Privacy policy
Armas Design LLC
Last updated: August 5, 2026
This Privacy Policy explains how Armas Design LLC (“we,” “us”) handles personal information across our services: michellearmas.com; catalystacademy.art and the Catalyst membership hub; our landing and registration pages and link-in-bio microsite; and our email newsletters, SMS program, and related communications (together, the “Services”). One company is responsible for your data across all of it.
For any privacy question or request, email legal@michellearmas.com.
1. Information We Collect
You provide: contact details (name, email address, phone number if you opt into SMS, shipping and billing address); account credentials; purchase history (payment card details are collected and processed directly by our payment processors — we never see or store full card numbers); member participation (artwork submitted for critique, community posts, questions, and your appearance, voice, and chat in live sessions — live classes are recorded, and those recordings, including participants who appear or speak in them, become part of the member content library; see the Catalyst Terms & Conditions for how recordings are used); communications with us; and commission or licensing inquiry details.
Collected automatically: device and usage data (IP address, browser and device type, pages viewed, referring URLs, approximate location); marketing attribution (the source that brought you to us, such as UTM parameters, attached to signups and purchases); and cookies and similar technologies (Section 4).
Sensitive information. We intentionally collect little sensitive information, but some of what we hold qualifies under certain state laws: account login credentials are treated as sensitive personal information where the law says so, and we protect them accordingly. We may also incidentally receive sensitive information you volunteer — for example, health or family details mentioned in a critique, community post, or support email. We do not use such incidental information for anything beyond the interaction in which it appeared, and we ask that you avoid posting sensitive personal details in community spaces.
2. How We Use Information
To: fulfill orders and provide access to purchased Programs and content; process payments, subscriptions, and renewals, and prevent fraud; run live classes, critiques, communities, and replays; send transactional messages (receipts, access details, reminders, notices); send marketing email and SMS you signed up for (every message includes an opt-out); measure how people find and use the Services and improve them; advertise our products (Section 4); keep records of your consents and choices; and enforce our terms and comply with law.
3. How We Share Information
We do not sell personal information for monetary consideration. We may share identifiers and internet-activity data with advertising partners for cross-context behavioral advertising, as described in Section 4, subject to the opt-out rights in Section 9.
Service providers. We share information with providers who perform services for us, under terms designed to limit their use of your data to those services. Current categories include: e-commerce and site hosting (Shopify and installed apps); payments (Stripe, PayPal, and wallet providers such as Shop Pay, Apple Pay, and Google Pay); email and SMS delivery (Klaviyo and its messaging vendors); funnels and landing pages (ClickFunnels); membership platform and access control; live classes (Zoom); social messaging automation (ManyChat); systems automation (Zapier); site analytics used for our own measurement (Google Analytics); shipping carriers and fulfillment vendors; cloud storage and support tooling; and professional advisers and fraud-prevention services where needed.
Advertising partners (third parties). Meta (Facebook/Instagram) and Google advertising services receive identifiers and internet-activity data from our sites for cross-context behavioral advertising and ad measurement. For that activity they act as third parties, not our service providers, may combine that data with data from other sources per their own policies, and the opt-out rights in Section 9 apply.
Community visibility. Content you post in member community spaces — including our private Facebook group — is visible to other members, and Facebook’s own privacy policy applies to data Facebook collects there.
Legal and business. We may disclose information to comply with law or legal process, enforce our terms, protect rights and safety, or in connection with a merger, sale, or reorganization (this policy continues to apply to transferred data until updated).
Mobile and SMS data. Mobile information, text-messaging originator opt-in data, and consent records are not sold or shared with third parties for their own marketing or promotional purposes. We share them with our service providers and carriers solely as necessary to operate the SMS Service.
4. Cookies, Pixels & Advertising
We use: essential cookies (cart, checkout, login — always on); analytics (Google Analytics, to understand site traffic and behavior); and advertising technologies (the Meta pixel and related tags) that collect device and activity data to measure and improve our advertising. Under some state laws, this advertising use is “sharing” for cross-context behavioral advertising, and you may opt out (Section 9).
You can also control cookies through your browser settings, opt out of Google Analytics via Google’s browser add-on, and adjust ad preferences in your Meta account settings.
