Privacy Policy

This Privacy Policy explains how Autism Possible LLC, doing business as Repped Labs™ (“Repped Labs,” “we,” “us,” or “our”), collects, uses, shares, and protects personal information when you visit reppedlabs.org (the “Site”), join our email list, give feedback, book a session, support our work, or otherwise interact with us (together, the “Services”). By using the Services, you agree to this Policy. If you do not agree, please do not use the Services.

1. Information we collect

Information you give us

• Sign-up information: your name, email address, organization (optional), and the programs you are interested in (Builder, Community, or Workforce).
• Feedback: your reactions to and suggestions about our shows and programs, along with your name and email address.
• Communications: anything you send us by email, including replies to our emails.
• Survey information: some people who joined our earlier list (Repped in Tech) chose to answer survey questions, which may include information about neurodivergence or neurotype. This may be sensitive personal information. We keep it only for the purposes you shared it for, restrict who can access it, and never sell it or use it for advertising.
• Payments and bookings: if you support our work or book a paid session, our payment and scheduling providers (Stripe and Calendly) collect the information needed to complete the transaction. We receive confirmation details such as your name, email, amount, and booking time. We do not receive or store full card numbers.

Information collected automatically

• Usage and device data: pages viewed, links clicked, approximate location (city or region), browser and device type, and referring site, collected through Google Analytics and our hosting provider.
• Campaign data: marketing tags in the link you used to reach us (for example, utm_source), the referring site, and the first page you visited, stored with your sign-up so we know which outreach works.
• Security data: IP addresses are used to block abuse and enforce rate limits. We store only a one-way hashed form for this purpose and delete it within a day.
• Email engagement: whether our emails were delivered, opened, or clicked, collected by our email provider.

2. How we use information

• To confirm your email address and add you to our list after you confirm.
• To send you updates, program information, and occasional requests for support. You can unsubscribe at any time.
• To respond to your messages, feedback, and booking requests.
• To plan, build, and improve our programs, shows, and the Site.
• To understand which outreach brings people to us.
• To process payments and send receipts.
• To protect the Services, prevent fraud and abuse, and comply with the law.
• To create an account for you on future Repped Labs platforms. Confirming your email creates a basic account that we may use to let you sign in later.

Where privacy laws require a legal basis, we rely on your consent (for example, to send marketing email), on performing a contract with you (for example, a paid session), on our legitimate interests (for example, security and improving the Services), and on legal obligations.

3. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Service providers who process information for us under contract: Vercel (website hosting), Supabase (database and accounts), MailerLite (email campaigns), Resend (confirmation emails), Google Analytics (site analytics), Stripe (payments), and Calendly (scheduling).
• Partners, with your permission: we will not share your information with community or workforce partners unless you ask us to or agree first.
• Legal and safety: when required by law, legal process, or to protect the rights, safety, and property of Repped Labs, our users, or others.
• Business changes: if Repped Labs is involved in a merger, acquisition, or sale of assets, information may transfer under this Policy’s protections.

4. Cookies and similar technologies

We use Google Analytics cookies to measure how the Site is used, and browser session storage to remember how you arrived (campaign tags) until you sign up. We do not use advertising cookies. You can block or delete cookies in your browser settings, or install the Google Analytics opt-out add-on. We treat a Global Privacy Control (GPC) signal as a request to opt out of any sale or sharing of personal information. We do not currently respond to “Do Not Track” signals, because there is no common standard for them.

5. Email and your choices

We send marketing email only after you confirm your address. Every marketing email includes an unsubscribe link and our mailing address. You can also unsubscribe by emailing hello@reppedlabs.org. After you unsubscribe we may still send messages about things you asked for, such as a booking or a receipt. We follow the CAN-SPAM Act.

6. Children

You must be 13 or older to sign up yourself. A parent or legal guardian may sign up a child under 13 using the parent’s or guardian’s own contact information. We do not knowingly collect personal information directly from children under 13, in line with the Children’s Online Privacy Protection Act (COPPA). If you believe a child under 13 has given us personal information, contact hello@reppedlabs.org and we will delete it. Parents and guardians can review, change, or delete information they provided about their child at any time.

7. How long we keep information

We keep sign-up information while you remain on our list and for a reasonable time afterward to honor your choices (for example, we keep your address on a suppression list so we never email you again after you unsubscribe). Unconfirmed sign-ups may be deleted after 90 days. Feedback is kept while it helps us plan our programs. Payment records are kept as long as tax and accounting laws require. Hashed security data is deleted within a day.

8. Your rights

Depending on where you live, you may have the right to:

• know what personal information we have about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• opt out of marketing, and of any sale or sharing (we do neither);
• limit the use of sensitive personal information;
• withdraw consent at any time; and
• not be treated differently for using these rights.

These include rights under the California Consumer Privacy Act as amended (CCPA/CPRA), the Tennessee Information Protection Act, other U.S. state privacy laws, and, for visitors in the European Economic Area or the United Kingdom, the GDPR and UK GDPR (including the right to object, to restrict processing, to data portability, and to complain to your local data protection authority). To make a request, email hello@reppedlabs.org. We will verify your request by confirming control of your email address and respond within the time the law requires (generally 30 to 45 days). An authorized agent may make a request for you with your written permission. If we deny your request, you may appeal by replying to our decision; we will respond to appeals within the time the law requires.

9. Security

We use reasonable safeguards, including encrypted connections (HTTPS), database access rules that keep sign-up and feedback data from being read through public interfaces, limited staff access, and rate limits against abuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as the law requires.

10. International visitors

Repped Labs is based in the United States, and our service providers process information in the United States and other countries. By using the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

11. Links to other sites

The Site links to partner and third-party sites, such as Stripe and Calendly. Their privacy practices are governed by their own policies, not this one.

12. Changes to this Policy

We may update this Policy from time to time. We will post the new version here with a new effective date and, if the changes are significant, tell you by email or on the Site before they take effect.

13. Contact us