Wayward Leaders LLC (“Wayward Leaders,” “we,” “us,” or “our”) is a South Dakota limited liability company. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information about you when you visit or use our websites and services, including www.waywardleaders.com, www.waywardleaders.learnworlds.com(our Academy), and www.waywardcarl.gumroad.com (collectively, the “Services”). It also explains the rights and choices you have regarding your personal information.

This Privacy Policy is governed by the laws of the United States and the State of South Dakota. We have included additional sections for individuals in the European Economic Area, the United Kingdom, and California, whose laws grant specific rights. Where any of those sections apply to you, they supplement (and, where stricter, prevail over) the general provisions of this Privacy Policy.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use the Services.

This Privacy Policy applies to personal information we collect or process in connection with the Services, including when you:

• visit, browse, or interact with our websites and pages;

• register for an account on the Academy or any other portion of the Services;

• enroll in or access a course, lesson, or digital product;

• purchase a course, book, digital product, or service through any of our channels;

• subscribe to a newsletter or marketing communications;

• contact us by email, phone, web form, or social media;

• submit feedback, reviews, comments, or other user-generated content.

This Privacy Policy does not apply to personal information collected by independent third-party platforms (including LearnWorlds, GoDaddy, Gumroad, Stripe, and PayPal) under their own privacy policies, except to the extent we receive that information and use it for our own purposes.

Wayward Leaders LLC is the controller of the personal information we collect through the Services (or, where required by applicable law, the equivalent term such as “business” under the California Consumer Privacy Act).

Wayward Leaders LLC

Sioux Falls, South Dakota, United States

Privacy contact: Dr. Carl Lee Tolbert

Email: carl@waywardleaders.com

Phone: (678) 523-2050

We collect personal information in the following categories:

• Identity and contact data: name, email address, postal address (where provided), telephone number (where provided), employer or organization name (where provided), and similar information you submit when registering, ordering, or contacting us.

• Account data: username, password (stored in hashed form), profile information, and preferences.

• Order and transaction data: records of courses, books, and digital products you have purchased; order numbers; billing details; and limited payment metadata. Full payment card numbers are not stored on our systems; payments are processed by Stripe or PayPal under their own terms and privacy policies.

• Course and learning data: course enrollments, progress, completion, quiz and assessment results, certificates issued, time spent in lessons, and similar learning analytics generated through the Academy.

• Communications data: the content of emails, support tickets, web form submissions, social media messages, and other communications you send to us.

• User-generated content: reviews, ratings, testimonials, comments, questions, feedback, and other content you submit.

• Device and connection data: IP address, approximate location derived from IP, browser type and version, operating system, device identifiers, screen resolution, language preferences, and referring or exit URLs.

• Usage data: pages and lessons viewed, links clicked, search terms entered on the Services, dates and times of access, session duration, and similar interaction data.

• Cookies and similar technologies: cookies, pixels, tags, local storage, and similar technologies set by us and by our service providers, as further described in our Cookie Policy.

We may receive information about you from:

• payment processors (limited transaction confirmation and fraud signals from Stripe and PayPal);

• the LearnWorlds platform, including enrollment, progress, and authentication data;

• the Gumroad platform, including order and delivery confirmations;

• the GoDaddy email and hosting platform;

• social media platforms where you interact with us publicly or send us a message.

We do not knowingly purchase personal information from data brokers.

We do not intentionally collect special categories of personal data or sensitive personal information (such as racial or ethnic origin, religious beliefs, political opinions, health data, biometric data, sexual orientation, government identifiers, or precise geolocation) through the Services. Please do not submit such information to us through any course assessment, forum, support ticket, or other channel. Where you voluntarily provide such information (for example, in correspondence with us), we will treat it with care and apply the protections required by applicable law.

The Services are intended for adults aged eighteen (18) years or older and are not directed to children. We do not knowingly collect personal information from any person under the age of eighteen. If we become aware that we have collected personal information from a person under the age of eighteen without verified parental or guardian consent, we will take reasonable steps to delete that information. If you believe we may have collected such information, please contact us at carl@waywardleaders.com.

