using the information in Sections 2.2 and 2.4. Legal basis: our legitimate interest in operating a secure service. You may object to this processing (see Section 9).
4. To understand which pages of the Site lead to signups, using the source page. Legal basis: our legitimate interest in understanding how the Site is used.
5. To keep a record of your consent and of any unsubscribe request, and to maintain a suppression list so that we do not email you after you have unsubscribed, except as described in Section 6(b). Legal basis: our legitimate interest in demonstrating that we have acted lawfully and in honoring your request not to be contacted, and compliance with our legal obligations.
6. To confirm a request to rejoin the mailing list after you have unsubscribed, by sending one email to the address entered in the signup form, as described in Section 6(b). Legal basis: our legitimate interest in making sure that an address is added back to the mailing list only by the person to whom it belongs, and, once you confirm, your consent.

Your email address is required to join the mailing list. If you do not provide it, we cannot add you to the list or reserve a Free Year for you.

3. Founding Advisor Applications

3.1 Scope of this section

This Section 3 applies to applications to the Program made through the application form at mecavoy.com/advisor-apply.html. The Program Terms are published at mecavoy.com/advisor-terms.html. Independent Agents may apply from the countries listed on the application form, and the Registered Advisor track is open only to individuals who reside in the United States, applying for businesses organized or registered there, as set out in Section 3 of the Program Terms. Sections 4 to 12 of this Policy apply to applicants as well as to subscribers. This Section 3, together with Sections 4.1, 8 and 9, is our notice at collection for applicants.

3.2 Information you provide

1. Identity and contact details. Your full name, email address, phone number (if you provide one), city and country of residence, and your state, province or region where the application form asks for it or you provide it.
2. Professional details. The track you apply for (Independent Agent or Registered Advisor), your headline, years of experience, a description of your work, specialties, destinations, languages and the services you offer, and, if you provide them, your website, Instagram and LinkedIn profiles and the name of your host agency.
3. Business details. For the Registered Advisor track, your business’s legal name, entity type and state of registration, and your seller-of-travel registration numbers and the states that issued them.
4. Headshot and documents. Your headshot and the documents you upload, which may include business registration documents, seller-of-travel certificates, proof of errors and omissions insurance, certificates or training records, and samples of your work, together with each file’s name, type and size. Each file is uploaded to our storage when you select it, before you submit the application.
5. Acceptances and choices. The version of the Program Terms you accepted, your authorization of the verification described in the Program Terms, your confirmation that you meet the age and sanctions requirements of the Program Terms, and your confirmation that the information you provided is accurate, each with the date and time you gave it, together with the wording of the age and sanctions confirmation; whether you asked to receive advisor news; and, if you did, the wording of that request and the date and time you made it.
6. Other information. Any other information you give us during our review, including in emails and verification calls.

We do not ask for a passport, national identity card or driver’s license number, a Social Security or other tax identification number, or payment details when you apply.

3.3 Information collected automatically

When you submit an application, we collect a hashed value derived from your IP address and your browser’s user agent, as described in Section 2.2. The access logs and application logs described in Section 2.4 also record your use of the application form. Draft answers saved in your own browser while you complete the form are not sent to us until you submit the application (see Section 5.2). We also record the country from which you submitted the application, as determined by our content delivery network from your IP address. We store the country only, not the IP address, and use it to help detect fraud and to check the application against U.S. sanctions requirements. The network may also give us the state, province or region it associates with your IP address; we use that only for the same check and do not store it.

3.4 Information from other sources

When we verify an application, we may obtain information confirming whether the information you provided is accurate from the bodies that issued a certificate, registration or license you have submitted, from public registers, and from any references you have given us. We may also review the website and social media profiles you list in your application and publicly available information about your travel business. We check each applicant’s name and country, and for the Registered Advisor track the name of the business, against the sanctions and other restricted-party lists published by the U.S. government, using government search services such as the Consolidated Screening List or the Office of Foreign Assets Control’s Sanctions List Search.

