Privacy Policy

Last updated: July 3, 2026

This Privacy Policy explains how Thunder X Capital, LLC ("we", "us") collects, uses, shares, and protects personal information when you visit 100mexitspodcast.com (the "Site"), use the Engage AI chat, sign up for our newsletter, or contact us (collectively, the "Services").

We are the data controller of your personal information under the EU General Data Protection Regulation ("GDPR") and the UK GDPR, and a "business" under the California Consumer Privacy Act as amended by the CPRA ("CCPA") and equivalent US state privacy laws.

Contact: Thunder X Capital, LLC, New Jersey, USA, legal@100mexitspodcast.com.

1. Information we collect

We collect the following categories of personal information:

• Account & identity data, email address, name, password hash (via our authentication provider), and profile details you provide.
• Communications, the content of messages you send us (contact form, guest applications, sponsor inquiries, newsletter signup).
• Engage AI data, the questions you ask, the responses generated, and "profile facts" you share to personalize responses.
• Usage & device data, IP address, user agent, referrer, pages viewed, video events, outbound-link clicks, search terms, form-submission events, UTM parameters.
• Cookies & local storage, see our Cookie Policy.

We do not knowingly collect Social Security numbers, government IDs, precise geolocation, financial-account numbers, or health information. Please do not send us that information.

2. How we use personal information

• Provide the Services, run the Site, authenticate you, deliver Engage responses.
• Improve & secure the Services, analytics, debugging, fraud prevention, aggregate performance.
• Communicate with you, respond to inquiries, send transactional email (account confirmations, receipts).
• Marketing (with consent where required), send you our newsletter and podcast updates. You can unsubscribe at any time.
• AI personalization, with your account and "profile facts," we tailor Engage responses to your stage, sector, and goals.
• Legal & compliance, enforce our Terms, comply with law, respond to lawful requests.

3. Legal bases (EU/UK visitors)

• Contract (Art. 6(1)(b)), creating and operating your account, delivering Engage responses you request.
• Consent (Art. 6(1)(a)), marketing emails, non-essential cookies, AI personalization based on profile facts. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)), securing the Site, aggregate analytics, direct communications with prospective business contacts. You may object at any time.
• Legal obligation (Art. 6(1)(c)), tax, accounting, and record-keeping.

4. Sharing personal information

We share personal information with the categories of recipients listed below. A full list is on our Subprocessors page:

• Infrastructure & hosting, Cloudflare, Supabase (database, authentication, storage).
• Email delivery, SendGrid.
• CRM & marketing lists, HubSpot (list 476).
• Analytics, Google Analytics 4 (only after consent for EU/UK visitors).
• AI providers, Google (Gemini API) for Engage generation and embeddings.
• Search & content enrichment, Brave Search, Firecrawl, YouTube (embeds), Google Drive.
• Professional advisors, lawyers, accountants, auditors under confidentiality obligations.
• Legal & safety, to comply with law, enforce our Terms, or protect rights, property, and safety.
• Business transfers, in connection with a merger, acquisition, financing, or asset sale.

We do not sell personal information for money. Certain analytics/advertising cookies may constitute "sharing" or "sale" as broadly defined by CCPA/CPRA and similar laws. US residents can opt out via Your US Privacy Choices.

5. International transfers

We are based in the United States. Personal information is processed in the US and other countries where our service providers operate. For transfers of EU/UK personal data outside the EEA/UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (UK IDTA), together with supplementary measures where required.

6. Retention

• Account data, for the life of your account, plus up to 24 months after deletion for backups and legal compliance.
• Newsletter subscribers, until you unsubscribe, plus a suppression record afterwards.
• Engage chat history, up to 24 months, unless you delete your account earlier.
• Form submissions, up to 36 months.
• Analytics, GA4 default (14 months).
• Server & security logs, up to 90 days.

7. Your rights

Subject to applicable law, you may have the right to:

• Access, correct, delete, or export your personal information.
• Object to or restrict certain processing.
• Withdraw consent (where processing is based on consent).
• Opt out of the "sale" or "sharing" of personal information and of targeted advertising.
• Limit the use of sensitive personal information (CPRA).
• Lodge a complaint with your data protection authority (EU/UK) or your state attorney general.

Exercise your rights at /dsr or by emailing legal@100mexitspodcast.com. We will not discriminate against you for exercising these rights. We will verify your request using the email associated with your account (and, where necessary, additional information). Authorized agents may submit requests on your behalf with written proof of authorization.

8. US state privacy notices

Categories of personal information we collect and disclose: identifiers (email, IP), internet or network activity (usage data), commercial information (form submissions), inferences (Engage personalization). Purposes: those described in Section 2. Sources: directly from you, automatically from your device, and from our service providers. Categories disclosed for a business purpose: identifiers, internet activity, and commercial information to the service providers listed on our Subprocessors page.

Sensitive personal information: we do not use or disclose SPI for purposes that would require the "limit use" right, but you may still request limitation.

Do Not Sell or Share & targeted advertising opt-out: submit via Your US Privacy Choices. We honor Global Privacy Control (GPC) signals as an opt-out for the browser sending the signal.

9. Children

The Services are for users aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

10. Security

We use industry-standard administrative, technical, and physical safeguards (encryption in transit, hashed passwords, row-level security in our database, principle-of-least-privilege access). No system is perfectly secure; you use the Services at your own risk.

11. AI & automated decisions

Engage uses generative AI (Google Gemini) with retrieval over public podcast transcripts and Jason Kirby's knowledge base. Outputs may be inaccurate. Engage does not make decisions that produce legal or similarly significant effects concerning you. See the AI Disclosure in our Terms of Service.

12. EU/UK representative

We have not appointed an Article 27 EU/UK representative. EU/UK residents may contact us directly at legal@100mexitspodcast.com.

13. Changes

We may update this Policy. Material changes will be posted here with a new "Last updated" date; for significant changes we will provide additional notice (e.g., email or in-app banner).

14. Contact

Thunder X Capital, LLC, New Jersey, USA, legal@100mexitspodcast.com.