We use personal information for the following purposes:

• to operate and provide the Services, including registering accounts, delivering courses, books, and digital products, tracking course progress, and issuing certificates of completion;

• to process orders and payments, including invoicing and refunds, and to maintain transaction records;

• to communicate with you about your account, orders, courses, important changes to the Services, and customer support;

• to send marketing emails about new courses, books, programs, and offerings, where permitted by law and where you have not opted out;

• to maintain the security and integrity of the Services, prevent fraud, detect and respond to malicious activity, and enforce our terms;

• to analyze and improve the Services, develop new offerings, and conduct internal research and reporting;

• to comply with our legal, accounting, tax, regulatory, and other obligations;

• to establish, exercise, or defend legal claims and protect our rights and the rights of others;

• for any other purpose for which you have given consent or that is clearly identified at the time of collection.

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal information on one or more of the following legal bases under the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and the UK General Data Protection Regulation as supplemented by the Data Protection Act 2018 (“UK GDPR”):

• Contract (Art. 6(1)(b)): to perform a contract with you (for example, to deliver a course you have purchased) or to take steps at your request before entering into a contract.

• Legitimate interests (Art. 6(1)(f)): to operate, secure, and improve the Services; to administer our business; to maintain records; to prevent fraud; to communicate with existing customers about related courses and offerings; and to establish, exercise, or defend legal claims. We balance these interests against your rights and freedoms.

• Legal obligation (Art. 6(1)(c)): to comply with applicable law, including tax, accounting, and regulatory obligations, and lawful requests from public authorities.

• Consent (Art. 6(1)(a)): where required, such as for certain marketing communications and for the use of non-essential cookies. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We and our service providers use cookies, pixels, tags, local storage, and similar technologies to operate the Services, remember your preferences, analyze usage, and (where applicable) deliver relevant content. The categories of cookies we use, their purposes, and your choices are described in our Cookie Policy, which is incorporated by reference. Where required by applicable law, we will obtain your consent before placing non-essential cookies on your device.

We share personal information only as described in this Privacy Policy. We do not sell your personal information to third parties for monetary consideration. The categories of recipients are:

We share personal information with vendors and service providers that perform services on our behalf and are contractually required to protect that information and use it only for the purposes for which it was disclosed. Our principal service providers include:

• LearnWorlds — Academy platform hosting, course delivery, learner authentication, course progress and assessment tracking, and platform-provided email.

• GoDaddy — website hosting for waywardleaders.com, domain services, and platform-provided email.

• Gumroad — digital product sales, checkout, delivery, and platform-provided email.

• Stripe — primary payment processing.

• PayPal — backup payment processing.

We share personal information with our accountants, auditors, lawyers, insurers, bankers, and other professional advisors as reasonably necessary to operate our business and protect our legal interests.

We may disclose personal information to law enforcement agencies, regulators, courts, and other public authorities when we believe in good faith that disclosure is required by law or necessary to: (a) comply with legal process; (b) protect our rights, property, or safety, or those of our Users, customers, or others; (c) detect, prevent, or address fraud, security, or technical issues; or (d) enforce our terms.

If we engage in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, personal information may be transferred as part of that transaction, subject to the receiving party honoring the commitments in this Privacy Policy or providing notice to you.

We may share personal information with third parties when you direct us to do so or otherwise consent.

Wayward Leaders is based in the United States. Our service providers may be located in the United States and other countries. When you use the Services, your personal information may be transferred to, stored in, and processed in jurisdictions outside your country of residence, including jurisdictions that may not provide the same level of data protection as your home jurisdiction.

For transfers of personal information from the EEA or the United Kingdom to the United States or other jurisdictions outside the EEA or the United Kingdom, we rely on appropriate safeguards required by applicable law, including the Standard Contractual Clauses adopted by the European Commission and (for UK transfers) the UK International Data Transfer Addendum or UK International Data Transfer Agreement. You may request a copy of the safeguards in place by contacting us at carl@waywardleaders.com.

We retain personal information for as long as is reasonably necessary for the purposes set forth in this Privacy Policy and to comply with our legal, accounting, tax, and reporting obligations, to resolve disputes, and to enforce our agreements. The applicable retention period depends on the type of information and the purpose for which it is processed. Examples of typical retention periods:

• Account and learner records: for the duration of your active relationship with us, and for a reasonable period afterward to support reactivation, certificate verification, and legal defense.

• Order and transaction records: for the period required by applicable tax, accounting, and consumer-protection law (typically seven years in the United States).

• Marketing data: until you opt out or otherwise withdraw consent, plus a short period to honor your opt-out.

• Communications: for a reasonable period appropriate to the nature of the communication and any associated dispute or claim.

When personal information is no longer needed, we will securely delete, anonymize, or de-identify it, except where longer retention is required by law.

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These safeguards include access controls, encryption in transit (HTTPS/TLS), password hashing, vendor due diligence on principal service providers, and limits on internal access. No method of transmission over the internet or method of electronic storage, however, is one hundred percent secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and any relevant supervisory authority as required by applicable law, including the South Dakota data breach notification law (SDCL § 22-40-19 et seq.) and any equivalent law that applies to you.

13.1 Account information. You may access and update certain account information through your Academy account settings or by contacting carl@waywardleaders.com.

13.2 Marketing email. You may unsubscribe from our marketing email at any time by clicking the unsubscribe link in any marketing message or by emailing carl@waywardleaders.com. We will continue to send you transactional and account-related communications (such as order confirmations and Course-related notices) for as long as your Account remains active.

13.3 Cookies. You may manage cookies through your browser settings and, where available, through the cookie controls on the Services. See our Cookie Policy for details.

13.4 Do Not Track. Some web browsers offer “Do Not Track” signals. Because there is no consistent industry standard for responding to these signals, we do not currently change our practices based on Do Not Track signals.

If you are located in the EEA or the United Kingdom, you have the following rights with respect to your personal information, subject to the conditions and exceptions in the GDPR and UK GDPR:

• Access: to confirm whether we process personal information about you and to obtain a copy.

• Rectification: to correct inaccurate or incomplete personal information.

• Erasure (“right to be forgotten”): to request deletion of your personal information.

• Restriction: to restrict our processing of your personal information in certain circumstances.

• Portability: to receive certain personal information in a structured, commonly used, machine-readable format and, where technically feasible, to have it transmitted to another controller.

• Objection: to object to processing based on legitimate interests, including direct marketing.

• Withdraw consent: to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

• Lodge a complaint: with the data protection supervisory authority of the EU Member State where you live, work, or where the alleged infringement occurred, or with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any of these rights, please contact us at carl@waywardleaders.com. We may need to verify your identity before responding. We will respond within the time required by applicable law (generally one month under the GDPR and UK GDPR).

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), grants you specific rights with respect to your personal information. This Section is provided to supplement the rest of this Privacy Policy.

In the preceding twelve (12) months, we may have collected the following categories of personal information about California consumers, as defined in Cal. Civ. Code § 1798.140:

• Identifiers (name, email address, postal address, IP address, account identifiers);

• Customer records information (billing details, contact information, transaction history);

• Commercial information (records of products and services purchased or considered, learning history);

• Internet or other electronic network activity information (browsing history on the Services, interaction with our pages and emails);

• Geolocation data (approximate location derived from IP address);

• Inferences drawn from the above categories to create a profile reflecting your preferences and learning interests.

The sources of this personal information, the purposes for which we use it, and the categories of recipients with whom we share it are described in Sections 3, 6, and 9 of this Privacy Policy.

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising, as those terms are defined in the CCPA. We do not knowingly sell or share the personal information of consumers under the age of sixteen.

Subject to verification and applicable exceptions, California consumers have the right to:

• know what categories and specific pieces of personal information we have collected, used, disclosed, and (if applicable) sold or shared about them;

• request deletion of personal information we have collected from them;

• request correction of inaccurate personal information;

• opt out of any sale or sharing of personal information (we currently do not engage in either);

• limit the use and disclosure of sensitive personal information (we do not intentionally collect sensitive personal information through the Services);

• not be subject to discrimination for exercising their CCPA rights.