We do not obtain consumer reports from consumer reporting agencies. If you live outside the United States, we do not search public records about you, other than to confirm a credential you have submitted with its issuer or a public register and to check the sanctions lists as described above, and we do not obtain criminal records or court records about you. If we ourselves obtain public records about you in the course of verification, we will send a copy of them to the email address in your application within seven days after we obtain them, as set out in Section 5.4 of the Program Terms. You do not need to ask for the copy.

During a verification call we may ask you to show an official photo identity document. We look at it only to confirm your identity and that you meet the eligibility requirements of the Program Terms. We do not record the call or keep an image or copy of the document unless you agree or the law requires it, and we do not use facial recognition or other automated means to compare your headshot with it.

3.5 Information we generate

A record of our review, including any note recorded with our decision, our decision, the role approved (if any), the date of each step, the staff account that made each decision, the checks recorded when an application is approved, the results of the sanctions screening described in Section 3.4, including any note resolving a possible match, and a history of the submission and each decision; a count of any later attempts to submit an application with the same email address; and the dates on which we sent you emails about your application.

3.6 How we use this information, and our legal bases

1. To review and verify your application, and to communicate with you about it, so that we can make sure that advisors on Mecavoy are who they say they are and hold the qualifications they claim. Legal basis: taking steps at your request before entering into the Advisor Agreement with you, and our legitimate interest in verifying advisors and preventing fraud.
2. To screen applicants against U.S. government sanctions lists and to comply with the laws that apply to us, including U.S. sanctions and tax laws. Legal basis: our legitimate interest in complying with the laws that apply to us and, where the law of the country in which you live imposes the obligation, compliance with a legal obligation.
3. If your application is approved, to prepare your advisor profile and to enter into the Advisor Agreement with you. Legal basis: taking steps at your request before entering into a contract.
4. To keep a record of the terms you accepted, your authorizations and confirmations, and our decisions, and to establish, exercise or defend legal claims. Legal basis: our legitimate interest in showing that we have acted lawfully and in protecting our legal position.
5. To detect and prevent automated, fraudulent or abusive submissions and to keep the Site secure, including by comparing the country you give with the country from which your application was submitted and with your phone number’s country code. Legal basis: our legitimate interest in operating a secure service and preventing fraud.
6. To send you occasional Mecavoy news for advisors, if you asked to receive it. Legal basis: your consent, which you may withdraw at any time by asking us to stop these emails. Withdrawing consent does not affect processing carried out before you withdrew it.

Where we rely on our legitimate interests, you may object (see Section 9). We do not rely on your consent for verification. The application form asks you to authorize the verification described in the Program Terms. Decisions on applications are made by Mecavoy staff. We do not make decisions about applicants based solely on automated processing. The information marked as required on the application form is necessary for us to consider your application. Other information is optional.

3.7 Internal notification

When you submit an application, a copy of the information in it, other than the uploaded files, is emailed to an internal Mecavoy mailbox so that authorized staff can review it. Applications and uploaded files are otherwise accessed through our password-protected administration console.

3.8 How long we keep application information

1. Applications under review. For as long as the review continues.
2. Approved applications. For as long as you are a Mecavoy advisor, and afterwards for as long as the Advisor Agreement or applicable law requires.
3. Declined applications. The documents you uploaded are deleted automatically no later than 12 months after the date of our decision. The rest of the application record is kept only for as long as reasonably necessary to answer questions about the decision, to consider a future application from you, to comply with our legal obligations and to establish, exercise or defend legal claims.
4. Applications withdrawn, or deleted at your request. We delete the application, the documents uploaded with it and our internal notification of it within 30 days after we receive your request, except to the extent that the law requires us to keep them.
5. Files not submitted with an application. Files uploaded through the application form but never submitted with a completed application are deleted automatically three days after upload.
6. Sanctions screening records. A record of each screening (the date, the list searched, the names searched, the result, the staff account and any note) is kept with the application for the periods in (a) to (d). If you sign the Advisor Agreement, we keep screening records for at least 10 years after our last transaction with you, consistent with U.S. sanctions recordkeeping rules. If a screening confirms that you are on a U.S. government sanctions list, we keep the screening records, and the information in your application needed to identify you and to show what was screened and decided, for 10 years after that confirmation or for any longer period that U.S. sanctions law requires, even if you withdraw the application or ask us to delete it. Your documents and the rest of the application are deleted as (a) to (e) otherwise provide.

