Privacy Policy and How Your Information Is Used

Wayward Leaders LLC

Wayward Leaders LLC (“Wayward Leaders,” “we,” “us,” or “our”) is a South Dakota limited liability company. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information when you visit or use www.waywardleaders.com, www.vfdmentor.ai, www.brandloyalty.ai, www.moduslimbi.com, waywardcarl.gumroad.com, and our related Training, Technical Consulting, and Professional Services (collectively, the “Services”). Capitalized terms not defined here have the meanings given in our Terms and Conditions.

This Privacy Policy is governed by the laws of the United States and the State of South Dakota. We have included additional sections for individuals in the European Economic Area, the United Kingdom, and California, whose laws grant specific rights. Where any of those sections apply to you, they supplement (and, where stricter, prevail over) the general provisions of this Privacy Policy.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not access or use the Services.

1. Scope

This Privacy Policy applies to personal information we collect or process in connection with the Services, including when you:

visit, browse, or interact with our websites;
use VFD Mentor, the simulations, or other Tools;
purchase a book, Digital Product, Training, or service;
attend Training or take part in Technical Consulting or Professional Services;
respond to a survey or assessment we run for an organization;
subscribe to a newsletter, download a report, or request a quote;
contact us by email, phone, web form, or social media, or we contact you about our services;
submit feedback, reviews, comments, or other user-generated content.

This Privacy Policy does not apply to personal information collected by independent third-party platforms (including Gumroad and Stripe) under their own privacy policies, except to the extent we receive that information and use it for our own purposes.

2. Data Controller and Contact

Wayward Leaders LLC is the controller of the personal information we collect through the Services (or, where required by applicable law, the equivalent term such as “business” under the California Consumer Privacy Act), except where Section 5 says we act on behalf of an organization.

Wayward Leaders LLC

Sioux Falls, South Dakota, United States

Privacy contact: Dr. Carl Lee Tolbert

Email: carl@waywardleaders.com

Phone: (678) 523-2050

3. Information We Collect

3.1 Information you provide to us.

Identity and contact data: name, email address, telephone number, job title, employer or organization, postal address (where provided), and similar information you submit when ordering, requesting a quote, registering, or contacting us.
Account data: username, password (stored in hashed form), and preferences, where a Tool requires an Account.
Order and transaction data: records of products and services purchased, quotes, Statements of Work, invoices, order numbers, billing details, and limited payment metadata. Full payment card numbers are not stored on our systems.
Training records: attendance, completion, certificates issued, signed participant waivers, and class feedback.
Tool inputs: questions you ask VFD Mentor, values you enter into simulations or calculators, and similar inputs (see Section 4).
Survey and assessment data: responses to surveys and assessments we run, as described in Section 5.
Engagement data: information about your facility, equipment, and operations that you or your organization share with us during Technical Consulting or Professional Services. Most of this is business information rather than personal information, and it is also protected by the confidentiality terms in our Terms and Conditions.
Communications data: the content of emails, web form submissions, social media messages, and other communications you send us.
User-generated content: reviews, testimonials, comments, questions, and other content you submit.

3.2 Information we collect automatically.

Device and connection data: IP address, approximate location derived from IP, browser type and version, operating system, device identifiers, language preferences, and referring or exit URLs.
Usage data: pages viewed, links clicked, search terms entered on the Services, dates and times of access, and similar interaction data.
Cookies and similar technologies: cookies, pixels, tags, and browser storage, as described in our Cookie Policy.

3.3 Information from third parties.

Payment processors: transaction confirmations and fraud signals from Stripe and Gumroad.
CRM and contact enrichment: we use Apollo as our CRM to manage business contacts and sales conversations. Apollo also helps us find, verify, and update professional contact details (such as name, job title, employer, business email, and business phone) for people at organizations we are working with or reaching out to. We also use public professional profiles such as LinkedIn. We use this information only to contact people at organizations about our Training and services, and you can ask us to stop at any time (Section 15.3).
Partners and referrers: contact details passed to us by a distributor, channel host, college, or other partner when you or your organization ask about Training.
Social media platforms: where you interact with us publicly or send us a message.

4. VFD Mentor, Simulations, and Other Tools

4.1 What we process. When you use VFD Mentor, the questions you type and the answers generated are processed to produce a response. Simulations and calculators process the values you enter.

4.2 Who processes it. To answer a VFD Mentor question, your question is sent to our AI model provider (currently Groq), may be compared against our reference library stored with our vector database provider (currently Qdrant Cloud, hosted in the United States), and may be sent to a web search provider (currently Tavily) when our library does not answer it. These providers process the question on our behalf.

