Online Privacy Policy for The Miracle School

Last Updated: 7/2/26  Effective Date: 7/2/26

 

At The Miracle School, we are committed to protecting your privacy and personal data. This Privacy Policy (“Policy”) explains how we collect, use, disclose, and protect your personal data when you visit our website, www.themiracleschool.net, and use our services. We comply with global privacy laws, including but not limited to:

• General Data Protection Regulation (GDPR) (UK, EU, and EEA) 
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) (California, US )
• Lei Geral de Proteção de Dados (LGPD)(Brazil) Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada) 
• Act on the Protection of Personal Information (APPI) (Japan) 
• Australian Privacy Principles (APPs) under the Privacy Act 1988 (Australia) 
• By using our website, you agree to the collection and use of personal data in accordance with this Policy.

 

 

1. Introduction and Scope

This Policy applies to all personal data processed by The Miracle School in connection with our services and website visitors. 

 

Our Contact Details: The Miracle School Mailing Address: 500 Westover Drive, Sanford, NC, USA. Phone Number: 206-629-4344. Email Address: contact(at)themiracleschool.net

 

Data Protection Officer (DPO) / Privacy Contact: Sherry Daniel, Ph.D., contact(at)themiracleschool.net

 

We encourage you to read this Policy carefully to understand our practices regarding your data and how we will treat it.

 

 

2. Information We Collect 

We collect various types of information for different purposes to provide and improve our services to you. We only collect data that is necessary for the stated purposes.

2.1. Personal Data

This includes information that can be used to identify you directly or indirectly. The categories of personal data we may collect include:

• Identifiers: Name, email address, postal address, phone number, IP address, gender, country, age, online identifiers. 
• Purchase Information: Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories.
• Financial Information: Payment card details (processed securely by third-party payment processors; we do not store full payment card numbers), billing address.
• Account Information: Username, password, preferences, feedback.
• Communications: Information you provide when contacting us, such as support inquiries.
• Professional or Employment-Related Information: Job title, company name (if you interact with us in a business capacity).
• Education Information: (If relevant to our services.)

2.2. Usage Data

When you access our website we may automatically collect certain anonymous information such as the pages  viewed and the country of origin. This is done by our Plausible Analytics which is compliant with global privacy standards. Plausible does not engage in personal tracking.

 

No cookies are used on the website except for ones that are rated exempt by GDPR (General Data Protection Regulation) and all other privacy standards.  These cookies are needed for necessary online functionality.

 

2.3. Sensitive Personal Information

We may collect, use, store and otherwise process certain types of personal data that are considered sensitive, special category, or protected data, under global data protection laws. This is information that you have voluntarily provided in order to receive Source Guidance about your life situation. This may include any information that you choose to share with us. This could include:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs 
• Physical or mental health data 
• Sexual orientation or sex life 
• Financial account information (where considered sensitive under applicable law)
• Precise geolocation data 

 

We only process this type of data when: 

• You have given your explicit consent by providing the information. 
• It is required or authorized by law 
• It is necessary to protect your vital interests 
• It is necessary for the establishment, exercise, or defense of legal claims 
• It is in the substantial public interest, in line with applicable laws
• It is required for employment, social security, or social protection obligations

 

We implement appropriate safeguards to protect this information, including: 

• Encryption for information in transit 
• Secure storage 
• Access restrictions and role-based controls 
• Staff training and confidentiality obligations 
• Data minimization and retention limits 

 

We will never use sensitive personal data for marketing or profiling without your explicit consent where required. 

 

Your rights regarding this data, including access, correction, deletion, objections, and withdrawal of consent, may vary depending on your jurisdiction. Please refer to the “7. Your Data Protection Rights” section of this policy or contact us at  contact(at)themiracleschool.net for further details.

 

2.4. Tracking Technologies

No personalized tracking technologies are used by the website, Plausible Analytics, or Wistia, the website video service provider.  Mailchimp and Foxycart track personal information that you have submitted. No cookies are used on the website except for ones that are rated exempt by GDPR (General Data Protection Regulation) and all other privacy standards.  For more details see section #4.

 

3. How We Use Your Information 

We use the collected data for various purposes, based on specific legal bases:

• To Provide and Maintain Our Service: Including to process your transactions, manage your account, and deliver the services you request.

         Legal Basis: Performance of a contract.

• To Send You Source News Updates through Connecting Emails: When you signup for a gifted membership in Connecting you consent to receive emailed Source News Updates about The Work of the Source.  You can retain access to all of the gifted Source-Directed Activism materials on the website that come with your membership in Connecting and unsubscribe at any time from the Connecting emails. The unsubscribe link is in the footer of Connecting emails.

        Legal Basis: Consent. We obtain your consent through clear opt-in mechanisms, such as checkboxes. 