When a document is deleted, our storage provider may keep it in the storage version history for up to 30 days before it is permanently removed. Deleted application records may remain in encrypted database backups for up to 35 days. We do not make or keep copies of identity documents shown on a verification call unless you agree or the law requires it (see Section 3.4). Please do not upload an identity document with your application; if you do, we delete it.

3.9 Withdrawing an application

To withdraw your application, email support@mecavoy.com from the address you applied with. To exercise any of the rights described in Section 9, email privacy@mecavoy.com.

4. How We Disclose Personal Information

4.1 No sale or sharing for advertising

We do not sell personal information, share it for cross-context behavioral advertising, or disclose it to third parties for their own marketing. We have not done so in the preceding 12 months.

4.2 Service providers

The following service providers process personal information on our behalf, under contract, and only for the purposes described:

1. Amazon Web Services (AWS). Hosts the Site, the databases that hold subscriber and application records, the storage that holds application documents, and our logs, in the United States.
2. Mailgun (Sinch). Delivers the emails we send to subscribers and applicants, and our internal notifications of new applications. It receives the recipient’s email address and the content of each email so that it can deliver the message.
3. Our business email hosting provider. Hosts the mecavoy.com mailboxes that receive your messages to us and our internal notifications of new applications.

4.3 Other disclosures

We may also disclose personal information:

1. to issuing bodies, public registers and references you have given us, limited to what is necessary to verify your application (for example, your name and a registration number), and to the U.S. government services we use to search sanctions lists, limited to your name and country and, for the Registered Advisor track, the name of your business;
2. to our professional advisers, such as lawyers, accountants and insurers, where necessary and subject to duties of confidentiality;
3. where required by law, regulation, legal process or an enforceable governmental request, or where reasonably necessary to protect the rights, property or safety of Mecavoy, our users or others, or to prevent fraud; and
4. in connection with a merger, acquisition, financing, reorganization or sale of all or part of Mecavoy’s business or assets. If this occurs, we will notify you before your personal information becomes subject to a different privacy policy.

5. Cookies, Browser Storage and Tracking

5.1 No cookies on the public Site

The public pages of the Site set no cookies. The Site uses no analytics, advertising or social media tracking technologies, and loads no content from third-party servers; the typefaces are served from the Site itself.

5.2 Browser storage

The Site stores limited information in your browser, on your device, where a feature you use requires it:

1. Home page. An entry in your browser’s session storage recording that the opening animation has played. It is deleted when you close the browser tab.
2. Founding advisor application. The text answers you type into the application form, and the country, state, province or region you choose, saved in your browser’s local storage so that you can finish later. Other options you select, such as checkboxes, and uploaded files are not saved. This draft stays on your device and is not sent to us until you submit the application. It is deleted when you submit the application or choose “Clear saved progress” or “Start over”. A saved draft that is more than 30 days old is deleted automatically the next time you open the home page, a Founding Advisor Program page or the application form. You can also delete it through your browser settings. If you use a shared device, we recommend clearing your saved progress when you finish.

Files you upload with an application are sent directly from your browser to our storage provider, AWS, over an encrypted connection.

5.3 Staff administration console

The administration console used by authorized Mecavoy staff sets one strictly necessary session cookie when a staff member signs in. It is never set for visitors. It expires after a period of inactivity, when the staff member signs out, or 8 hours after sign-in, whichever occurs first. The console also remembers the selected view in session storage.

