The Shift asks you for unusually personal information — childhood memories, the beliefs you carry, people you've lost. This policy explains plainly what happens to it.
The short version: your intake is used to build your sessions and nothing else. It is never sold. It is never used for advertising. It is never shared with anyone except the specific service providers needed to create and deliver your recordings. You can have it deleted at any time.
Your intake will often contain sensitive personal information, including details touching on mental and emotional health. You provide it voluntarily and consent to its use for building your Program. Because The Shift is not a licensed healthcare provider, this information is not protected health information under HIPAA, and legal therapist–client privilege does not apply. It is still treated as confidential under this policy.
Not used for: advertising, profiling, resale, or training publicly available AI models on your personal content.
These providers process data strictly to deliver the Program:
| Provider | Purpose | What it receives |
|---|---|---|
| Stripe | Payments | Name, email, payment details |
| Supabase | Database | Intake responses, account records |
| Cloudflare | Hosting | Site traffic, request data |
| Anthropic | Session drafting | Intake responses, no name or contact details |
| ElevenLabs | Voice rendering | Finished session text |
| Cloudinary | Audio hosting | Your recordings |
| Resend | Name, email, session links |
Your data may also be disclosed where required by law, or where there is a genuine belief it is necessary to prevent serious harm to you or someone else.
You may request access to your data, correction, deletion, a portable copy, or restriction of processing. Email marcus@theshift.energy and we will respond within 30 days.
Deletion removes your intake, session scripts, and recordings permanently. Payment records are retained where law requires. If you are in California, the EEA, or the UK, you have additional statutory rights, including the right to complain to your data protection authority — and we will not discriminate against you for exercising them.
Data is encrypted in transit and at rest. Database access is restricted to the application and to Marcus. Payment data never touches our servers. No system is perfectly secure, but the amount of personal history in an intake is taken seriously; if a breach affects your data, you will be notified without undue delay.
Cookies: only what's needed to make the site and checkout work. No advertising or third-party tracking cookies.
Children: the Program is for adults 18+. Information from minors is not knowingly collected; if we learn we have, it is deleted.
International: data is processed in the United States. Enrolling from elsewhere means consenting to that transfer.
Changes: material changes will be emailed to active clients.