Privacy Policy

This policy covers Demysti5, at demysti5.com and the Demysti5 app. When we say "we", "us", or "our", we mean Demysti5.

We follow the Australian Privacy Principles under the Privacy Act 1988 (Cth), and where relevant, the EU General Data Protection Regulation (GDPR).

"Personal information" means information we hold that's identifiable as being about you: your name, email address, or any other information that can reasonably identify you, directly or indirectly.

We receive and store personal information you submit to our website and app, or give us in other forms.

• Basic information such as your name and email address, so we can send you information and manage your account.
• Information from your Cyber Health check-in: your answers to onboarding questions, which we use to calculate your score and build your task plan.
• Information you give us when you provide feedback, respond to surveys, or contact support.
• Content you post in the Demysti5 Community feature, such as questions or scam reports.

We never ask you for passwords, banking credentials, or direct access to your accounts.

We collect personal information when you interact with us electronically (through the website or app), when you sign up, and when you contact us. We may receive personal information from third parties; if we do, we protect it the same way as everything else described in this policy.

By providing us with personal information, you consent to us using it as set out in this policy.

We use personal information only for the purposes you'd reasonably expect, including to:

• provide the Cyber Health score, daily tasks, and other features of the service;
• administer your account and respond to support requests;
• improve our products and services;
• tell you about new features or relevant updates;
• communicate with you by email, in-app notification, or (if you've given a number) SMS; and
• investigate any complaints.

If you withhold personal information, it may not be possible for us to provide the service, or you may not be able to fully use the app.

We may disclose personal information where required by law, such as under a court order, subpoena, warrant, or law enforcement request.

If Demysti5 changes ownership or sells its business assets, we reserve the right to transfer user data as part of that transfer, to the extent the law allows.

We may disclose your personal information to people who reasonably need it to help us run Demysti5: for example, our hosting provider, payment processor, insurers, or professional advisers, only as far as is reasonably necessary.

If we disclose your personal information to a third party, we require them to protect it consistent with this policy.

Our website and app run on Google Cloud / Firebase infrastructure, primarily hosted in Australia. Payments (for Pro subscriptions) are processed by Stripe, which may store and process payment data outside Australia as part of providing that service.

If any of our service providers are located outside Australia, we take reasonable steps to make sure your data is protected to a standard consistent with the Australian Privacy Principles.

If you're an individual in the EU, you have rights over how your personal information is used, and we aim to honour them. Except as otherwise provided by the GDPR, you have the right to:

• be informed how your personal information is used;
• access a copy of your personal information;
• correct your personal information if it's inaccurate or incomplete;
• delete your personal information ("the right to be forgotten");
• restrict or object to how your personal information is processed; and
• object to automated decision-making.

Contact us at any time to exercise these rights, using the details at the bottom of this page. We may ask you to verify your identity before acting on a request.

We do not knowingly collect personal information from children under 16 without the consent of a parent or guardian.

We take reasonable steps, physical, electronic, and procedural, to protect your information from misuse, loss, unauthorised access, and disclosure.

No transmission over the internet is completely secure, and we can't guarantee the security of information you send us or that we send you. See our Security page for more on how we handle your data, and what we never ask you for.

When you visit demysti5.com, we may collect information like browser type and which pages you visited, to understand how people use the site and to improve it. This information is used in aggregate; it's not used to personally identify you.

We may use cookies, small files stored by your browser, to recognise your device on a return visit. Cookies do not let us access personal information like your name or email address on their own.

Most browsers accept cookies automatically, but you can change your browser settings to reject them. Doing so may affect how well the site works for you.

Our site and app may link to other websites we don't own or control. We're not responsible for the privacy practices of those sites. We encourage you to read the privacy policy of any site that collects your personal information.

You can ask for a copy of the personal information we hold about you, or ask us to correct it if it's inaccurate, out of date, or incomplete. Email us at [email protected].

We may decline a request in limited circumstances permitted under the Privacy Act or other applicable law, and we'll explain why if that happens.

If you have a complaint about how we've handled your personal information, email us at [email protected] with details. We take complaints seriously and will respond as soon as we reasonably can.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC), the independent regulator for privacy in Australia.

We may update this policy from time to time. Changes take effect as soon as we publish them on this page. Please check back occasionally to stay up to date.

Questions about this policy, or about your personal information? Email [email protected].