5. SMS Program
If you opt into text messages, our Mobile Terms of Service (posted with our Terms of Service) govern. Consent is not a condition of purchase. Opt out at any time by replying STOP — or any other reasonable revocation, as described in the Mobile Terms — or by emailing legal@michellearmas.com.
6. How Long We Keep Information
We keep personal information no longer than reasonably necessary for the purposes described above, using these categories and criteria:
- Order, payment, and tax records — as long as tax and accounting law requires.
- Member accounts — while active, plus a limited wind-down period after closure for reactivation and dispute handling.
- Support communications — for the period needed to resolve and document the matter.
- Marketing profiles — until you unsubscribe or the data is no longer needed; suppression (opt-out) records are kept indefinitely so we do not contact you again.
- Attribution and analytics records — per the retention settings of the analytics and advertising tools in use.
- Consent records (terms acceptance, media releases, SMS consent) — for as long as the related relationship plus applicable limitations periods.
- Class recordings, critique submissions, and community content — retained as part of the Program library per the Catalyst Terms & Conditions (see Section 9 on how deletion interacts with recordings).
- Commission and licensing files — for the life of the project plus applicable limitations periods.
- Security logs — for a limited rolling period.
When retention ends we delete or anonymize data, or isolate it from use where immediate deletion is not possible (for example, backups) until deletion occurs.
7. Security
We use reasonable organizational and technical safeguards appropriate to the data we handle, and we rely on the security programs of our major processors for payment and hosting infrastructure. No system is perfectly secure; we will notify you of a breach where the law requires.
8. International Transfers
We are a U.S. company and process data primarily in the United States; our service providers and their subprocessors may process data in other countries. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S. and those countries. Where EU or UK data-protection law applies to a transfer, we rely on appropriate safeguards such as our providers’ standard contractual clauses or data-privacy-framework certifications.
9. Your Privacy Rights and Choices
Everyone: unsubscribe from marketing email (link in every email); opt out of SMS (Section 5); update your account information by logging in; or email legal@michellearmas.com to request access to, correction of, or deletion of your personal information. We verify requests (and accept authorized-agent requests with proof of authority), respond within the time applicable law requires, and do not discriminate against you for exercising your rights. If we decline a request, we will explain why, and where state law provides an appeal right you may appeal by replying to our decision; we respond to appeals within the legally required period.
Targeted-advertising opt-out. To opt out of cross-context behavioral advertising or “sharing,” use the privacy-choices control on our sites where available, adjust the settings described in Section 4, or email legal@michellearmas.com. We honor Global Privacy Control (GPC) signals as opt-out requests where required by law. You may change your choice at any time, and we keep records of your choices.
Deletion and recordings — what to expect. If you were a member, deletion removes your account data, marketing profile, and standalone submissions we control. Completed class and critique recordings in which you appear or speak are retained in the member-only content library, per the license in the Catalyst Terms & Conditions: removing individual participants from finished recordings is generally not practical, participation in recorded sessions is on the basis of the irrevocable replay consent described there, and deletion requests do not require us to edit or remove completed recordings. They remain member-only, not public. Where non-waivable local law gives you a broader right, we will comply to the extent that law requires. Where we used your content publicly under a media release you later withdraw, we stop new uses and make reasonable efforts to remove it from channels we control. Legal retention obligations (Section 6) also survive deletion requests.
California “Shine the Light”: we do not share personal information with third parties for their own direct marketing.
EEA, UK, and Switzerland residents: you have rights of access, rectification, erasure, restriction, portability, and objection, and may withdraw consent prospectively. Our lawful bases are contract performance (orders, memberships), legitimate interests (analytics, security, marketing to customers), consent (marketing signups, and cookies where required), and legal obligation. You may complain to your local supervisory authority.
10. Minors
The Services are for adults 18 and older. A minor may only observe content through a parent’s supervised account and may not register, post, submit content, or appear in recordings (see our Terms of Service and Catalyst Terms & Conditions). We do not knowingly collect personal information from anyone under 18; if you believe we have, email legal@michellearmas.com and we will delete it.
11. Changes to This Policy
We will update this policy as our practices or the law change and revise the “Last updated” date. Material changes will be notified by prominent posting or by email.
12. Contact
Armas Design LLC — legal@michellearmas.com