Privacy and member data

This policy explains how Silvestro Musumeci trading as STRATA IQ Academy (ABN 38 721 081 538) collects, uses, stores, protects and discloses personal information through the website and Learning Hub.

1. Information we collect

• Account information: name, email address, role, optional organisation, membership tier, account status and sign-up source.
• Learning information: courses opened or completed, reading progress, scenario activity, assessment answers and results, certificates and related dates.
• Pocket site visits: if you choose to use Site Walk-Through, scheme reference, site name and optional address, visit date, observations, proposed actions and optional photographs. These are working notes for the member, not the owners corporation's official records.
• Optional role-play information: typed contributions used to run a fictional guided meeting simulation, session duration, support use and the resulting private coaching debrief. A typed transcript is stored only when you separately choose to save it for that session.
• Choices, enquiries and communications: optional marketing preference, policy acceptance record, pilot-feedback ratings and comments, a separate choice about follow-up contact, support requests, corrections, complaints, messages and optional event, organisation or audience details supplied for speaking, training, media, publishing or collaboration enquiries.
• Technical and security information: session identifiers, login activity, security events, device or browser information, IP address where processed for security, and information needed to prevent misuse.
• Public website measurement: the Academy website used, page path, membership-button activity, referral website and campaign labels included in a promotional link. The Academy's first-party campaign reporting does not set an advertising cookie or attach this public activity to a member's private learning record.

We do not ask members to provide sensitive information. Do not enter passwords, bank details or health information. Avoid identifiable client, owner and tenant details in Academy forms and tools. Site Walk-Through may need a scheme reference or building address; include only what is needed for the visit, and check photos for people, documents and private details before saving.

2. How information is collected

Information is collected when you visit a public Academy page, follow a campaign link, join, sign in, update a profile, complete learning, submit an assessment, request a certificate, contact the Academy, choose to receive updates or use security-protected forms. Some activity is created automatically when the service records aggregate website use, progress, account protection or a signed-in session.

Required registration details are identified in the joining form. If you do not provide them, we cannot create or secure an Academy membership. The Academy is intended for people aged 18 or older and records an age-eligibility confirmation rather than collecting a date of birth.

3. Why we collect and use it

We use this information to create and secure your membership, save learning progress, issue and verify certificates, respond to enquiries, maintain legal and publication controls, understand service performance, improve Academy content, assess speaking, training, media, publishing and collaboration enquiries, prepare requested proposals, prevent fraud and operate the service. Optional Academy communications may include a short getting-started series for new members, a concise weekly learning update and separate alerts for material NSW developments. They are separately chosen and can be withdrawn at any time. Commercial electronic messages will identify the sender and provide a practical unsubscribe method as required by law.

Choosing to be contacted about pilot feedback does not give the Academy permission to publish it. We will obtain separate written approval before publishing identifiable feedback or using it as a testimonial.

4. Storage, providers and overseas processing

Membership and learning records are stored through Supabase, with the primary database region configured in Sydney, Australia. The Academy also uses providers supporting hosting and security (Cloudflare), authentication and database services (Supabase), transactional email delivery (Resend), and compromised-password screening (Have I Been Pwned). The password-screening service receives only a short hash prefix; it does not receive your password, email address or complete password hash.

When you voluntarily enter the Role Play Room, the fictional typed conversation and guided debrief are processed by the Academy website using controlled scenario and assessment rules. The current guided experience does not use an external AI voice or debrief service. Use only the supplied fictional facts. The Academy does not use role-play conversations for advertising.

Pocket Site Walk-Through stores uploaded visit details in the Academy's controlled database and uploaded photos in its protected file storage. Offline drafts, including any photos, remain in the browser storage on that device until you upload or discard them. The notes field can use your phone keyboard's dictation; Pocket does not upload a voice recording for this feature. Review the words before saving. A reviewed report must be filed separately in the scheme's normal records.

