Privacy Policy

1. Scope

This Privacy Policy applies to visitors of all websites operated by Ryan Hanau, Inc. ("RHI," "we," "us"), including:

• •ryanh.com
• •experienceplus.ai
• •aileadership.one
• •uxrcourse.com
• •creativeconversion.one
• •lilikoi.one
• •Any subdomains of these sites (including, for example, plusone, unlimited, sprint, heuristics, testing, develop, geo, brand, growth, and portfolio subdomains)
• •Future websites operated by RHI

Experience Plus, Lilikoi, Creative Conversion, and our other site brands are brands of Ryan Hanau, Inc.; this single policy governs them all. This policy covers website visitors, form submissions, purchases made through our sites, and participation in our programs. It does not cover the substance of client engagements, which are governed by our client agreements.

Where a specific product or program collects something this policy doesn't describe generally, the property-specific details in Section 3 apply.

2. Information We Collect

Automatically collected:

IP address, browser type and version, referring website, pages visited and time spent, date/time of visit, and device information.

Information you provide:

• •Name, email address, and phone number (if provided)
• •Message content from contact forms, and anything else you choose to share when contacting us
• •Account credentials (email and password) when you register for or sign in to gated areas of our sites (e.g., portfolio and course areas). Authentication is managed via our backend provider; we do not store passwords in plaintext.
• •Newsletter subscription email addresses

Referral and payment information.

If you participate in the Plus One referral program, we also collect:

• •The name, company, email address, and other contact details of the person you refer, along with any context you choose to share about them
• •Payment details you provide so we can pay a finder's fee you've earned
• •Tax identification information required by law to make that payment, including a Form W-9 or Form W-8BEN/W-8BEN-E, which may contain a Social Security number, Individual Taxpayer Identification Number, or Employer Identification Number

We treat taxpayer identification numbers as sensitive personal information. We collect them solely to pay you and to meet our tax reporting obligations, and we do not use or disclose them for any other purpose, including to infer characteristics about you.

Information you provide about others.

Some features of our websites — including the Plus One referral program — let you submit information about another person, such as a prospective client's name and contact details. Only share someone's information if you have the appropriate permission to do so. We use information submitted about others to evaluate the referral and to contact that person about working with us, as described in this policy and the applicable program terms. If someone's information was shared with us and they'd prefer we not hold it, they can contact us and we will delete it, subject to the retention requirements in Section 8.

Purchase information.

When you buy a service, subscription, or course through our sites, payment is processed by Stripe. We receive transaction confirmations, billing name and email, and order details; we do not receive or store full card numbers.

Third-party collection:

Some features of our websites may be built using third-party platforms that collect their own analytics and usage data. We cannot control or disable all third-party data collection embedded at the platform level.

3. Property-Specific Details

uxrcourse.com (UX Research Course).

Course purchases are processed by Stripe. Course access requires an account; sign-in state is maintained using local storage in your browser. uxrcourse.com does not use the cross-subdomain session cookie described in Section 5 — its sign-in is intentionally separate from our other sites. Course progress data (lessons completed, quiz results) is retained for the life of your account.

plusone.experienceplus.ai (Plus One referral program).

Referral submissions are governed by this policy and the Plus One Referral Program Terms. The program is offered in the United States only.

Gated portfolio and client areas.

Access credentials and session metadata are collected as described in Section 2.

If a property's practices differ from this policy in a material way not listed here, that property will say so on the relevant page.

4. How We Use Information

We use collected information to:

• •Respond to your inquiries and provide requested information or services
• •Process purchases and deliver products, subscriptions, and course access
• •Administer the Plus One referral program and evaluate referrals
• •Pay finder's fees and meet related tax reporting obligations
• •Prevent spam and fraud
• •Improve website functionality and analyze website usage patterns
• •Send marketing communications (only with your consent)
• •Comply with legal obligations

We do not sell, rent, or trade your information to third parties for their marketing purposes.

5. Cookies and Tracking

Our cookies.

We use limited essential cookies for website functionality, including a session cookie scoped to .experienceplus.ai that enables single sign-on across our subdomains. These cookies are necessary for the website to operate properly. You can disable cookies through your browser settings, though some features (including sign-in) may not work correctly. uxrcourse.com maintains sign-in state in browser local storage rather than cookies (see Section 3).

Analytics.

We use Umami, a privacy-preserving, open-source analytics tool that we self-host on our own infrastructure. Umami does not use cookies and does not collect any personally identifiable information. It records only aggregated, anonymized usage data — such as page views, referring sites, and general device, browser, and country information. It does not track you across other websites, does not create a profile of you, and does not sell or share your data. Because it collects no personal data and sets no cookies, no analytics consent banner is required. You can opt out by using a browser or extension that blocks analytics scripts.

Third-party tracking.

If our websites are built or hosted using third-party platforms or services, those platforms may implement their own analytics or tracking that we cannot fully control. We are not responsible for platform-level tracking.