4.3 How we use it. We use Tool inputs to provide the response, keep the Tools working, and improve them. We may review questions in de-identified form to see what plant teams are asking and to improve our reference library and published guides. We do not sell Tool inputs or use them for advertising.

4.4 What not to enter. Please do not enter passwords, personal information about other people, or information your employer treats as confidential into any Tool.

4.5 Browser storage. Some Tools keep your settings or a run in progress in your own browser storage, as described in our Cookie Policy.

5. Survey and Assessment Data

5.1 Our role. When an organization engages us for an assessment such as the Maintenance Health Index or Specialist Health Index, we collect survey responses from that organization’s team members. We process those responses to deliver the assessment to the organization under our agreement with it.

5.2 Aggregate reporting. Participation is voluntary. We report results to the organization in aggregate only and never attribute an individual response to a named respondent.

5.3 Research use. Where the organization’s agreement or a signed data-use agreement permits it, we may use de-identified responses for research and publication. Published research never identifies an organization, facility, or respondent.

5.4 Questions from respondents. If you responded to a survey through your employer, you may contact us directly or through your organization with questions or requests about your responses.

6. Sensitive Personal Information

We do not intentionally collect special categories of personal data or sensitive personal information (such as racial or ethnic origin, religious beliefs, political opinions, health data, biometric data, sexual orientation, government identifiers, or precise geolocation) through the Services. Please do not submit such information through any Tool, survey, form, or other channel. Where you voluntarily provide such information, we will treat it with care and apply the protections required by applicable law.

7. Children’s Privacy

The Services are intended for adults aged eighteen (18) years or older and are not directed to children. We do not knowingly collect personal information from any person under the age of eighteen. If we become aware that we have collected such information, we will take reasonable steps to delete it. If you believe we may have collected it, please contact us at carl@waywardleaders.com.

8. How We Use Personal Information

We use personal information to:

operate and provide the Services, including delivering Digital Products, running Tools, scheduling and delivering Training, issuing certificates, and performing Technical Consulting and Professional Services;
prepare quotes, process orders and payments, issue invoices and refunds, and maintain transaction records;
communicate with you about orders, scheduling, engagements, important changes to the Services, and support;
contact people at organizations about Training and services that may fit their work, and send marketing email where permitted by law and where you have not opted out;
conduct research and publish de-identified findings, as described in Sections 4.3 and 5.3;
maintain the security and integrity of the Services, prevent fraud, and enforce our terms;
analyze and improve the Services and develop new offerings;
meet our legal, accounting, tax, federal contracting, and regulatory obligations;
establish, exercise, or defend legal claims and protect our rights and the rights of others;
for any other purpose you consent to or that is clearly identified at the time of collection.

9. Legal Bases for Processing (EEA and UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal information on one or more of the following legal bases under the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and the UK General Data Protection Regulation as supplemented by the Data Protection Act 2018 (“UK GDPR”):

Contract (Art. 6(1)(b)): to perform a contract with you or take steps at your request before entering into one.
Legitimate interests (Art. 6(1)(f)): to operate, secure, and improve the Services; to administer our business; to contact people at organizations about relevant business services; to conduct de-identified research; to prevent fraud; and to establish, exercise, or defend legal claims. We balance these interests against your rights and freedoms.
Legal obligation (Art. 6(1)(c)): to comply with applicable law, including tax, accounting, and regulatory obligations, and lawful requests from public authorities.
Consent (Art. 6(1)(a)): where required, such as for certain marketing communications and non-essential cookies. You may withdraw consent at any time without affecting processing carried out before withdrawal.

10. Cookies and Similar Technologies

We and our service providers use cookies, pixels, tags, browser storage, and similar technologies to operate the Services, remember your preferences, and analyze usage. The categories we use and your choices are described in our Cookie Policy, which is incorporated by reference. Where required by applicable law, we will obtain your consent before placing non-essential cookies on your device.

We do not sell your personal information. We share it only as described below.

11.1 Service providers. We share personal information with vendors that perform services on our behalf and are required to protect it and use it only for those services. Our principal service providers include:

Gumroad: digital product sales, checkout, and delivery.
Stripe: payment processing.
Website hosting providers, including Cloudflare for waywardleaders.com and Netlify for vfdmentor.ai.
Google Analytics 4: site usage analytics on waywardleaders.com, not linked to advertising products.
Kit and Formspark: receiving web form submissions, such as class requests, quote requests, and report downloads, and sending the emails that follow from them.
AI, search, and storage providers for VFD Mentor: currently Groq, Tavily, and Qdrant Cloud (Section 4).
Email and productivity providers that host our business email, documents, and calendars.
Customer relationship management: currently Apollo, for managing business contacts and sales conversations and for verifying and updating business contact details.
Accounting and banking: QuickBooks Online and our bank, for invoicing and payment records.