• For Miracle School Support: To respond to your inquiries, provide technical support, and resolve issues.

         Legal Basis: Performance of a contract, legitimate interests (to provide good customer service).

• For General Anonymous Website Analytics and Research: To monitor and analyze trends, usage, and activities in connection with our services.

         Legal Basis: Legitimate interests (to understand and improve our services).

• For Security and Fraud Prevention: To detect, prevent, and address technical issues, fraud, or illegal activities.

        Legal Basis: Legitimate interests (to protect our business and users), legal obligation. Where we rely on

        legitimate interests, we have conducted a balancing test to ensure our interests do not override your 

        rights and freedoms.

• To Comply with Legal Obligations: To meet our regulatory and legal requirements, such as tax and accounting obligations.

         Legal Basis: Legal obligation.

 

No personal information is derived from website analytics tracking. The personal information we have is the information that you have voluntarily provided to us in order to receive our services. 

 

4. How We Share Your Information 

We may share your personal data with third party Service Providers needed to provide you with the services offered by The Miracle School. Appropriate safeguards are in place with these providers.  Please refer to a list of our Service Providers below: 

 

Foxycart (foxy.io) is our shopping cart servicer. They keep your financial data which is not stored on our servers. They maintain records of your purchase history.  They protect your data through password protected access. They are compliant with global privacy standards.

 

Mailchimp (mailchimp.com) sends out Connecting emails to members who have signed up for a gifted membership in Connecting. The signup form is a custom form that only gives Mailchimp the information that you provide such as your name, email address, and country. Mailchimp may also automatically receive technical information such as your IP address as part of the standard operation of internet communications. This may be used for security and fraud prevention. They do not sell your personal information and are in compliance with global privacy standards such as GDPR. No Track settings prevent tracking of responses to emails. You can unsubscribe from Source News Update emails sent by Mailchimp at any time by clicking on the unsubscribe link at the bottom of every Connecting email. You will still be able to access Gifted Source-Directed Activism Trainings online by using the Connecting Login that you create when you subscribe to a gifted membership in Connecting.

 

Wistia (wistia.com) provides the service that enables Miracle School videos to be available on the website. Wistia provides analytics on views of the videos but there is no personal tracking that attributes a view to a particular person.  Privacy is achieved with the activation of a setting to anonymize IP addresses so that they are not linked to any particular person but just give general geographical information about the country of the person watching the video. This, in effect, means that they are not storing any personal information. They are compliant with global privacy standards.

 

Plausible Analytics (plausible.io) provides analytics for page views on the website.  It does not store any personal information. Plausible is compliant with global privacy standards.

 

Foxycart and Mailchimp are the only two Service Providers who store any personal information. They are both compliant with global privacy standards which include data transfer standards.

 

4.1. Service Providers: We may engage third-party companies and individuals to facilitate our services, perform service-related services, or assist us in analyzing how our service is used (e.g., hosting providers, payment processors, analytics providers, email service providers). These third parties have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

 

4.2. Business Transfers: The Miracle School will not be involved in a merger or sale to another company. Your personal data will remain within the jurisdiction of The Miracle School. 

 

4.3. Legal Requirements: We may disclose your personal data in the good faith belief that such action is necessary to:

• Comply with a legal obligation (e.g., subpoena or court order).
• Protect and defend the rights or property of The Miracle School. 
• Prevent or investigate possible wrongdoing in connection with the service.
• Protect the personal safety of users of the service or the public.
• Protect against legal liability.

 

4.4. With Your Consent: We may disclose your personal data for any other purpose with your explicit consent.

 

4.5. Aggregated or De-identified Data: We may share aggregated or de-identified information that cannot reasonably be used to identify you.

 

5. International Data Transfers

Your information, including personal data, may be transferred to — and maintained on — servers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

 

For transfers of personal data from the European Economic Area (EEA), UK, or Switzerland to countries not deemed to provide an adequate level of data protection by the European Commission or relevant authorities, we implement appropriate safeguards, such as:

• Standard Contractual Clauses (SCCs): Approved by the European Commission, obliging recipients to protect personal data to the GDPR standards.
• Data Privacy Framework Certification

 

Data Privacy Framework Certification maintains safe data transfer conditions when data is transferred between our US based service providers and other countries.

 

We periodically evaluate Service Providers to ensure that they remain compliant with global transfer standards.

 

By providing your personal data, you consent to this transfer, storage, and processing. Where consent is the legal basis for transfer, you have the right to withdraw that consent at any time.

 

 

6. Data Security and Retention 

 

6.1. Data Security: We employ industry-standard technical and organizational security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: Using SSL/TLS encryption for data in transit (HTTPS).
• Access Controls: Restricting access to personal data to authorized personnel only.
• Data Minimization: Collecting only necessary data.
• Regular Security Audits: Conducting periodic reviews of our security practices.
• Employee Training: Educating our staff on data protection and security.
• Pseudonymization/Anonymization: Where feasible and appropriate.

 

While we strive to use reputable methods to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.

 

6.2. Data Retention: We will retain your personal data only for as long as is necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law (e.g., for legal, tax, or accounting purposes).

When we no longer need your personal data, we will securely delete or anonymize it in accordance with applicable law.

 

7. Your Data Protection Rights

Depending on your location and applicable privacy laws, you have various rights regarding your personal data. We are committed to facilitating the exercise of these rights.

7.1. General Rights (Applicable Broadly, e.g., GDPR, CCPA, LGPD, PIPEDA, APPI, APPs):

• Right to Be Informed: You have the right to know what personal data we collect, why we collect it, and how we use it. This Policy serves to fulfill this right.
• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Correction): You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to Erasure (Deletion / “Right to Be Forgotten”): You have the right to request the deletion of your personal data under certain circumstances (e.g., if the data is no longer necessary for the purposes for which it was collected).
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under certain conditions (e.g., if you contest the accuracy of the data).
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data for continuing Connecting emails by unsubscribing from Source News Update emails.  The unsubscribe link is in the footer of each Connecting email. This will remove all personal information on Mailchimp servers.
• Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

7.2. Specific Rights by Region:

• For California Residents (CCPA/CPRA):
• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected, the categories of sources from which personal information is collected, the purpose for collecting or sharing personal information, and the categories of third parties to whom we disclose personal information. [This Privacy Policy provides information on these issues.]
• Right to Opt-Out of Sale or Sharing: You have the right to opt-out of the “sale” or “sharing” of your personal information (as defined by CCPA/CPRA) for cross-context behavioral advertising. [We do not engage in cross-context behavioral advertising. This Privacy Policy explains the details.]
• Right to Limit Use and Disclosure of Sensitive Personal Information: You have the right to limit the use and disclosure of your sensitive personal information (as defined by CCPA/CPRA) to only that which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services. [This Privacy Policy explains how we deal with personal information.}
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
• Right to Correct Inaccurate Personal Information.
• For Brazilian Residents (LGPD):
• Similar rights to GDPR, including confirmation of processing, access, correction, anonymization/blocking/deletion, portability, deletion of data processed with consent, information about shared data, information about possibility of denying consent and consequences, and revocation of consent.
• For Canadian Residents (PIPEDA):
• Similar rights to access, correction, and challenging compliance. Emphasis on accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and recourse.
• For Japanese Residents (APPI):
• Similar rights to disclosure, correction, cessation of use, and deletion of personal information. Requirements for appropriate security measures and supervision of service providers.
• For Australian Residents (APPs):
• Similar rights to access and correction. Specific principles regarding collection, use, disclosure, data quality, data security, and direct marketing.
• For EU/UK Residents:
• If you believe your rights have been violated, you have the right to lodge a complaint with your local data protection authority. For the UK: https://ico.org.uk/; for the EU: https://www.edpb.europa.eu/edpb_en

7.3. How to Exercise Your Rights: To exercise any of these rights, please contact Sherry Daniel, PhD., Director of The Miracle School at: contact(at)themiracleschool.net or call 206-629-4344. 

 

We will respond to your request within the timeframes required by applicable law (e.g., 30 days under GDPR, 45 days under CCPA). We may need to verify your identity before fulfilling your request. You may exercise your rights free of charge, unless requests are manifestly unfounded or excessive.

 

8. Children’s Privacy

We do not knowingly collect personally identifiable information from children without verifiable parental consent.

 

If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.

 

9. Links to Other Websites

Our services may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the privacy policy of every site you visit.

 

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

 

10. Changes to This Privacy Policy

We may update this Policy from time to time. We will notify you of any changes by posting the new Policy on this page and updating the “Last Updated” date at the top of this Policy.

 

We will also inform you via an Update Notice on the Privacy Link on our website. 

 

You are advised to review this Policy periodically for any changes. Changes to this Policy are effective when they are posted on this page.

 

11. Complaints and Supervisory Authorities 

If you have concerns about our privacy practices, please contact us directly using the details provided in Section 1 above.

 

You also have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction:

• For EU/EEA Residents: You can contact the data protection authority in your Member State. A list of authorities can be found here: [Link to European Data Protection Board (EDPB) list, if available, or instruct them to search for their local DPA].
• For UK Residents: Information Commissioner's Office (ICO)
• For Canadian Residents: Office of the Privacy Commissioner of Canada (OPC)
• For Brazilian Residents: Autoridade Nacional de Proteção de Dados (ANPD)
• For Australian Residents: Office of the Australian Information Commissioner (OAIC)
• For California Residents: California Attorney General or the California Privacy Protection Agency (CPPA).