6. AI Development Disclosure

Portions of our websites may be developed using artificial intelligence tools. These platforms have their own privacy practices beyond our control.

7. Information Sharing

We may share your information with:

Service providers:

Web hosting and infrastructure (our sites are hosted on services such as GitHub Pages; our analytics are self-hosted with Umami, so usage data is not shared with any third-party analytics provider), payment processing (Stripe), email service providers, security and anti-spam services, and other providers necessary to operate our websites.

Legal requirements:

We may disclose information when required by law, court order, or legal process, or when necessary to protect our rights or property, prevent fraud or cybersecurity threats, respond to government requests, or protect public safety.

Business transfers:

Information may be transferred in connection with a merger, acquisition, or sale of assets.

8. Data Retention

• •Contact form submissions: Retained as needed for business purposes or legal requirements.
• •Authentication records (account email, session metadata, course progress): Retained for the life of your account; deleted on request per Section 10.
• •Security and abuse-prevention logs (IP addresses tied to login attempts and rate-limit windows): Automatically purged on a rolling schedule — login-attempt records after 90 days, rate-limit records after 7 days.
• •Referral submissions: Retained for the duration of the twelve-month referral window and for a reasonable period afterward to administer the program, resolve attribution questions, and maintain a record of referrals we've received. Referrals that don't convert are deleted or anonymized after that period.
• •Referred prospect information: If a referred prospect doesn't become a client, we retain their contact information only as long as needed for ordinary business follow-up, and we delete it on request. If they do become a client, their information is governed by our client relationship, not this policy.
• •Payment and tax records: Retained as required by law. Tax forms and payment records supporting a Form 1099 are generally retained for at least four (4) years after the applicable tax is due or paid, and we cannot delete them on request during that period.
• •Website analytics: Aggregated and anonymized as described in Section 5.
• •Legal compliance: We may retain information longer if required by law or for legal defense purposes.

9. Security

We implement commercially reasonable security measures appropriate to the nature of the information collected. However, no internet transmission or storage system is completely secure, and we cannot guarantee absolute security. We maintain incident response procedures in compliance with applicable law.

10. Your Rights

You may request to:

• •Access information we have about you
• •Correct inaccurate information
• •Delete your information, except where we're required to retain it — for example, tax and payment records described in Section 8
• •Opt out of marketing communications
• •Know what information we collect and how we use it

To exercise these rights, use our contact form at https://experienceplus.ai/contact. Requests concerning any RHI property can be made there.

California residents have additional rights under CCPA/CPRA: the right to know categories of information collected; the right to know if information is sold or shared (we do not sell personal information); the right to opt out of sale (not applicable, as we don't sell data); the right to limit use of sensitive personal information; and the right to non-discrimination for exercising privacy rights.

EU/EEA residents: As described in Section 13, our websites and services are not directed to individuals in the EU/EEA and we do not knowingly collect their personal data. If you believe we hold personal data about you and you are in the EU/EEA, contact us and we will delete it and confirm the deletion.

11. Third-Party Links

Our websites may contain links to other sites. We are not responsible for the privacy practices or content of third-party websites. We encourage you to read the privacy policies of any linked sites you visit.

12. Children's Privacy

Our websites are not directed to individuals under 16. We do not knowingly collect personal information from children under 16. If we learn we have collected information from a child under 16, we will delete it promptly.

13. International Data Transfer

Our websites and all associated services are operated by RHI and are intended solely for users located outside the European Economic Area (EEA). We do not knowingly collect, store, or process personal data from individuals who are physically present in the EEA. If you are an EU/EEA resident, please refrain from submitting any personally identifying information. Should any EU-resident personal data be received inadvertently, we will promptly delete it from our systems and confirm the deletion upon request.

This also applies to information submitted about other people. If you refer or otherwise provide us with the contact details of someone located in the EU/EEA, we will delete that information rather than process it.

For users outside the EEA: if you access our websites from outside the U.S., your information will be transferred to and processed in the U.S.

14. Changes to This Policy

We may update this policy periodically. Check the "Last Updated" date for the most recent version. Continued use of our websites after changes constitutes acceptance of the updated policy.

15. Platform Limitations

Our websites may be built or hosted using third-party platforms that impose their own technical features, analytics, or data collection that we cannot fully control or disable. While we select platforms with privacy in mind, we are not responsible for platform-level features beyond our control.

16. Do Not Track

Our websites do not respond to "Do Not Track" browser signals. Some third-party services we use may track your activities across other websites.

17. Contact Information

For privacy questions or to exercise your rights:

• •Contact form: https://experienceplus.ai/contact
• •Mail: Ryan Hanau, Inc., 1831 Poipu Rd Apt 720, Koloa, HI 96756-9429

All privacy-related requests should be submitted through our contact form for fastest response.

This policy is the single privacy policy for all Ryan Hanau, Inc. properties. Individual sites link here rather than hosting separate copies.