Providers may process limited information in Australia, the United States and other countries where their infrastructure or support teams operate. Provider locations can change. We limit provider access to what is reasonably required for the service and assess the safeguards available for the information involved.

5. When information may be disclosed

We do not sell personal information. Information may be disclosed to service providers supporting the Learning Hub, to a professional adviser where reasonably necessary, where required or authorised by law, or where reasonably necessary to investigate fraud, security threats or serious misuse. An organisation does not receive a member's individual learning record merely because the member lists that organisation in their profile. Any future employer or team reporting feature will require a separate, clear arrangement and notice.

6. Cookies and device storage

The Academy uses essential secure session cookies and browser storage for signed-in access, learning progress and user-interface preferences. Aggregate first-party website and campaign events are recorded without setting an advertising cookie. The Academy does not currently use advertising cookies. Details and browser choices are explained in the Cookie and Device Storage Notice.

An offline Pocket site-visit draft may contain photographs and remain on a personal device until you upload or discard it. Protect the device with a screen lock. Removing the browser's stored site data may remove a draft before it is uploaded.

7. Role-play choices

The current guided Role Play Room does not request microphone access. The Academy saves a completion record and debrief to your private learning record. Saving the typed transcript is a separate, optional choice that is off by default. You may delete a role-play record through the available member control or request assistance through the contact form.

8. Retention and account closure

We retain account and learning records while a membership remains active and afterwards only for as long as reasonably needed for documented legal, accounting, security, fraud-prevention and dispute-management purposes. Pilot feedback, contact and support records are reviewed against the same needs. Records no longer required are deleted or de-identified where practicable and lawful. Closing an account does not always require immediate deletion of every record, including a security record held for a documented purpose. Certificate records are removed with account deletion; download copies you want to keep before requesting deletion because online verification ends.

You can delete an individual Pocket site visit and its uploaded photos within Pocket. Discard an offline draft on the device where it was made. To request deletion of your Academy account and associated Pocket information, use Pocket → Account → Request account deletion, or the website deletion request page if you no longer have Pocket. Silvestro oversees completion within 7 calendar days of the first request, followed by a confirmation email. Identity verification and retained-record blockers must be resolved without restarting that deadline. We will explain what is removed and any records retained for a documented need. A request does not automatically close your membership or erase information on your phone.

9. Security and data incidents

Safeguards include encrypted transport, restricted administrative access, row-level database controls, secure HTTP-only session cookies, strong-password screening, security checks and controlled server interfaces. No online service can guarantee absolute security. Suspected incidents are assessed, contained and documented, and affected people and regulators will be notified where required by applicable law.

10. Access, correction and your choices

You may access the member Account & Email Preferences control to withdraw optional marketing consent or close your membership. Closing access is separate from requesting account deletion. You may also ask to access or correct personal information, request deletion where applicable, or ask how a decision about your information was made. We may need to verify identity before releasing, changing or deleting account information. Some requests may be limited where retention or refusal is permitted or required by law; if so, we will explain the position where lawful.

11. Privacy complaints

Members can manage optional emails or close a membership from My Learning → Account & Email Preferences. You may also submit a privacy request or complaint through the contact form and select the privacy option. We aim to acknowledge a complaint within five business days and provide a substantive response within 30 calendar days where reasonably practicable. If a covered privacy concern remains unresolved, you may be entitled to contact the Office of the Australian Information Commissioner.

12. Privacy framework

The Academy manages personal information using the Australian Privacy Principles as its practical benchmark. The legal application of the Privacy Act 1988 (Cth) can depend on an organisation's circumstances, including turnover and statutory exceptions. This policy does not reduce any privacy right that applies by law.

13. Updates and contact

We may update this notice when the Learning Hub or information-handling practices change. The version and effective date will be shown at the top of this page. Material changes will be communicated through the website or member service where appropriate. Contact: hello@strataiqacademy.com.au.