5.4 Global Privacy Control and Do Not Track

We do not sell or share personal information (see Section 4.1), and the Site does not track visitors over time or across third-party websites. We nonetheless treat a Global Privacy Control signal sent by your browser as a valid request to opt out of any sale or sharing of your personal information. Because we do not sell or share personal information, honoring that request does not change how the Site operates. We do not respond to a Do Not Track signal differently, because the Site does no tracking for that signal to stop. No third party collects personally identifiable information about your online activities over time and across different websites through the Site.

6. Retention

We keep personal information only for as long as necessary for the purposes described in this Policy. Retention periods for application information are set out in Section 3.8. For the mailing list and our logs:

1. Subscriber records. Until you unsubscribe or ask us to delete your information.
2. After you unsubscribe. We delete your consent record and the information described in Sections 2.2 and 2.3, except that we keep your email address, your subscription status, the dates on which you subscribed and unsubscribed, and any record that an email to you could not be delivered, on a suppression list so that we do not contact you again, except as described below. If you subscribed while Version 1 of the Offer Terms was published, we keep only your email address on the suppression list, as those terms provide, and delete everything else. We also use the email address on the suppression list to honor the Offer Terms: unsubscribing does not end the Free Year of Mecavoy Plus reserved for that address, and if you open a Mecavoy account with it, the Free Year applies as those terms provide. We use the address for that purpose only until the Offer lapses for that address. If an address on the suppression list is entered in the signup form again, we do not add it back to the mailing list. We send one email to that address asking whether it should be added back, and no more than one such email to the same address in any 24 hours, unless the link in the previous one was used. The signup form adds the address back only if the link in that email is used within 48 hours; the new subscription is then recorded as described in Sections 2.1 to 2.3 and is governed by the current Offer Terms and this Policy (see Section 11.2). Until then the suppression record does not change, whichever version of the Offer Terms you subscribed under. If you ask us, from that address, to stop sending these emails, we stop, and we keep a record of your request, identified by a pseudonymous identifier derived from the address rather than by the address itself, until you ask us to add you back or to delete your information. We keep a request to rejoin, meaning the address and the information described in Sections 2.1(b) and 2.2 that were submitted with it, separately from the suppression record, and we delete it automatically 48 hours after it is made; the deletion can take a few more days to complete. We keep the suppression record for as long as we operate the mailing list.
3. Signups that were never confirmed. Until we removed the confirmation step from the signup process, a signup became a subscription only when the confirmation link in our confirmation email was clicked. A signup that was never confirmed is not on the mailing list, receives no emails from us and does not reserve a Free Year under the Offer Terms. We delete these records, and in any event no later than 12 months after each record was created.
4. Web and storage access logs. 90 days.
5. Application logs. Up to 90 days.
6. Correspondence. Emails you send us are kept for as long as reasonably necessary to respond to you and to keep a record of any request you make.
7. Backups. Deleted or changed database records may remain in encrypted backups for up to 35 days before they are permanently overwritten.

7. Security

We encrypt personal information in transit. The databases, document storage and log storage that we operate encrypt it at rest. Access to subscriber and application records is limited to authorized Mecavoy staff, who review them through a password-protected administration console over an encrypted connection. The underlying databases and document storage are not publicly accessible, and our email sending key is held in a managed secret store.

No method of transmission or storage is completely secure. If a security incident affects your personal information, we will notify you, and any authority we are required to notify, as required by applicable law.

8. International Users

8.1 Where we process personal information

Mecavoy is based in the United States. We collect personal information directly from you through the Site and store and process it in the United States. Section 3.4 describes the information we obtain from other sources when we verify an application. Our service providers may also process personal information in other countries in which they operate. The data protection laws of the United States and of those countries may differ from those of your country.

