privacy notice
version 2026-10-29
who we are
AVALON RESET LLC operates cto-legends at cto-legends.com, including its public engineering dispatches, open-source capability catalog, optional creator-tip mechanism, voice-note inbox, member access portal, and connected GoHighLevel (HighLevel) workspace provisioning service. Stripe, GitHub, Skool, GoHighLevel, and the other independent services you choose to use operate under their own privacy notices.
For privacy requests, billing questions, or portal support, email quest@cto-legends.com, message Benjamin on Skool, or write to AVALON RESET LLC, P.O. Box 114, Norristown, PA 19408, United States. Identify cto-legends and your request in your message. Do not send passwords, verification links, full payment-card numbers, or government identity documents in an initial request.
information we use
- Sign-in information: your GitHub identifier, username, profile name, avatar, and verified email, and the account-linking and verification records needed to recognize your cto-legends account. If Google sign-in or a linked Google identity is used, the corresponding identifier, name, and verified email are used for that feature. An email may differ from the one you use on Skool.
- Creator-tip and billing records: when you authorize an optional one-time, monthly, or yearly creator tip, we record your verified email address; consent, authorization, notice-version, SHA-256 consent hash, receipt, and cancellation records; selected amount, currency, and billing interval; and Stripe customer, Checkout session, subscription, invoice, payment-status, refund, dispute, and receipt identifiers. Stripe receives and processes full payment-card details, billing name, billing address, and fraud-prevention signals under Stripe's own privacy notice. AVALON RESET LLC does not receive or store full card numbers or CVC codes.
- Voice messages: if you record and send an optional voice note after signing in, we collect the audio recording, duration, technical format, voice-message consent record, the provider-verified email and profile identifiers for that session, timestamp, and basic request metadata. Voice recordings are stored in private operator storage and are not used for biometric speaker identification or voiceprints.
- Membership and community access information: your membership email, membership status, payment verification records, repository access checks and invitations, and optional community invitation requests, status, and timestamps. When a WhatsApp joining or verification feature is used, this can include your phone number, account identifier, and joining or verification activity.
- Workspace and agent information: when you request or manage a GoHighLevel sub-account workspace, we collect your administrator login name, workspace classification (own business or client workspace), business name, contact person name, business email, business phone, street address, city, state, postal code, country, and timezone, along with the assigned HighLevel Location ID, provisioning status, timestamps, billing-setup status, and retirement request reasons. When you use browser agents (WebMCP) or our agent API, we record pairing codes, hashed agent tokens, request timestamps, and tool actions under your session.
- Support and security information: messages you send us, account changes, administrative actions, request information, and technical logs (including IP addresses, user agent, host, and security telemetry processed by our hosting and network providers).
GitHub sign-in does not give cto-legends a general right to read your private repositories. The sign-in permissions used for this portal request profile and verified email information. Separate organization tools manage invitations to member repositories.
why we use it
We use this information to operate cto-legends.com, sign you in, document creator-tip consent and electronic records, administer creator-tip authorizations, renewals, refunds, and cancellations, match and verify membership, provide and manage requested repository, community, and GoHighLevel workspace access, deliver voice messages to Benjamin, send requested verification and necessary transactional notices, provide support, keep accounting and tax records, prevent mistake, fraud, unauthorized access, and abuse, and comply with law.
Where EU or UK data-protection law applies, we rely on contractual necessity for information objectively needed to process requested transactions, membership-access, and workspace provisioning services; legitimate interests for proportionate security, rate-limiting, fraud prevention, and support administration; and legal obligations for tax, accounting, and compliance records. Optional uses that require consent are handled separately.
When you submit contact details for a client workspace, you act as the business contact responsible for that submission. You must ensure you have lawful authority and required notices or consents to provide your client's contact information for workspace setup. We process client workspace contact details solely to create and administer the requested sub-account under our agency account, not for independent marketing or data sales. You act as the independent data controller (or processor for your clients) for any leads, contacts, or communications stored inside your GoHighLevel sub-account.
emails and marketing
Authorizing a creator tip or requesting a one-time verification link does not by itself buy email or enroll you in third-party ad lists. Stripe or AVALON RESET LLC may send receipts and operational messages about authorization, payment, renewal, failed payment, cancellation, refunds, verification, workspace activation, or material billing changes.
