Last updated: 28 September 2026
Data Handling Policy
A plain-language explanation of exactly what data we collect, where it goes, and how long we keep it. Read alongside our Privacy Policy for full detail.
Data we collect and where it lives
| Data type | Where stored | Retention |
|---|---|---|
| Email address | Supabase (auth) + Brevo (email) | While your account is active + 7 years (Supabase); until you ask us to delete it (Brevo; unsubscribing stops the emails) |
| Name | Supabase profile table + Brevo contact | While your account is active + 7 years (Supabase); until you ask us to delete it (Brevo; unsubscribing stops the emails) |
| Hashed password | Supabase (auth) — bcrypt | While account active + 7 years |
| Purchase record (amount, date, product) | Supabase — product_purchases table | 7 years (legal/tax requirement) |
| Access entitlement (product, expiry) | Supabase — product_entitlements table | Duration of access + 7 years |
| Stripe session ID | Supabase — product_purchases table | 7 years |
| Invoice details you choose to add at checkout (name, organisation, ABN, PO, registration reference, invoice email) | Supabase — product_purchases table, with the purchase | 7 years (legal/tax requirement) |
| Quiz or tool result (result band and overall score, e.g. an anxiety band from a GAD-7-informed check) with your email, kept only after you tick both consent boxes. This is sensitive (health) information. Individual answers are not kept for questionnaires that check for distress | Supabase — funnel_leads table (Australia); the band is also on your contact with Brevo, our email provider, in the European Union. A copy of the result, with your email, is also sent to our practice inbox (info@mindspan.com.au), which is hosted by Google and may be stored outside Australia | Supabase: deleted 2 years after your last result, or sooner if you ask. If you gave us your email but didn't finish a quiz, we delete it after 12 months, or sooner if you ask. The copy in our practice inbox is kept with our email records, and the band on your Brevo contact stays until you ask us to delete it (unsubscribing stops the emails). |
| Privacy consent (that you agreed, when, and which policy version) | Supabase — your account record (auth) and the purchase record; your browser (cookie ms_consent, version only) | Account: while active + 7 years. Purchase: 7 years. Cookie: 12 months |
| Card details / banking data | NOT stored by Mindspan — Stripe only | Stripe retains per their policy |
| Program usage / page views | Supabase (session logs) | 12 months rolling |
| Visitor ID (random, in a cookie shared across Mindspan sites on *.mindspan.com.au) | Your browser (cookies ms_vid, ms_vid_d) + Supabase (analytics, offer windows) | Cookie: expires 12 months after it is set. Database: as for page views |
| Offer start date (your first visit to the DSM-5-TR, NPE or OSCE pages while a limited-time offer runs) | Supabase — offer_windows table, keyed by visitor ID, plus your account ID and a one-way hash of its email once you sign in | Deleted 12 months after the offer ends, or sooner if you ask |
| Feedback and reviews you send us (star rating, the options you tap, your comment, your profession if you give it; your first name and last initial only if you tick the box to share a comment), and a note that we asked you | Supabase — beta_feedback and review_requests tables, linked to your account ID | Deleted 2 years after the last activity on it, or sooner if you ask |
| Email open/click data | Brevo | 2 years |
| IP address (login events) | Supabase auth logs | 90 days |
| Support emails | Gmail (info@mindspan.com.au) | 7 years |
Your visitor ID and limited-time offers
When you first visit a Mindspan site we give your browser a randomly generated visitor ID in a cookie. It contains no name, email, IP address or device fingerprint. The same ID is used across all Mindspan sites on mindspan.com.au (for example app., osce., npe. and dsm.mindspan.com.au). We use it for two things:
- Site analytics. It lets us see a visit as one journey instead of disconnected page views (see our Privacy Policy).
- Limited-time offers. When a limited-time offer is running, we record the date and time of your first visit to the DSM-5-TR, NPE or OSCE pages against this ID. That is how we make sure the deadline we show you is real: it is the same deadline on every Mindspan page and at checkout, and it does not restart if you come back later.
Do Not Track and Global Privacy Control. If your browser sends either signal, our in-browser tracking of page views and clicks switches off. Our servers still record sign-ups, downloads, course enrolments, logins and purchases against your visitor ID, because the service needs them. The offer record is also still kept while an offer is running, because without it we could not show you a genuine deadline. It holds your visitor ID, which offer and page it is for, when you first saw the offer and when the offer price ends for you, and, once known, your account ID and a one-way hash of your email. It is never used for advertising, and we will delete it if you ask.
If you sign in, we link your account and a one-way hash of its email (not the email itself) to that record. That keeps the deadline the same on any device you use. An email typed at the offer’s checkout step is only used to check the deadline already linked to that address; it is never added to anyone’s record. We never use this record for advertising, never share it with third parties, and never use it to decide anything other than whether the offer price is still available to you.
Data flows — what happens when you purchase
- You click purchase → redirected to Stripe-hosted checkout
- Stripe processes payment → sends
checkout.session.completedevent to our webhook - Our Supabase edge function receives the event, verifies the Stripe signature, and records the purchase in
product_purchases - If you were logged in at checkout, your access entitlement is granted immediately in
product_entitlements - Your name and email are added to the relevant Brevo list → triggers the email onboarding sequence
- We email you one tax invoice from Mindspan Pty Ltd (ABN 57 636 648 336) showing the GST. Stripe sends a separate payment receipt, which is not a tax invoice
Guest purchases (checkout without being logged in) are recorded in product_purchases. Access entitlement requires an account. Log in with the email used at checkout to link your access.
Third-party services and data processing
Supabase
All account, purchase, and entitlement data. Hosted in AWS ap-southeast-2 (Sydney). Row-level security enabled. Data does not leave Australia for primary storage. Supabase Privacy Policy →
Stripe
All payment processing. Stripe stores payment card details — we do not. Data processed in the USA. Stripe is PCI-DSS Level 1 certified. Stripe Privacy Policy →
Brevo (Sendinblue)
Email delivery and automation. Stores your name, email, and program attributes. Data processed in the European Union. Unsubscribe at any time via any email footer link. Brevo Privacy Policy →
Vercel
Platform hosting and edge delivery. May process request metadata (IP address, headers) in the USA. No personal data is stored at the Vercel layer beyond standard web server logs. Vercel Privacy Policy →
Google Analytics
Aggregate usage statistics on our public pages. Google Analytics may set its own cookies under Google’s terms and processes this data in the USA. It never receives your quiz answers or results. Google Privacy Policy →
What we do not do
- We do not sell personal data to any third party
- We do not use behavioural advertising or cross-site tracking
- We do not use advertising or social-media tracking pixels
- We do not collect health information through this platform, other than the self-reflection results you choose to save with your email (see the table above)
- We do not use personal data to train AI models
- We do not profile users for targeted advertising
Your rights
To access, correct, or delete your data, email info@mindspan.com.au. We will respond within 30 days. Some data may be retained after deletion requests where required by law (e.g., financial records for 7 years).
To unsubscribe from emails: use the unsubscribe link in any email, or email us and we will remove you from all lists within 48 hours.
Questions: info@mindspan.com.au | Mindspan Pty Ltd | Melbourne, Victoria, Australia