Privacy Policy
Last updated: August 22, 2026
Plain-English summary
We collect very little. Your email address if you subscribe, what you need to give us to buy something, and basic technical information that any website receives.
We do not sell your personal information and we do not run advertising trackers. We do use Google Analytics to see how the site is used, and you can turn it off using our cookie banner. We also use email marketing software that records whether you open and click our emails, and coaching sessions are recorded. All of that is explained below.
If you want to know what we hold about you, or want it deleted, email hello@incomeoptionslab.com and we will take care of it.
1. Who we are
Income Options Lab is the operating name of Ahmad Jawid Rostayee, a sole proprietorship in Ontario, Canada. We are the controller of the personal information described here.
This policy covers incomeoptionslab.com, our emails, our digital products, our coaching sessions, and any community we operate.
Privacy questions and requests: hello@incomeoptionslab.com
2. What we collect, and where it comes from
When you subscribe to our email list. Your name where you provide it, your email address, and the form you signed up through. Our email provider also records your IP address and the time of signup as proof of consent, and whether you open our emails and click links in them.
When you buy something. Your name, email address, billing country, and the last four digits and card type of your payment method. Our payment providers handle the transaction and we never see or store your full card number.
When you book coaching. Your name, email address, the time slot you booked, and anything you choose to tell us before or during the session. Sessions are recorded, and our video software produces an automatic transcript and notes.
When you join a community. Your Discord username and account identifier, your membership status and billing history from our membership platform, and everything you post inside the community.
When you visit the site. Standard server information including your IP address, browser and device type, the pages you viewed, and the time of your visit. Our web host records this automatically as part of running the site. If you accept analytics cookies, we also collect the information described in Section 8.
We do not ask for and do not want your brokerage credentials, account numbers, account balances, or trading positions. Please do not send them to us.
3. Why we use it, and our legal basis for doing so
To deliver what you bought, including sending your files, running your coaching session, and providing community access. Legal basis: performance of our contract with you.
To send you educational emails and updates. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in any email.
To understand how the site is used, so we can improve it. Legal basis: your consent, given through our cookie banner, where the law where you live requires consent before analytics cookies are set. Elsewhere, our legitimate interest in improving the site, which you can object to using the same banner.
To respond to you when you contact us for support. Legal basis: our contract with you, or our legitimate interest in answering questions.
To keep the site and community secure, prevent abuse, and detect fraudulent transactions. Legal basis: our legitimate interests.
To meet legal obligations, including keeping financial records for tax purposes. Legal basis: legal obligation.
We do not use your information to make automated decisions that produce legal or similarly significant effects.
4. Email tracking
Our email platform records whether you open our emails and which links you click. We use this to see which material is useful and to stop sending to addresses that never engage. Most email marketing works this way and few businesses say so plainly, which is why we are saying it here.
You can prevent open tracking by turning off remote image loading in your email client, and you can stop all of it by unsubscribing.
5. Coaching sessions
Coaching sessions are recorded, and the video platform we use generates an automatic transcript and notes. That means the platform processes what is said during the session.
Recordings and transcripts are used to support you after the session and to improve how the sessions are run. They are not published, sold, or shared with anyone outside the business, and they are not used as marketing material without your separate written permission.
You will be told a session is recorded before you book and again at the start of the call. If you do not want to be recorded, tell us before the session and we will make other arrangements.
Recordings and transcripts are kept for 12 months and then deleted. You can ask us to delete yours sooner at any time.
6. Community spaces
Our communities run on Discord, using a third-party membership platform for billing and access.
Anything you post in a community is visible to other members and to us, and it stays in the message history after you leave unless you delete it yourself. Please treat it as you would any semi-public forum, and do not post anything about your finances that you would not want other members to see.
Discord and our membership platform each collect and process your information under their own privacy policies, which we do not control. Your relationship with them is separate from your relationship with us.
7. Affiliate links
Some links on our Resources page are affiliate links, including Amazon Associates and various software and brokerage partners. When you click one, the destination site is told the visit came from us, usually through a tracking code in the link, and that site may set its own cookies to record it.
We are paid a commission on qualifying signups or purchases. We do not receive your name, contact details, or payment information from those merchants, only aggregate reporting on referrals and commissions.
8. Cookies, analytics, and embedded content
Cookies are small files stored on your device by a website. Some are needed to make a site work, and others record how the site is used.
Your choice comes first. When you first visit, you are asked whether to accept cookies that are not strictly necessary. Embedded video and fonts do not load until you accept. Analytics works slightly differently depending on where you are: in regions whose law requires consent before any analytics cookie is set, nothing is recorded until you accept. Elsewhere, analytics may begin when the page loads. Either way, choosing Deny stops it, the site works normally without it, and you can change your choice at any time using the consent link on the site.