When commercial or quest email is sent by AVALON RESET LLC from quest@cto-legends.com, each marketing message identifies AVALON RESET LLC, includes our postal address (P.O. Box 114, Norristown, PA 19408), and provides a working unsubscribe method. Using the unsubscribe link suppresses future marketing email for that address. Necessary transactional, payment, security, and legally required notices may still be sent.
who receives information
Authorized administrators and service providers receive only the information reasonably needed for their role. These include Stripe for creator-tip payment processing and billing management, GitHub (and Google when offered) for authentication and repository access, Skool for membership matching, Resend for transactional email delivery, Hetzner for hosting, Cloudflare for network and edge security services, and GoHighLevel (HighLevel / LeadConnector LLC) for CRM and requested workspace sub-accounts. Optional Buzz or WhatsApp access involves those platforms and the identifiers needed for the requested feature.
We may also disclose necessary information to professional advisers, to comply with law, or to protect users and the service. Providers may process information in the United States, Europe, or other countries under applicable data-processing addenda and standard contractual clauses.
No sale or behavioral advertising: we do not sell personal information or share it for cross-context behavioral advertising. We do not operate third-party advertising pixels on portal or checkout flows, and we do not send names, emails, exact creator-tip amounts, or Stripe identifiers to advertising networks.
cookies, analytics and browser storage
We use first-party cookies for requested sign-in, session security, and privacy preferences. Fonts are self-hosted on cto-legends. Quality-assurance replay on authenticated portal routes uses an in-memory session identifier while the portal is open rather than an advertising cookie.
| cookie | purpose | maximum lifetime |
|---|
| First-party portal session cookie (HttpOnly) | authenticated cto-legends portal session | 7 days |
| First-party OAuth state cookie (HttpOnly) | protect the OAuth sign-in flow | 10 minutes |
| First-party OAuth link cookie (HttpOnly) | secure account linking | 10 minutes |
| First-party pending OAuth cookie (HttpOnly) | complete identity verification | 15 minutes |
| First-party administrator session cookie (HttpOnly) | authorized administrator sign-in | 8 hours |
| cto_analytics_choice / cto_analytics_opt_out | remember browser analytics opt-in/opt-out preference | 12 months |
The browser router may keep per-tab scroll-position information in session storage under tsr-scroll-restoration-v1_3. You can delete or block cookies in your browser, or visit /clear-cookies to reset browser cookies. Because we do not sell or share personal data for targeted advertising, we do not activate behavioral advertising regardless of Global Privacy Control (GPC) or Do Not Track settings, and we honor recognized GPC signals as an analytics opt-out.
analytics settings
Analytics is off until this browser affirmatively allows it. The cto_analytics_choice and cto_analytics_opt_out preference cookies last no more than one year and exist solely to remember cto-legends analytics choices for this browser. Continuing without analytics, turning analytics off, or sending a recognized Global Privacy Control (GPC) signal suppresses the Google Analytics tag and pings and deletes controllable _ga* cookies. Allowing analytics does not override GPC. Google's explanation of its role: https://policies.google.com/technologies/partner-sites.
analytics off ยท no permission has been given
quality assurance replay
Signed-in portal sessions may be reconstructed for quality assurance using self-hosted PostHog on our Hetzner infrastructure to diagnose onboarding and provisioning issues. Passwords, authentication tokens, invitation QR codes, account-verification codes, and masked contact fields are excluded, and payment cards are entered only on Stripe-hosted Checkout, never on cto-legends. Signing out stops replay capture.
retention and security
We keep creator-tip recurring-charge consent verification for at least three years or one year after termination, whichever is longer, and keep payment and tax records for the period required by law. We retain account, membership-linking, voice-message, and workspace provisioning records while needed to provide access, document consent, maintain agency account integrity, prevent abuse, and meet legal requirements.
We use administrative and technical security safeguards, including HTTPS/HSTS, strict Content Security Policy headers, and cryptographic session verification, but no internet service can guarantee absolute security. Never share a sign-in link, session cookie, or agent token with another person.
your choices and rights
Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction, or objection to processing, or withdraw consent for an optional use by contacting quest@cto-legends.com. To manage or cancel an active recurring creator tip at any time, use https://cto-legends.com/cancel or the Stripe billing-management link in your receipt.
Deleting portal records or signing out does not automatically cancel a separate Skool membership, cancel a Stripe recurring creator tip, or retire an active GoHighLevel sub-account. Use /cancel for creator-tip subscriptions, Skool settings for Skool billing, and the workspace portal for HighLevel sub-account retirement.
eligibility, children and changes
cto-legends, including its creator-tip mechanism and community surfaces, is intended only for adults 18 and older. Contact us at quest@cto-legends.com if you believe someone under 18 has supplied information. We will update the effective date on this notice when it changes and provide additional notice or request consent when required by law.
back to member access