To exercise your CCPA rights, please email carl@waywardleaders.com with the subject line “California Privacy Request” and provide enough information to allow us to verify your identity (such as your name and the email address associated with your Account). You may also use an authorized agent to submit a request on your behalf, in which case the agent must provide written authorization signed by you and we may require you to verify your identity directly. We will respond within forty-five (45) days, with one possible forty-five-day extension where reasonably necessary.

Residents of certain other U.S. states (including, depending on the date and circumstances, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others) may have additional rights under their state consumer privacy laws, including rights to access, correct, delete, and port personal information, and to opt out of certain processing activities. Where such rights apply to you and you contact us as described in Section 14 or 15, we will treat your request in accordance with applicable state law.

Wayward Leaders is organized in South Dakota and complies with South Dakota’s data breach notification law, SDCL § 22-40-19 et seq. In the event of a breach of system security that compromises the security, confidentiality, or integrity of personal information of South Dakota residents, we will notify affected residents in accordance with the timing and content requirements of that law.

We send marketing email in compliance with the federal CAN-SPAM Act of 2003 and applicable state and international laws. Our marketing email includes a valid postal address, identifies the sender, accurately describes the subject matter, and provides a clear and conspicuous mechanism to opt out of further marketing email. We honor opt-out requests promptly. For EEA and UK Users, we send marketing email only on a legal basis permitted by the GDPR or UK GDPR, including (where required) on the basis of your prior consent or, for existing customers of similar courses and products, our legitimate interests, subject to your right to object at any time.

We do not make decisions about you that produce legal effects concerning you, or similarly significantly affect you, that are based solely on automated processing. Course progress tracking and assessment scoring are automated calculations that do not constitute solely automated decision-making for purposes of the GDPR or UK GDPR.

The Services may contain links to third-party websites, applications, or services that are not operated by Wayward Leaders. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices or content of any third party, and we recommend that you read the privacy policy of any third party before providing personal information to it.

Our Courses, books, and other Content may reference manufacturer product names and images (such as ABB and other industrial equipment manufacturers) for educational and identification purposes, may include AI-generated or stock images (including outputs from Adobe Firefly), and may use licensed typefaces (such as Montserrat and Palatino). Such third-party materials are used under the relevant license terms, fair use principles, or as nominative reference. The use of third-party trademarks does not imply endorsement, sponsorship, or affiliation. If you believe any third-party material has been used improperly, please contact us at carl@waywardleaders.com.

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date above and, where the changes are material, provide reasonable additional notice (which may include email notice or an in-platform notice). Your continued use of the Services after the effective date of any revised Privacy Policy constitutes your acknowledgment of the revised Policy, except where additional consent is required by law.

The Services are operated from the United States. If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. By using the Services, you understand that your personal information may be transferred to and processed in the United States and other jurisdictions that may have different data protection laws than your country, subject to the protections described in Section 10.

24.1 Authorized agents. Where permitted by applicable law, you may use an authorized agent to submit a request to exercise your rights. We may require the agent to provide proof of authority (such as a signed written authorization or, where applicable, a valid power of attorney) and may require you to verify your identity directly with us.

24.2 Verification. To protect your information, we will take reasonable steps to verify your identity before responding to a request. The verification steps will depend on the type of request, the sensitivity of the information involved, and the nature of your relationship with us. We may decline a request if we cannot reasonably verify your identity.

24.3 Appeals. Where required by applicable law, you may appeal a denied request by replying to our response with the subject line “Privacy Appeal” and an explanation of why you believe our determination was incorrect. We will review and respond within the time required by applicable law.

If you have any questions, comments, or concerns about this Privacy Policy or our handling of your personal information, please contact:

Wayward Leaders LLC

Sioux Falls, South Dakota, United States

Privacy contact: Dr. Carl Lee Tolbert

Email: carl@waywardleaders.com

Phone: (678) 523-2050

© 2026 Wayward Leaders LLC. All rights reserved.