Privacy Policy

This Privacy Policy explains how Model Answer Pty Ltd (ABN [ABN]) (“Model Answer”, “we”, “us”, “our”) collects, uses, discloses, and protects personal information in connection with the PAYOFF·FIT workshop scoring tool (the “Service”) at payoff.modelanswer.com.au.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Policy should be read together with our Terms of Service.

1. What personal information we collect

We collect the following categories of personal information:

• Facilitator account information — email address used to sign in via magic link, and metadata about your sign-in sessions.
• Attendee participation data — the name you provide when joining a Workshop, your scores for each Use Case, and any free-text justifications you submit.
• Workshop content — Use Case definitions, client logos, and other content uploaded by Facilitators. This may include limited information about your organisation or its operations.
• Technical data — IP address, browser type and version, device type, referring URL, and timestamps of your interactions, collected by our hosting and authentication providers for security and operational purposes.
• Authentication cookies — set when you sign in to allow the Service to recognise you between page loads. See section 8.

We do not intentionally collect sensitive information (as defined in the Privacy Act, including health, racial or ethnic origin, political opinions, or biometric data). Please do not include such information in scores, justifications, or uploaded Use Cases.

2. How we collect it

We collect personal information directly from you when you sign in as a Facilitator, join a Workshop as an Attendee, submit scores, or upload content. Some technical data is collected automatically by our hosting and authentication infrastructure when you access the Service.

3. Why we collect and use it

We use personal information to:

• provide, operate, and maintain the Service;
• authenticate Facilitators and protect Facilitator accounts;
• display Workshop content and scores in real time to Workshop participants;
• generate aggregated outputs and Excel exports at the conclusion of a Workshop;
• respond to support requests and communicate with you about the Service;
• diagnose technical problems, prevent abuse, and improve the Service;
• comply with our legal obligations.

4. Who we share it with (sub-processors)

We use a small number of trusted service providers to operate the Service. These providers process personal information on our behalf and only as required to deliver the Service:

• Supabase — database, authentication, realtime, and file storage. See supabase.com/privacy.
• Railway — application hosting and deployment. See railway.app/legal/privacy.
• Resend — transactional email delivery (magic-link sign-in emails). See resend.com/legal/privacy-policy.

We may also disclose personal information where required by law, where necessary to protect our legal rights, or in connection with a corporate transaction (such as a merger or sale of assets). We do not sell personal information.

5. Where personal information is stored

Workshop data, account information, and authentication records are stored in our Supabase project, hosted in [SUPABASE_REGION]. Application traffic is served from Railway’s infrastructure. Magic-link emails are dispatched via Resend. Each provider may operate or replicate data in additional regions for redundancy and disaster recovery purposes.

Where personal information is transferred outside Australia, we take reasonable steps to ensure that the recipient handles it in a manner consistent with the Australian Privacy Principles, including by selecting providers with substantive privacy commitments in their own terms.

6. How long we keep it

We retain personal information for as long as is necessary to provide the Service and to meet our legal, accounting, and contractual obligations. In practice:

• Workshop content and scores — retained for the duration of the client engagement and for a reasonable period thereafter to allow for follow-up work, typically up to 24 months. Workshop data may be deleted on Facilitator request.
• Facilitator account information — retained for as long as the Facilitator account is active. Inactive accounts may be deleted at our discretion.
• Technical and authentication logs — retained by our sub-processors in line with their own retention schedules, typically 30–90 days.

7. How we secure it

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure, including:

• HTTPS / TLS encryption in transit;
• encryption at rest at the database layer (provided by Supabase);
• row-level security policies enforced at the database level;
• magic-link authentication for Facilitators (no passwords stored);
• access to production systems restricted to authorised Model Answer team members.

No method of electronic transmission or storage is completely secure. While we apply commercially reasonable safeguards, we cannot guarantee absolute security.

8. Cookies and similar technologies

The Service uses cookies that are strictly necessary for its operation, including:

• Authentication cookies set by Supabase to maintain your signed-in session as a Facilitator. These cookies expire automatically and can be cleared at any time through your browser settings.

We do not use third-party advertising cookies or cross-site tracking. We may add privacy-friendly analytics in the future; if we do, this Policy will be updated to describe what is collected and how to opt out.

9. Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you;
• Correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading;
• Request deletion of personal information, subject to our retention obligations and legitimate business needs;
• Withdraw consent for any processing that is based on your consent (this will not affect the lawfulness of processing carried out before your withdrawal);
• Make a complaint about our handling of your personal information (see section 12).

Attendees who wish to exercise these rights with respect to a specific Workshop should contact the Facilitator who invited them in the first instance, and may also contact Model Answer directly using the details below.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected personal information from a child, please contact us and we will take steps to delete it.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated by updating the “Last updated” date above and, where appropriate, by other reasonable means.

12. How to contact us & lodge a complaint

For privacy questions, requests, or complaints, contact:

• Email: [CONTACT EMAIL]
• Post: Model Answer Pty Ltd, [REGISTERED ADDRESS]

We aim to respond to privacy enquiries within a reasonable time, generally within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Online: oaic.gov.au
• Phone: 1300 363 992