8.2 Safeguards

Our service providers process personal information on our behalf under written contracts that require them to protect it and to use it only on our instructions. Where the law of your country requires it for information they receive from us, those contracts include safeguards such as the European Union’s standard contractual clauses. You may ask for a copy of these safeguards by emailing privacy@mecavoy.com; we may remove commercial terms from the copy.

8.3 Access by authorities

Personal information held in the United States may be accessible to U.S. courts, law enforcement agencies and national security authorities under U.S. law.

8.4 Who may take part

The Free Year of Mecavoy Plus is available only to residents of the United States, as set out in the Offer Terms, but anyone may subscribe to the mailing list. Independent Agents may apply to the Program from the countries listed on the application form, and the Registered Advisor track is open only to individuals who reside in the United States, as set out in Section 3 of the Program Terms. Section 9 describes your rights, including additional rights for individuals in the European Economic Area, the United Kingdom and Switzerland (Section 9.3) and in other countries (Section 9.5).

8.5 Language

This Policy and our communications are in English. If we provide a translation, the English version controls.

9. Your Rights and Choices

9.1 Your choices

You may unsubscribe from the mailing list at any time using the link in any email we send, or by replying to any email and asking to be removed. You may stop receiving advisor news at any time in the same way or by emailing support@mecavoy.com.

9.2 Rights available to everyone

Wherever you live, you may ask us to:

1. confirm whether we hold personal information about you and give you access to it;
2. correct personal information that is inaccurate or incomplete;
3. delete your personal information, except the suppression record described in Section 6(b), information we are required by law to keep and information we need to establish, exercise or defend legal claims;
4. provide your personal information in a portable, machine-readable format;
5. stop processing your personal information on the basis of our legitimate interests (the right to object); and
6. withdraw any consent you have given, which for the mailing list you may do by unsubscribing.

If, at your request, we also delete your email address from the suppression list described in Section 6(b), we will no longer hold a record that the address was subscribed, and the Free Year of Mecavoy Plus reserved for it can no longer be applied under the Offer Terms. We will tell you this before we delete it.

These rights are subject to the limits and exceptions set by applicable law. If we cannot fulfill a request in full, we will tell you why. We do not charge for these requests, and we will not treat you differently because you make one.

9.3 Individuals in the European Economic Area, the United Kingdom and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland:

1. Mecavoy LC, identified in Section 1.1, is the controller of your personal information, and Sections 2.6 and 3.6 set out our legal bases for using it;
2. you may also ask us to restrict our processing of your personal information;
3. you have the right to lodge a complaint with a data protection authority: in the European Economic Area, the authority in the country where you live or work or where the matter arose; in the United Kingdom, the Information Commissioner’s Office; and in Switzerland, the Federal Data Protection and Information Commissioner; and
4. we do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

You may also complain to us first, as described in Section 9.6.

9.4 United States residents

Depending on the state in which you live, you may have rights under state privacy law, including rights to know, access, correct, delete and obtain a portable copy of your personal information, and to opt out of its sale, of targeted advertising and of profiling. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. For that reason we do not offer a “Do Not Sell or Share My Personal Information” link. If that changes, we will update this Policy and provide any opt-out required by law before the change takes effect. We treat a Global Privacy Control signal as described in Section 5.4.

In the preceding 12 months we have collected the following categories of personal information, from the sources and for the purposes described in Sections 2 and 3: identifiers (such as name, email address, phone number, IP address and hashed IP values); customer records information (such as name, phone number and any insurance information in documents you upload); commercial information (the Free Year reserved for your email address); professional or employment-related information (such as experience, specialties, business details and registrations, and the results of sanctions screening); audio, electronic, visual or similar information (your headshot); and internet or other electronic network activity information (such as user agent, source page, the country from which an application was submitted and log data). We disclose these categories only to the recipients described in Section 4, and we keep them for the periods described in Sections 3.8 and 6. We do not use sensitive personal information to infer characteristics about you.

