Privacy policy.

Draft for legal review. Items in [brackets] are still to be confirmed.

The short version

• We collect only what we need to run your membership, answer you and send the letters you asked for.
• We never sell your information, and there are no advertising trackers or third-party analytics on this site.
• Your 8 Areas Assessment answers are scored in your browser. They reach us only if you ask us to email your results or to share them.
• You can ask to see, correct or delete your information at any time.

Who we are

This policy explains how Chi Coaching (Jeremy Cole, ABN [ABN to be added]) handles personal information. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). [Confirm whether the Privacy Act applies to the business by turnover or because it handles health information; this policy is written to meet the Principles either way.]

Questions or requests: jc@chi.net.au.

What we collect, and why

When you join or buy

Your name, email address, membership level, whether you pay monthly or yearly, and the dates of your membership. Payments are handled by Stripe: you enter your card details on Stripe's secure page, and we never see or store your full card number. Stripe tells us whether a payment succeeded and gives us a customer reference so we can manage your membership.

For gifts, we also keep the buyer's name and email, the recipient's name and email if you give them, and any message you write.

Your Chi Dashboard account

When you join or redeem a gift, we send your email address and membership level to Supabase, which hosts the Chi Dashboard, so your account can be created and your level recorded. What you do and save inside the Dashboard (such as your 8 Areas over time) is stored there. [Link a Dashboard-specific privacy notice if the Dashboard collects more than described here.]

Letters and the email list

If you sign up for letters, or tick the box to hear from us, we add your email address (and name, if you give it) to our email service, Kit. We may tag you so the right emails reach you, for example "took the assessment" or your membership level. Every email has an unsubscribe link.

The 8 Areas Assessment

Your answers are scored in your own browser. If you simply take the assessment and read your results, your answers are not sent to us.

If you ask us to email your results, or choose to share them with Jeremy, we keep your email address, name if you give it, your scores and the area that scored lowest, so we can send them and, if you've asked, follow up. [Retention period to be confirmed.]

Messages and applications

When you use the contact form or apply for private coaching or a retreat, we keep what you send: your name, email address, your message, and anything you choose to tell us about yourself. Applications may include things that are sensitive, such as your health or what you're going through. Please share only what you're comfortable sharing; we use it only to consider your application and to look after you if you join.

How people find the site, without tracking you

• Anonymous daily counts. We count things like "how many assessments were started today" and which link people arrived from. These counts contain no names, email addresses or IP addresses.
• Lead source. If you arrive from one of our links (for example an Instagram post), a short note of that link is kept in your browser tab's sessionStorage, which is cleared when you close the tab. If you then send a form or join, that note is sent with it, so we know which posts help people find Chi.
• Spam protection. To stop automated spam, forms briefly count how often a device sends them. Your IP address is turned into a one-way code for this and is not stored; the count expires within [24 hours].

Cookies

We don't use advertising, analytics or tracking cookies. The site sets one functional cookie for visitors:

• chi_m: set after you join or redeem a gift on this device. It remembers your email address and membership level for up to 180 days, so the site can greet you and show "Open Dashboard". It's signed so it can't be altered, can't be read by scripts on the page, and gives no access to anything paid. Use "Not you?" on the home page, or clear your cookies, to remove it.

If you sign in to the site's admin area (only Chi staff do this), WordPress sets its own sign-in cookies.

Our website host

Our host, [Hostinger], keeps standard server logs (such as IP address, browser and pages requested) for security and to keep the site running. [Confirm log retention.]

Who we share it with

We share personal information only with the services that help us run Chi, and only what each one needs:

• Stripe for payments;
• Supabase for Chi Dashboard accounts;
• Kit for letters and the email list;
• [Hostinger] for hosting the website, and [email delivery provider] for sending emails from the site.

Some of these providers store information outside Australia, including in [the United States and the European Union]. We choose providers with strong security and privacy commitments and take reasonable steps to make sure they handle your information consistently with the Australian Privacy Principles.

We never sell or rent your information, and we don't share it for advertising. We may disclose information if the law requires it, or if we believe it's needed to prevent a serious threat to someone's life, health or safety.

How long we keep it

We keep membership and purchase records for as long as you're a member and then for [7] years, as tax law requires. Messages and applications are kept for [2] years unless you ask us to delete them sooner. Email-list details are kept until you unsubscribe. [Confirm all retention periods.]

Keeping it safe

Access to personal information is limited to the people who need it to run Chi. The site uses encryption (HTTPS), card payments happen on Stripe, and our providers are chosen for their security. No system is perfectly secure; if a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Seeing, correcting or deleting your information

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email jc@chi.net.au from the address we know you by, and we'll respond within 30 days. There's no charge. We may need to keep some records where the law requires it (for example, payment records), and we'll tell you if so.

You can change your level, pause or cancel your membership any time from Manage my membership, and unsubscribe from letters using the link in any email.

Complaints

If you're worried about how we've handled your information, please tell us first at jc@chi.net.au. We'll look into it and reply within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Children

Chi is designed for adults. We don't knowingly collect information from anyone under [18].

Changes to this policy

We may update this policy as Chi changes. We'll post the new version here, and email members about any important change.

Date of effect: [to be confirmed]