11.2 Organizations that engage us. When your employer or another organization engages us, we share with it the information needed to deliver the engagement, such as Training attendance and completion, and aggregate assessment results. We do not share individual survey responses (Section 5.2).

11.3 Professional advisors. We share personal information with our accountants, lawyers, insurers, bankers, and other professional advisors as reasonably necessary to operate our business and protect our legal interests.

11.4 Government contracting. When we perform work for a government agency, we may share information as required by the applicable contract or by federal, state, or local law.

11.5 Legal and safety. We may disclose personal information to law enforcement, regulators, courts, and other public authorities when we believe in good faith that disclosure is required by law or necessary to: (a) comply with legal process; (b) protect our rights, property, or safety, or those of others; (c) detect, prevent, or address fraud, security, or technical issues; or (d) enforce our terms.

11.6 Business transfers. If we engage in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to the receiving party honoring this Privacy Policy or providing notice to you.

11.7 With your direction. We may share personal information with third parties when you direct us to or otherwise consent.

12. International Data Transfers

Wayward Leaders is based in the United States, and our service providers may be located in the United States and other countries. Your personal information may be transferred to, stored in, and processed in jurisdictions outside your country of residence that may not provide the same level of data protection as your home jurisdiction.

For transfers of personal information from the EEA or the United Kingdom, we rely on appropriate safeguards required by applicable law, including the Standard Contractual Clauses adopted by the European Commission and, for UK transfers, the UK International Data Transfer Addendum. You may request a copy of the safeguards in place by contacting us at carl@waywardleaders.com.

13. Data Retention

We retain personal information for as long as reasonably necessary for the purposes in this Privacy Policy and to meet our legal, accounting, tax, contracting, and reporting obligations, resolve disputes, and enforce our agreements. Typical retention periods:

Customer, quote, and engagement records: for the duration of the relationship and a reasonable period afterward to support repeat work and legal defense.
Training records and signed waivers: for a period consistent with applicable limitation periods for claims.
Survey and assessment responses: identifiable responses for the period stated in the engagement agreement, after which they are deleted or de-identified.
Tool inputs: for a limited period to operate and improve the Tools, after which they are deleted or de-identified.
Order and transaction records: for the period required by tax, accounting, and consumer protection law (typically seven years in the United States).
Business contact and marketing data: until you opt out, plus a short period to honor your opt-out.
Communications: for a reasonable period appropriate to the nature of the communication and any related dispute.

When personal information is no longer needed, we securely delete, anonymize, or de-identify it, except where longer retention is required by law.

14. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include access controls, encryption in transit (HTTPS/TLS), password hashing, vendor due diligence on principal service providers, and limits on internal access. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and any relevant authority as required by applicable law, including South Dakota law (Section 19).

15. Your Choices

15.1 Your information. You may ask to access or update information we hold about you by contacting carl@waywardleaders.com, or through your Account settings where a Tool provides them.

15.2 Marketing email. You may unsubscribe from marketing email at any time using the unsubscribe link in any marketing message or by emailing carl@waywardleaders.com. We will still send transactional messages, such as order confirmations and scheduling details, while an order or engagement is open.

15.3 Business outreach. If we contacted you about our services and you do not want to hear from us again, reply to that message or email carl@waywardleaders.com and we will stop and mark your contact record so it is not used for outreach again.

15.4 Cookies, Do Not Track, and Global Privacy Control. You may manage cookies through your browser settings and, where available, the cookie controls on the Services; see our Cookie Policy. Because there is no consistent industry standard for Do Not Track signals, we do not change our practices in response to them. Where applicable law requires us to honor a Global Privacy Control signal, we will do so.

If you are located in the EEA or the United Kingdom, you have the following rights, subject to the conditions and exceptions in the GDPR and UK GDPR:

Access: to confirm whether we process personal information about you and to obtain a copy.
Rectification: to correct inaccurate or incomplete personal information.
Erasure: to request deletion of your personal information.
Restriction: to restrict our processing in certain circumstances.
Portability: to receive certain personal information in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
Objection: to object to processing based on legitimate interests, including direct marketing and business outreach.
Withdraw consent: at any time where processing is based on consent.
Lodge a complaint: with the data protection supervisory authority of the EU Member State where you live, work, or where the alleged infringement occurred, or with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us at carl@waywardleaders.com. We may need to verify your identity before responding, and we will respond within the time required by law (generally one month).