9.5 Individuals in other countries

Wherever you live, you may exercise the rights described in Section 9.2. Depending on where you live, the law of your country may give you further rights, including the right to complain to your local data protection authority. If you live in Canada, you may complain to the Office of the Privacy Commissioner of Canada, and you may contact the person accountable for our compliance with Canadian privacy law at privacy@mecavoy.com.

9.6 How to make a request

Email privacy@mecavoy.com. To protect your information, we may ask you to confirm the request from the email address associated with it before we act on it. You may make a request through an authorized agent, in which case we will ask the agent for proof of their authority and may ask you to confirm the request directly.

We respond to requests within 30 days after we receive them. Where reasonably necessary, we may extend that period once by up to a further 30 days, and if we do we will tell you why. If we decline a request, we will explain why, and you may appeal the decision by replying to our response; we will respond to an appeal within the period required by applicable law. If you are not satisfied with the outcome, you may contact the attorney general of your state or, if you live in California, the California Privacy Protection Agency.

Complaints. You may complain to us about how we handle your personal information by emailing privacy@mecavoy.com. We acknowledge a complaint within 30 days after we receive it and tell you the outcome without undue delay. Complaining to us does not affect your right to complain to a data protection authority or other regulator.

10. Children

Anyone 13 years of age or older may subscribe to the mailing list. The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. You must be at least 18 years of age to claim the Free Year under the Offer Terms. To apply to the Program, you must be at least 18 years of age and, if the age of majority where you live is higher, have reached that age. If you believe that a child under 13 has provided personal information to us, contact privacy@mecavoy.com and we will delete it.

11. Changes to This Policy

11.1 How we make changes

We will post any change to this Policy on this page with a new version number and effective date. If a change materially affects how we use personal information we already hold about you, we will email you at least 30 days before the change takes effect, and where the law requires your consent we will ask for it. Previous versions of this Policy are available on request from privacy@mecavoy.com.

11.2 Subscribers under Version 1

This Section 11.2 applies to you if you subscribed to the mailing list while Version 1 of this Policy was the version published on the Site, and only for as long as that subscription continues. If it ends and you subscribe again after Version 2 is published, Version 2 applies to the new subscription. Any change made by Version 2 of this Policy that reduces a commitment made to you in Version 1 takes effect for you 30 days after the date on which we email you notice of that change. Until then, the Version 1 commitment continues to apply to you. This Section 11.2 does not reduce any right that the Offer Terms give you, and the Free Year of Mecavoy Plus reserved for your email address remains reserved for it after you unsubscribe, as the Offer Terms provide (see Section 6(b)). The changes to which this Section 11.2 applies include the following:

1. Deletion requests (Section 9.2(c)). Version 1 stated that, on request, we delete the information we hold about you except your email address, which stays on the suppression list. This Policy also allows us to keep information that we are required by law to keep or that we need to establish, exercise or defend legal claims.
2. Response times (Section 9.6). Version 1 stated that we answer requests within 30 days, or within 45 days in California, where the period may be extended once. This Policy states that we respond within 30 days and may extend that period once by up to a further 30 days.
3. Do Not Track and Global Privacy Control (Section 5.4). Version 1 stated that we treat a Do Not Track or Global Privacy Control signal as an objection to any processing that you are entitled to object to. This Policy treats a Global Privacy Control signal as a request to opt out of any sale or sharing, and does not respond to a Do Not Track signal differently.
4. Security incidents (Section 7). Version 1 stated that, if a breach affects your information and creates a real risk to you, we will tell you and the relevant regulator without unreasonable delay. This Policy states that we will notify you, and any authority we are required to notify, as required by applicable law.
5. Encryption (Section 7). Version 1 stated that information is encrypted in transit and at rest. This Policy states that information is encrypted in transit, and at rest in the databases, document storage and log storage that we operate.
6. Disclosures (Section 4). Version 1 named Amazon Web Services and Mailgun as our only service providers, and otherwise described disclosures only to our accountants, lawyers or insurers, to authorities that the law obliges us to inform, and in connection with a sale of Mecavoy or its assets. This Policy adds our business email hosting provider, and disclosures in response to legal process or an enforceable governmental request, or where reasonably necessary to protect the rights, property or safety of Mecavoy, our users or others, or to prevent fraud.
7. How addresses are added to the mailing list (Section 2.5). Version 1 stated that we do not add addresses that were not given to us directly by the person to whom they belong. This Policy states that we add addresses submitted through the signup form on the Site or at the request of the person to whom the address belongs.
8. Logs and backups (Sections 2.4 and 6). Version 1 did not describe application logs or backups. This Policy states that application logs, which may include IP addresses, are kept for up to 90 days, and that deleted or changed records may remain in encrypted backups for up to 35 days.
9. Browser storage (Section 5). Version 1 stated that the Site sets no cookies at all. The public pages of the Site still set no cookies, but the Site stores limited information in your browser as described in Section 5.2, and the staff administration console sets a cookie for authorized staff only.