Cookies we rely on to run the site. These include WordPress session and preference cookies, cookies set by our email platform’s signup forms, and Google reCAPTCHA, which protects those forms from automated spam and operates under Google’s privacy policy. These are necessary for the site to function and are not subject to consent.
Analytics. Subject to the consent choice described above, we use Google Analytics 4 to understand how the site is used, which pages people find useful, and where visitors arrive from.
Google Analytics records the pages you visit, an approximate location derived from your IP address, your device and browser type, the site or source that referred you, and interactions such as file downloads, form submissions, and clicks on links leading to other websites. It sets cookies in your browser so that a returning visitor can be distinguished from a new one. IP addresses are anonymized and are not stored, and we cannot use this information to identify you by name. We look at it in aggregate: it tells us that a page was read or a resource was downloaded, not who did it.
Google processes this information as our service provider and also for its own purposes. Google’s Analytics service includes optional data-sharing settings covering product improvement, aggregated benchmarking and modelling, technical support, and account recommendations, and these are currently enabled on our account. What Google does with the information is governed by Google’s Privacy Policy and by the terms of the Google Analytics service. We have accepted Google’s data processing terms for this purpose.
Embedded content. Some pages embed YouTube videos. With your consent, the player loads from YouTube’s servers, which may set cookies and record your interaction with the video under Google’s Privacy Policy. Until you consent, a placeholder is shown in place of the player. Our pages also load fonts from Google, and these are blocked until you consent.
Link tagging. We add tracking parameters to some links, including links inside our free downloadable resources, so we can tell which resource or campaign a visitor arrived from. These identify the source of the visit, not the person making it.
Your other choices. You can block or delete cookies in your browser settings, though some features may stop working. You can opt out of Google Analytics on every site you visit by installing the Google Analytics Opt-out Browser Add-on.
We do not run advertising pixels, retargeting tags, or remarketing. If that changes, this policy will be updated before those tools go live.
9. Who we share information with
We do not sell personal information, and we have never sold or shared it for cross-context behavioural advertising. We do not rent or trade email lists.
We share information only with the service providers that run the business: our email platform, our payment processor for books and coaching, our membership billing platform, Discord, our video conferencing and calendar provider, our analytics provider, our web host, and the cloud storage provider that holds our site backups. Each receives only what it needs to do its job, and each has its own privacy policy governing what it does with that information.
We may also disclose information where required by law, or to establish, exercise, or defend a legal claim, including responding to a payment dispute.
If the business is ever sold or transferred, customer information may transfer with it, and you would be notified before that happened.
10. International transfers
We are in Canada and our service providers are mostly in the United States. If you are outside those countries, your information will be transferred to and processed in them, where privacy laws differ from your own.
Where required, we rely on standard contractual clauses or equivalent safeguards offered by those providers. Where Google processes analytics information on our behalf, it does so under Google’s data processing terms, which include the safeguards required for transfers out of the European Economic Area and the United Kingdom.
11. How long we keep information
Email subscribers: until you unsubscribe or ask for deletion, after which we retain a minimal suppression record so we do not email you again by mistake.
Purchase and transaction records: at least six years, because Canadian tax law requires it.
Coaching recordings, transcripts, and notes: 12 months, or sooner on request.
Community data: for the duration of your membership. Posts remain in message history afterward unless deleted.
Analytics data: retained by Google under the retention period set in our Analytics account, currently 14 months for user and event data, after which it is deleted automatically. Aggregated reporting is retained indefinitely.
Site backups: two scheduled backups are retained at a time and older ones are overwritten automatically. Backups contain copies of the information described above and are stored in cloud storage under our control.
Server logs: as retained by our web host under its own schedule.
We may retain specific information beyond the periods above where it is needed to establish, exercise, or defend a legal claim, and only for as long as that is necessary.
12. Security
We use reasonable technical and organizational measures to protect your information, including reputable providers, two-factor authentication on business accounts, and limiting access to what is needed. We are a one-person business and access is limited to the owner.
No system is completely secure. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the relevant authorities as the law requires.
13. Your rights
Depending on where you live, you may have the right to access the information we hold about you, correct it, delete it, receive a copy in portable form, object to or restrict certain processing, and withdraw consent at any time.
To exercise any of these, email hello@incomeoptionslab.com. We will respond within 30 days and will not charge you or treat you differently for asking.
If you are in California, note that we do not sell or share personal information as those terms are defined under the CCPA. If you are in the EU or UK, you may lodge a complaint with your local supervisory authority. If you are in Canada, you may complain to the Office of the Privacy Commissioner of Canada.
14. Children
Our products and services are for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with information, email hello@incomeoptionslab.com and we will delete it.
15. Changes to this policy
We may update this policy. The current version is always posted here with its effective date. If a change materially affects how we handle your information, we will tell subscribers by email before it takes effect.
16. Contact
Privacy questions, access requests, and deletion requests: hello@incomeoptionslab.com
Product support, delivery, and refunds: support@incomeoptionslab.com