Privacy Policy

Who we are

The Let's Talk Culture Offsite Toolkit is provided by Shane Michael Hatton Pty Ltd ("we"). This policy explains what personal information we collect, how we use it, and the choices you have. When an organisation buys licences for its people, that organisation is usually the controller of its team's data and we process it on their behalf; a Data Processing Agreement is available on request.

What we collect

Account details you give us (your name and email). The content you create in the platform, such as your agenda, comms plan and culture action plan. Basic technical data needed to run and secure the service, such as log and device information. A record of your purchase. When you poll the room, participants join anonymously from their phones with no name, email or login, and we only store the text or vote they submit.

How we use it

To provide the platform and its features, to support you, to process and record your purchase, to keep the service secure, and to improve the product. We do not sell your data, we do not show ads, and we do not use your content to train AI models.

Who processes your data

We use a small set of trusted providers to run the service. Each handles only what it needs to, under its own security and privacy commitments:

• Supabase — application database and sign-in. Hosted in Australia.
• Vercel — web hosting and serverless functions. Global infrastructure, primarily United States.
• Stripe — payment processing. Global.
• Anthropic — the AI-generated suggestions in our AI features. United States.
• Resend — sending transactional email. United States.
• Bunny — video streaming and delivery. Global content network.

Where your data is processed

Your core content is stored in a database hosted in Australia. Some processing happens outside Australia: the AI features send text to a provider in the United States, and email and video delivery use global providers. Where data is handled overseas we rely on reputable providers and their contractual protections. Each customer's data is isolated with database row-level security, so one customer can never see another's content.

AI features

Some features send the text you enter to our AI provider (Anthropic) to generate a suggestion, such as an agenda or an answer from the guide. That text is processed only to give you a response and is not used to train their models under our commercial arrangement. As with any AI, suggestions can be imperfect, so use your judgement.

Payments

Payments are processed by Stripe. Your card details are handled entirely by Stripe and never reach our servers. We keep a record of your purchase so we can give you access and meet our tax and accounting obligations.

Security

We protect your data with encryption in transit and at rest, per-account isolation, restricted internal access, and secure sign-in with a password or a one-time link. No system is perfectly secure, but we take reasonable steps to keep your information safe.

How long we keep it

We keep your data while your account is active. If you close your account or ask us to delete it, we remove your content, though we may retain limited records such as proof of purchase where the law requires. You can delete any poll and its responses yourself at any time.

Your rights

You can access, correct, export or delete your data. Export your plans as Word documents at any time, and email us to access or delete your account and its content. If you are in the EU or UK you have rights under the GDPR, including to object to or restrict processing; if you are in Australia you can raise a concern with the Office of the Australian Information Commissioner.

Data breaches

We maintain a process to detect and respond to security incidents. If a breach were likely to cause serious harm, we would notify you and the relevant regulator as required under Australia's Notifiable Data Breaches scheme and, where applicable, the GDPR.

Children

The platform is made for workplaces and is not directed at children. We do not knowingly collect data from anyone under 16.

Cookies

We use only the essential cookies needed to keep you signed in. We do not use advertising or tracking cookies.

Changes and contact

We may update this policy from time to time; the date above shows when it last changed. For any privacy question, or to access or delete your data, contact us at contact@shanemhatton.com.