11.3 Applicants before Version 2.3

This Section 11.3 applies to you if you applied to the Program before Version 2.3 of this Policy was published. The changes that Version 2.3 makes to how we use information about applicants, including the sanctions screening described in Section 3.4, take effect for your application 30 days after the date on which we email you notice of them. Until then, we use the information in your application as Version 2.2 describes, and we do not check it against the sanctions lists.

12. Contact Us

Mecavoy LC, 5830 E 2nd St, Ste 7000 #38404, Casper, WY 82609, United States.

Privacy questions and requests: privacy@mecavoy.com. All other questions: support@mecavoy.com.

Version History

This version history is provided for information and does not form part of this Policy.

Version 2.3, September 26, 2026. Section 3 now reflects Version 1.1 of the Program Terms, under which Independent Agents may apply from the countries listed on the application form and the Registered Advisor track remains open only to individuals who reside in the United States. The principal changes are as follows:

1. Section 3.1 states who may apply on each track, and the Summary is updated to match;
2. Sections 3.2 and 3.3 describe the country and region we collect, the confirmation of the age and sanctions requirements, and the country (and, for a check only, the region) from which an application is submitted, and state that we do not ask for identity document numbers, tax identification numbers or payment details when you apply;
3. Section 3.4 describes the screening of applicants, and on the Registered Advisor track their businesses, against U.S. government restricted-party lists. It states that we do not search public records about applicants who live outside the United States, other than to confirm a credential they have submitted and to check those lists, or obtain criminal or court records about them, and that we do not record verification calls or keep copies of identity documents;
4. Section 3.5 adds the results of that screening to the information we generate, Section 3.6 sets out our legal bases for using application information, and Section 3.8 describes how long sanctions screening records are kept;
5. Section 4.3 adds the U.S. government services we use to search sanctions lists;
6. Section 5.2 states that a saved application draft also keeps the country, state, province or region the applicant chooses;
7. Section 8 states that we collect personal information directly from the people it is about and store it in the United States, describes the safeguards in our contracts with service providers and access by U.S. authorities, and states that this Policy is in English;
8. Section 9.3 now also covers Switzerland, Section 9.4 adds sanctions screening results and the country from which an application was submitted to the categories of information collected, Section 9.5 is added for individuals in other countries, and Section 9.6 describes how to complain to us;
9. Section 10 states the age requirement for applying to the Program; and
10. Section 11.3 is added. It states that, for people who applied before this version was published, the changes to how we use information about applicants take effect 30 days after we email them notice of the changes.

These changes do not change how we use information about subscribers.

