Last updated: 19 August 2026
Privacy Policy
Mindspan Pty Ltd (88 377 453 125) ("Mindspan", "we", "us") operates the platform at app.mindspan.com.au. This policy explains how we collect, hold, use, and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
By using our platform you agree to the collection and use of information as described in this policy. If you do not agree, do not use the platform.
1. Who we are
Mindspan is an independent educational platform operated by a registered psychologist (AHPRA registration current). We provide psychoeducational resources, study programs, and related digital content. We are not a clinical service and do not provide psychological treatment through this platform.
2. Information we collect
Account information: Name, email address, and password (hashed) when you create an account.
Purchase information: Payment is processed by Stripe. We receive confirmation of payment and your email address. We do not store card numbers or bank details.
Usage data: Pages visited, resources accessed, and program progress within the platform, collected via Supabase.
Site analytics: We run our own analytics on Mindspan’s websites. We record a randomly generated visitor ID stored in a cookie on your device, the site that referred you, any campaign tags (UTM parameters) in the address you arrived on, the forms you submit (that you signed up, not what you wrote), your purchases and course enrolments, and — where enabled — whether you opened or clicked a link in an email we sent you. Our own analytics may also record the pages you view and the links you click. This information is stored in our own Supabase database in Australia, is visible only to Mindspan staff, and is never sold or shared with advertisers. We also run Google Analytics and Vercel Analytics on our public pages, which collect their own usage statistics separately under their own privacy terms — our own analytics data described here is not sent to them. Our analytics does not record what you type into any form or message box, the content of your answers to any questionnaire, or anything clinical. It does not store your IP address — some signup forms separately store a one-way hash of your IP purely to detect abuse, from which your address cannot be recovered.
Communications: If you contact us by email, we retain your message and any follow-up correspondence.
Email marketing: If you purchase a program or subscribe to updates, your name and email are added to our email platform (Brevo) for delivery of program emails and relevant updates. You may unsubscribe at any time.
We do not collect sensitive information (as defined by the Privacy Act) through this platform. We do not collect health information through app.mindspan.com.au.
3. How we use your information
- To create and manage your account
- To process purchases and grant access to paid programs
- To deliver program-related email sequences
- To respond to enquiries and support requests
- To improve platform content and user experience
- To comply with legal obligations
We do not use your information for automated decision-making that produces legal or significant effects.
4. Disclosure to third parties
We disclose personal information only to the following third-party service providers, each bound by their own privacy commitments:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Australia (ap-southeast-2) |
| Stripe | Payment processing | USA (with standard SCCs) |
| Brevo (Sendinblue) | Email delivery and automation | EU (with standard SCCs) |
| Vercel | Web hosting, deployment and site analytics | USA (with standard SCCs) |
| Google Analytics | Aggregate website usage statistics | USA (with standard SCCs) |
We do not sell personal information. We do not share information with advertisers.
Where personal information is disclosed to overseas recipients (Stripe, Brevo, Vercel — USA/EU), we take reasonable steps to ensure those recipients handle it in a manner consistent with the APPs (APP 8).
5. Data storage and security
Account and program data is stored in Supabase on servers in the AWS ap-southeast-2 (Sydney) region. Passwords are hashed using bcrypt and are never stored in plaintext. Payment data is held solely by Stripe and is not stored on our servers.
We use industry-standard security measures including TLS encryption in transit, row-level security in our database, and access control policies. No system is completely secure — if you become aware of a security issue, please contact us immediately at info@mindspan.com.au.
6. Retention
We retain account information while your account is active and for seven years thereafter for financial and legal compliance purposes. Purchase records are retained for seven years in accordance with the Income Tax Assessment Act 1997 (Cth). Email addresses on marketing lists are retained until you unsubscribe or request deletion.
7. Your rights (APP 12 and APP 13)
You have the right to:
- Access the personal information we hold about you
- Correct personal information that is inaccurate, out of date, or incomplete
- Request deletion of your account and associated data (subject to our legal retention obligations)
- Unsubscribe from marketing emails at any time via the unsubscribe link in any email or by contacting us
To exercise these rights, email info@mindspan.com.au. We will respond within 30 days.
8. Cookies and tracking
We use session cookies necessary for authentication and platform function. We also set one first-party analytics cookie holding a randomly generated visitor ID, which lets us see a single visit as one journey rather than a series of disconnected page views (see “Site analytics” above). We do not use third-party advertising cookies and we do not sell cookie data. Google Analytics and Vercel Analytics set their own cookies on our public pages under their own terms; because our analytics cookie is readable by scripts on the page, we cannot technically guarantee a third-party script never reads it, so we do not claim otherwise. Disabling cookies will prevent you from logging in to the platform. If your browser sends a Do Not Track or Global Privacy Control signal, our own analytics respects it and records nothing about your visit.
9. Children
This platform is intended for adults aged 18 and over. We do not knowingly collect personal information from individuals under 18. If you become aware that a minor has provided us with personal information, contact us and we will delete it.
10. Complaints
If you believe we have breached the APPs, please contact us first at info@mindspan.com.au. If we do not resolve the matter to your satisfaction, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
11. Updates to this policy
We may update this policy from time to time. Material changes will be communicated by email or a notice on the platform. Continued use after notification constitutes acceptance of the updated policy.
Contact: info@mindspan.com.au | Mindspan Pty Ltd | Melbourne, Victoria, Australia