Privacy Policy

1. Information we collect

Account and profile. When you create an account, we store your email address. If you sign in with Google, we receive the name, email, and profile photo Google shares with us. You can also add a name, photo, headline, bio, location, role, learning goals, a contact email, a website, and a LinkedIn URL. These profile fields are optional.

Purchases. Stripe handles checkout. We receive a record of each purchase: customer and payment IDs, billing name, email and country, amount, currency, product, discount code, and whether the payment was refunded or disputed. We never receive your full card number. Stripe’s privacy policy explains what Stripe collects.

Learning activity. We store your enrolments, lesson progress, video completion, quiz attempts and scores, project submissions, certificates, and badges. We need these to run the course: to unlock lessons, track completion, grade quizzes, issue certificates, and check refund eligibility (see section 3).

Certificates. Anyone with a certificate’s link can view it. The link uses a random serial. The certificate shows your name and the course you completed, and we store its image so you can share it.

Live sessions and community. If you join a live session, we may record it, including your name, and your image, voice, and chat messages if you turn them on or post. If you join our Slack community, Slack handles your information under its own policy.

Support. If you email account@insertframe.io or contact us through our support chat, we keep that conversation and any details you include.

Device, usage, and advertising data. When you visit the site, we and our providers collect your IP address, browser and device type, pages viewed, links clicked, the page you came from, approximate location based on IP, and cookie or device identifiers. Some of this comes from the Meta Pixel and Google tags described in section 4.

What we do not collect on purpose. We do not ask for government ID numbers or for sensitive information such as health, racial or ethnic origin, religion, sexual orientation, or political opinions. Please do not put this kind of information in a submission, profile field, or support message.

2. How we use your information

We use personal information to:

• create and secure your account, including magic-link and Google sign-in
• provide the courses you bought, track progress, grade quizzes, and issue certificates
• take payments, prevent fraud, and handle refunds and disputes
• send emails about your account, purchases, and courses
• send marketing emails about our courses and products, which you can unsubscribe from at any time
• measure how the site and our ads perform, and show our ads to people who have visited the site (section 4)
• answer support requests and improve the Service
• run, debug, and protect the Service
• meet legal, tax, and record-keeping obligations

We do not sell your personal information. We do not use your submissions or learning data to train public AI models. We do not show third-party ads on the site.

3. Automated decisions

Some parts of the Service make decisions automatically, using rules we set:

• Refund eligibility. Our system checks your recorded course progress and purchase date to see whether you qualify for a change-of-mind refund under that course’s refund policy.
• Lessons and certificates. Our system unlocks lessons, marks lessons complete, grades quizzes, and decides whether you have met the requirements for a certificate.
• Security. Our system may flag or limit an account that shows signs of sharing or abuse.

These decisions use your learning activity, purchase records, and account activity. If you think an automated decision is wrong, email account@insertframe.io and a person on our team will review it.

4. Cookies, Meta Pixel, and Google tags

5. Who we share it with

We share personal information with service providers who help us run the Service. They handle it on our behalf, or under their own privacy policies where noted in section 4.

We may also share information:

• if the law requires it, or to respond to a valid legal request
• to protect our students, staff, or the Service, or to prevent fraud
• with a buyer or successor if we sell or restructure the business, who must handle it in line with this policy

Our staff can see project submissions so they can review them. We do not show your submissions to other students unless you choose to share them.

6. Overseas disclosure

Our service providers store and process information outside Australia. This includes the United States, where most of our providers are based and where our Supabase database is hosted. These countries may not have privacy laws equivalent to Australia’s. We choose providers we consider suitable for the information they hold and rely on their security and contractual commitments. We take reasonable steps to make sure they handle your information in line with the Australian Privacy Principles.

7. How long we keep it

• Account, enrolment, and purchase records: while your account is open, then for 7 years for tax, dispute, and audit purposes.
• Progress, quiz results, and submissions: while your account is open, so your course record stays intact.
• Certificates: kept so a shared certificate link keeps working, until you ask us to withdraw it.
• Support conversations: for as long as we need them to help you and keep a record of what was agreed, usually up to 3 years.
• Analytics and advertising data: for the retention period set in each provider’s tools, which we keep to the shortest practical setting.

If you ask us to delete your account, we delete or de-identify the profile and learning data we no longer need. We keep only a minimal purchase record where the law requires it.

8. Security

We protect your information with access controls, encrypted connections, and signed video links that expire. Stripe handles all card details. Only staff who need access to student records can see them.

No method of storage or transmission is completely secure. If we have a data breach that is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Privacy Act requires.

9. Your rights

You can:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong, out of date, or incomplete (you can also update most profile fields yourself)
• ask us to delete your account, subject to the records we must keep
• unsubscribe from marketing emails using the link in any of those emails
• turn off analytics and advertising cookies (section 4.5)
• ask a person to review an automated decision (section 3)

To make a request, email account@insertframe.io. We may need to confirm you control the account before we act. We will respond within 30 days. If we refuse a request, we will tell you why and how to complain.

Complaints. If you think we have mishandled your information, email account@insertframe.io with the details. We will look into it and reply within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

10. Extra rights in the EU and UK

If the EU or UK GDPR applies to you, we are the controller of your personal information. We rely on these legal bases: performing our contract with you (accounts, courses, and payments), our legitimate interests (security, support, improving the Service, and measuring and promoting our courses), and legal obligations (tax and records). You can object to analytics and advertising at any time using the options in section 4.5.

You also have the right to object to or restrict our processing, to receive your information in a portable format, and to complain to your local data protection authority. When we transfer your information outside the EU or UK, we rely on the safeguards our providers offer, such as standard contractual clauses.

11. Children

The Service is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you think a child has given us personal information, email account@insertframe.io and we will delete it.

12. Changes to this policy

We may change this policy at any time. The current version is always on this page with its effective date. If a change materially affects how we use your personal information, we will email account holders before it takes effect.

13. Contact