This school asks people to write down first-person things — what they know, what they chose, where their life cracked. That is unusually personal material, and this policy is written to be read, not to be clicked past. If anything here is unclear, write to hello@cocreating.school and a human will answer.
Who we are
DMBranco, Inc., trading as CoCreating.School, 11298 Carmel Creek Road, San Diego, CA 92130, United States. We are the data controller for everything described below. Contact: hello@cocreating.school.
What we collect
- —A phone number, if you give us one — offered at checkout and in CoCreation, your student area, never required. It is used only to reach you about a course you are enrolled in, such as a class moving or something going wrong on the day. We do not use it for marketing, we do not share it, and you can ask us to delete it at any time while keeping your seat.
- —Enrollment details — your name and email address, the tier you chose, and whether a seat was gifted. Payment card details are entered on Stripe's own checkout page and never reach our servers; we receive only the outcome, the amount, and the last-four style metadata Stripe returns.
- —What you write in class — the offerings you submit through the Loom (our live classroom): poll answers, written lines, the anchors on your map, and the artifacts woven from them.
- —Your Premise Map, if you take it and allow us to keep it: your answers, the reading computed from them, and the page that brought you there. It has its own section below, because some of the answers are sensitive.
- —Questions you send us — anything submitted through the ask-the-school form or by email, including scholarship requests.
- —Your time zone — so class reminders can show the time where you are. Your browser already knows it (for example “America/Sao_Paulo”) and reports just that string. We do not look up your location, your city, or your IP for this.
- —Minimal technical data — ordinary web server logs (IP address, time, page requested), kept for security and troubleshooting.
We do not use advertising or analytics trackers. We do not build profiles of you for advertising or marketing, and we never sell, rent, or share personal data with anyone for their own purposes. The one reading we compute about you is the Premise Map you ask for, and it is shown to you. The classroom stores a short-lived session token in your browser's session storage so the room knows who you are; it is gone when you close the tab.
Where it lives
Our application and database run on servers we control at Hetzner in Helsinki, Finland — inside the European Union. We are a US company using EU-hosted infrastructure, which means your material sits under EU data protection standards by default rather than by request.
Who else processes it
- —Stripe — payments and receipts. They receive your name, email, and payment details directly.
- —Resend — sends our email (enrollment confirmations, class reminders, replies). They process your email address and message content.
- —Zoom — hosts the live classes. Their own privacy terms apply to what happens on the call.
- —Anthropic — the AI that weaves the cohort's written lines into shared artifacts during class. The lines you submit at a weaving station are sent for processing, without your name attached, and are not used to train their models under our business terms.
- —An image-generation provider (Google or OpenAI) — for the classes where the artifact is a picture. Only the description you write is sent.
What is recorded, and what never is
Classes are recorded so nobody has to choose between being present and taking notes. A live class cannot be neatly separated from the people in it, so recordings may capture student participation: voices, questions, reactions. For that reason, recordings are shared only with the students registered in that same cohort — never published, never moved between cohorts, never used for marketing. Practice reports, integration circles, and what people say about their own lives in circle are never recorded. That rule is enforced by how the software is built, not only by etiquette.
Who can see your writing
Offerings you submit at an open station are visible to your cohort — that is the point of a room whose instrument is the group, and the join screen says so before you enter. Woven artifacts show the cohort's voices without attributing lines to individuals. Nothing you write in class is published outside your cohort, shown to other cohorts, or used in marketing without asking you first, by name, for that specific piece.
The Premise Map
The Premise Map is a short questionnaire about the premises you live by: whether you start from matter or from consciousness, what you anchor truth in, where you turn in a crisis (faith, science, or your own choice), and whether you see your identity as given or made. Some of these answers can reveal philosophical or religious beliefs, which data protection law (the LGPD in Brazil, the GDPR in Europe) treats as sensitive. So the map works like this:
- —Nothing leaves your browser while you answer. If you close the page before the last screen, we never receive a thing.
- —We keep it only with your explicit consent. On the last screen, a separate box, unticked until you tick it, asks your permission to keep your answers. Without it the map is not saved. We record that you gave it, when, and the exact words you agreed to.
- —What we keep: your answers, the reading computed from them (your scores and your starting point), your name and email, your language, and the page that brought you to the map.
- —Why: to show you your map, to keep it in your account so you can take it again at the end of the course and compare the two, and to understand, in aggregate, where the school's students start from.
- —Who sees it: you, in your student area and through your map's private link, and your teacher, who sees your starting point next to your name. Totals are counted without names. Your answers are never sent to an AI provider, never used for advertising, and never shared or sold.
- —No automated decisions: the reading does not change your price, your access, or anything else about your place in the school.
- —For how long: while you have an account with us. Write to hello@cocreating.school and we delete your maps; withdrawing your consent does the same.
Workshops and keynotes for organizations
When we run a workshop for an organization, the organization is our client and its participants are the people in the room. What participants write at anonymous stations is shown to that room and woven into a shared artifact without attribution. The sponsoring organization receives the woven artifacts and the room's aggregate results, never individual entries, and we do not identify who wrote what to anyone, including the employer. Participation is voluntary. Workshop rooms are not recorded. We keep workshop offerings for two years unless the organization asks for earlier deletion; participants may ask us to delete their own entries at any time.
Why we are allowed to hold it
For enrollment and delivering the course: performance of our contract with you. For class reminders and course email: the same. For security logs and keeping our records straight: our legitimate interests. For anything else — a quote, a case study, a testimonial — your explicit consent, asked for separately. For the Premise Map: your explicit consent, given on the map's last screen for the purposes described above, which you can withdraw at any time.
How long we keep it
- —Your artifacts and logbook entries: kept while you have an account with us, because the course is designed to be revisited — and deleted whenever you ask.
- —Enrollment and payment records: seven years, because tax law requires it.
- —Server logs: 30 days.
- —Questions and scholarship requests: two years.
- —Your Premise Maps: while you have an account with us, so you can compare them, and deleted whenever you ask or withdraw your consent.
Your rights
Wherever you live, you may ask us for a copy of what we hold, to correct it, to delete it, or to stop using it. Where you gave consent, you may withdraw it at any time. If you are in Brazil, those are your rights under the LGPD, including the right to petition the ANPD, the national data protection authority. If you are in the EU or UK, those are your GDPR rights, including the right to complain to your data protection authority. If you are in California, they are your CCPA/CPRA rights, including the right to know and to delete — and note that we do not sell or share personal information as those laws define it. One email to hello@cocreating.school is enough; there is no form. We answer within 30 days.
Children
This course is for adults. We do not knowingly enroll anyone under 18 or collect their data.
Breaches and changes
If personal data is ever exposed in a way that puts you at risk, we will tell you and the relevant authority within 72 hours of finding out — by email, plainly, without minimizing it. If this policy changes materially, enrolled students get an email; the effective date at the top always tells you which version you are reading.
Versions
- —23 September 2026: the Premise Map, what it keeps and why, the explicit consent it asks for, and how to have it deleted; Brazil's LGPD named with the other laws; a clearer line on profiling.
- —9 September 2026: workshops and keynotes for organizations.
- —10 August 2026: class recordings may include participation and stay inside the cohort.
- —6 August 2026: an optional phone number, used only about your course; the Portuguese translation published.
- —3 August 2026: the school's name became CoCreating.School.
- —25 July 2026: first version.
We keep every earlier version and will send you any of them on request.