17. California Residents: CCPA and CPRA

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), grants you specific rights. This Section supplements the rest of this Privacy Policy.

17.1 Categories collected. In the preceding twelve (12) months, we may have collected the following categories of personal information, as defined in Cal. Civ. Code § 1798.140:

Identifiers (name, email address, postal address, IP address, account identifiers);
Customer records information (billing details, contact information, transaction history);
Commercial information (records of products and services purchased or considered);
Professional or employment-related information (job title, employer, and business contact details, including details verified or updated through our CRM);
Internet or other electronic network activity information (browsing on the Services, interaction with our pages and emails, Tool inputs);
Geolocation data (approximate location derived from IP address);
Inferences drawn from the above to reflect your professional interests in our Training and services.

17.2 Sources, purposes, and recipients. The sources of this information, the purposes for which we use it, and the categories of recipients are described in Sections 3, 8, and 11.

17.3 Sale or sharing. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined in the CCPA. We do not knowingly sell or share the personal information of consumers under the age of sixteen.

17.4 Your rights. Subject to verification and applicable exceptions, California consumers have the right to:

know what categories and specific pieces of personal information we have collected, used, and disclosed about them;
request deletion of personal information we have collected from them;
request correction of inaccurate personal information;
opt out of any sale or sharing of personal information (we do not engage in either);
limit the use and disclosure of sensitive personal information (we do not intentionally collect it);
not be discriminated against for exercising these rights.

17.5 How to exercise them. Email carl@waywardleaders.com with the subject line “California Privacy Request” and enough information to verify your identity, such as your name and the email address we have for you. An authorized agent may submit a request on your behalf as described in Section 25. We will respond within forty-five (45) days, with one possible forty-five (45) day extension where reasonably necessary.

18. Other U.S. State Privacy Rights

Residents of certain other U.S. states may have rights under their state consumer privacy laws to access, correct, delete, and port personal information, and to opt out of certain processing. Where such rights apply to you and you contact us as described in Section 16 or 17, we will handle your request in accordance with applicable state law, including any right to appeal under Section 25.3.

19. South Dakota Data Breach Notification

Wayward Leaders is organized in South Dakota and complies with South Dakota’s data breach notification law, SDCL § 22-40-19 et seq. If a breach of system security compromises the personal information of South Dakota residents, we will notify affected residents in accordance with that law.

20. Email Marketing and CAN-SPAM

We send commercial email in compliance with the federal CAN-SPAM Act of 2003 and applicable state and international laws. Our commercial email identifies the sender, includes a valid postal address, accurately describes its subject, and provides a clear way to opt out. We honor opt-out requests promptly. For EEA and UK recipients, we send marketing email only on a legal basis permitted by the GDPR or UK GDPR, subject to your right to object at any time.

21. Automated Decision-Making

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. VFD Mentor answers, simulation results, and assessment scoring are automated outputs that inform people; they do not make decisions about you.

22. Third-Party Websites and Services

The Services may link to third-party websites, applications, or services that we do not operate. This Privacy Policy does not apply to them, and we are not responsible for their privacy practices. Please read the privacy policy of any third party before giving it personal information.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date above and, where the changes are material, provide reasonable additional notice. Your continued use of the Services after the effective date of a revised Privacy Policy constitutes your acknowledgment of it, except where additional consent is required by law.

24. Notice to International Users

The Services are operated from the United States. If you access them from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. Your personal information may be transferred to and processed in the United States and other jurisdictions, subject to the protections described in Section 12.

25. Authorized Agents, Verification, and Appeals

25.1 Authorized agents. Where permitted by applicable law, you may use an authorized agent to submit a request. We may require proof of the agent’s authority and may require you to verify your identity directly with us.

25.2 Verification. We take reasonable steps to verify your identity before responding to a request, based on the type of request and the sensitivity of the information. We may decline a request if we cannot reasonably verify your identity.

25.3 Appeals. Where required by applicable law, you may appeal a denied request by replying to our response with the subject line “Privacy Appeal” and an explanation of why you believe our decision was incorrect. We will respond within the time required by law.

26. Contact Us

If you have any questions, comments, or concerns about this Privacy Policy or our handling of your personal information, please contact: