Privacy Policy

Effective date: September 14, 2026

This Privacy Policy explains how Dr. Lisa Gold and Soul Surfing (collectively, “we,” “us,” or “our”) collect, use, store, and share information when you visit drlisagold.com, use the Soul Surfing App, communicate with us, or apply for or purchase our services.

Information we collect

Depending on how you interact with us, we may collect:

Account and profile information, such as your email address, initials, account role, authentication details, and invitation or access status.
Google account information, when you choose “Sign in with Google,” as described in the Google user data section below.
Soul Surfing App content, such as worksheet responses, assessment responses and scores, appointments, consent records, progress, and program-access records.
Information you submit on our website, such as contact details, messages, registration information, practitioner applications, professional credentials, and uploaded supporting documents.
Transaction information, such as the product or service purchased, payment status, transaction identifiers, and limited billing details. Payment-card information is processed by our payment provider and is not stored by us.
Technical and usage information, such as IP address, browser and device information, timestamps, requested pages, security events, and cookie or session information needed to operate and protect the website and app.

Please do not enter diagnoses, treatment records, identifying medical details, or other protected health information into the Soul Surfing App. The app is a coaching and educational tool and is not represented as a HIPAA-compliant system.

Google user data

The Soul Surfing App offers Google Sign-In as an optional way to authenticate. If you use it, the app requests only the basic Google account information needed to sign you in: your Google account identifier, email address, email-verification status, name, and profile image, when available. The app does not request access to Gmail, Google Drive, Google Calendar, contacts, or other Google Workspace content.

We use Google user data only to:

authenticate you and maintain your account session;
associate your sign-in with your invited Soul Surfing account;
display basic account information; and
prevent fraud, unauthorized access, and duplicate or ineligible accounts.

Google authentication data is transmitted through Google and our authentication provider, Supabase, and stored only as needed to operate and secure your account. We do not sell Google user data, use it for advertising, or use it to train generalized artificial-intelligence or machine-learning models. We do not transfer it to third parties except service providers acting on our behalf to provide authentication, hosting, security, and app functionality; when required by law; or with your explicit consent. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

How we use information

We use collected information to:

provide, personalize, secure, and maintain the website, Soul Surfing App, programs, and services;
authenticate users and enforce invitation, role, and access controls;
save user-requested worksheets, assessments, appointments, progress, and account settings;
process applications, registrations, transactions, refunds, and program access;
respond to questions and send service-related communications;
detect abuse, troubleshoot problems, keep security records, and improve reliability; and
comply with legal, accounting, and regulatory obligations.

We do not sell personal information. We do not use personal information for targeted advertising.

How we share information

We share information only as reasonably necessary with vendors that help us provide the services, including:

Google, for Google Sign-In;
Supabase, for authentication, database, and application infrastructure;
Vercel, for website and application hosting and delivery;
Stripe, when applicable, for payment processing and transaction administration; and
communications, email-delivery, security, and infrastructure providers used to operate the services.

These providers process information under their own terms and privacy policies and are permitted to use information only as necessary to provide their services to us. We may also disclose information if required by law, to protect rights or safety, in connection with a business transfer, or at your direction. We do not share personal information with data brokers.

Cookies and sessions

We use cookies and similar technologies that are necessary for authentication, security, invitation handling, and essential site functionality. We may also use privacy-conscious analytics to understand aggregate website usage. You can control cookies through your browser, but disabling essential cookies may prevent sign-in or other features from working.

Data storage, security, and retention

Information may be processed and stored in the United States by us and our service providers. We use access controls, encrypted network connections, row-level database protections, session security, rate limiting, and logging intended to protect information. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

We retain account and app information while your account is active and for as long afterward as reasonably necessary to provide the services, resolve disputes, prevent abuse, enforce agreements, and meet legal, tax, accounting, or security obligations. Retention periods vary by record type. Information may remain for a limited time in protected backups after deletion.

Your choices and rights

You may choose not to use Google Sign-In and use another available sign-in method. Where the Soul Surfing App provides these controls, signed-in clients can download their account data or request permanent account deletion from Settings → Your data & privacy. Account deletion removes the user account and associated app records subject to limited legal, security, transaction, and backup retention requirements.

You may also contact us to request access to, correction of, or deletion of your personal information, or to withdraw consent where applicable. We may need to verify your identity before completing a request. Depending on where you live, you may have additional privacy rights and the right to appeal a request decision or contact your local privacy regulator.

Children’s privacy

The website and Soul Surfing App are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, please contact us so we can address it.

Third-party links

Our services may link to websites or services we do not control. Their privacy practices are governed by their own policies, not this one.

Changes to this policy

We may update this policy as our services or legal obligations change. We will post the revised policy here and update the effective date. Material changes may also be communicated through the app or by email when appropriate.

Contact us

For privacy questions or requests, email soulsurfing@drlisagold.com or use our contact form.

This policy describes our current operational practices and should be reviewed by qualified privacy counsel as the services evolve.