Version 2.2, September 26, 2026. Sections 2.1, 2.3, 2.6 and 6(b) now describe how an address that has unsubscribed can rejoin the mailing list: if the address is entered in the signup form again, we email it one link to confirm, send no more than one such email in any 24 hours unless the link in the previous one was used, and add the address back only if the link is used within 48 hours. The suppression record, including the one kept for subscribers under Version 1, does not change unless the link is used. Section 6(b) also states how long a request to rejoin is kept, and how to stop these emails. In the Summary, the item on unconfirmed signups now says that it concerns the former two-step signup. No other provision of Version 2.1 is changed.

Version 2.1, September 26, 2026. Section 10 now states that anyone 13 years of age or older may subscribe to the mailing list, in place of the statement that the Site is intended for adults. The age requirements for claiming the Free Year and for applying to the Program are unchanged. No other provision of Version 2 is changed.

Version 2, September 25, 2026. Version 2 replaces Version 1, which covered the mailing list only. The changes are as follows:

1. Section 3 is added to cover applications to the Program. The Program is open only to individuals who reside in the United States and to businesses organized or registered there. Section 3.4 states that we do not obtain consumer reports from consumer reporting agencies, and that if we ourselves obtain public records about an applicant during verification, we will email the applicant a copy within seven days after we obtain them.
2. The description of how you subscribe is corrected, because subscribing no longer involves a separate confirmation step. Section 6(c) states that a signup that required a confirmation email and was never confirmed is not on the mailing list, receives no emails, does not reserve a Free Year and is deleted.
3. The description of the hashed value derived from your IP address is corrected.
4. Section 2.5 states that we add to the mailing list only addresses submitted through the signup form on the Site or at the request of the person to whom the address belongs.
5. Section 6 now describes the information kept after you unsubscribe, which includes your subscription status, the dates on which you subscribed and unsubscribed and any record of an undelivered email as well as your email address. If you subscribed while Version 1 of the Offer Terms was published, Section 6(b) provides that we keep only your email address, as those terms provide. Section 6(b) also states that unsubscribing does not end the Free Year reserved for your email address and that we use the address kept on the suppression list to apply it under the Offer Terms until the Offer lapses for that address, and Section 9.2 states that the Free Year can no longer be applied if we delete the address from the suppression list at your request. Sections 2.4 and 6 also describe application logs and the retention of application logs, correspondence and backups.
6. Section 5 now describes the browser storage used by the Site and the cookie used by the staff administration console. Version 1 stated that the Site sets no cookies at all.
7. Section 5.4 describes how we treat Global Privacy Control and Do Not Track signals. Version 1 stated that we treat either signal as an objection to any processing that you are entitled to object to. This Policy treats a Global Privacy Control signal as a valid request to opt out of any sale or sharing of personal information, and does not respond to a Do Not Track signal differently, because the Site does no tracking for that signal to stop.
8. Section 4.2 adds our business email hosting provider to the list of service providers, and Section 4.3 adds disclosures in response to legal process or an enforceable governmental request, or where reasonably necessary to protect the rights, property or safety of Mecavoy, our users or others, or to prevent fraud.
9. Section 7 states that personal information is encrypted at rest in the databases, document storage and log storage that we operate, and that we will notify you of a security incident as required by applicable law.
10. Section 9 extends the rights it describes to individuals wherever they live, adds rights for individuals in the European Economic Area and the United Kingdom, allows us to keep information that the law requires us to keep or that we need for legal claims when you ask us to delete your information, and describes authorized agents and appeals. Requests are answered within 30 days, which we may extend once by up to a further 30 days; Version 1 stated 30 days, or 45 days in California.
11. Section 11.2 is added. If you subscribed while Version 1 was published, a change made by Version 2 that reduces a commitment made to you in Version 1 takes effect for you 30 days after we email you notice of it, and until then the Version 1 commitment continues to apply. Section 11.2 describes those changes.

These changes describe our existing practices more accurately and add processing only for founding advisor applicants. They do not change the purposes for which we use the information we already hold about subscribers. Some of them reduce a commitment made in Version 1, and Section 11.2 sets out when those changes take effect for subscribers under Version 1.