Privacy Policy

This policy explains how FLSoft (“we”, “us”) handles personal information when you use FLSoft Academy at academy.flsoft.com.au. We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). For questions or requests, email forestlakesoft@gmail.com.

What we collect, and why

When you read lessons without an account

Your progress stays in your browser. Quiz results, XP, streaks and similar settings are saved in your browser’s local storage, on your device. They are not sent to us unless you sign in.
Anonymous lesson counts. When you open a lesson or submit a quiz, your browser tells us which lesson it was and whether the quiz was passed or failed. These counts contain no name, email, account, IP address or device ID. Your browser remembers what it has already counted, so opening or passing a lesson counts once per device; failed quiz attempts count each time. We use the totals to see where lessons are too hard or where learners stop.
Campaign tags. Links we share in ads, posts or emails can carry campaign tags in the address (for example ?utm_source=facebook&utm_campaign=nov-launch). If you arrive through one, your browser remembers those tags for 30 days, and if you buy or subscribe in that time they are recorded with the payment, so we can see which campaigns bring buyers. The tags describe the link, not you. We don’t use tracking pixels, and we don’t share them with advertisers.
Technical data. Like any website, our hosting provider receives your IP address and browser details in order to deliver pages to you. We don’t keep logs of page visits.
Firewall. To stop automated copying, our firewall (AWS WAF) limits how quickly paid lessons can be opened. It counts recent requests per IP address and per access cookie for a few minutes. When it blocks a request, it logs that request (IP address, page, time and browser details, but not cookies) for 30 days.
Fonts. The site’s fonts are loaded from Google Fonts, so your browser connects to Google, which receives your IP address and browser details under Google’s privacy policy.

When you create an account

Your email address and password. Sign-in is handled by Amazon Cognito (part of Amazon Web Services). Your password is checked by Cognito and never reaches our own systems. Cognito emails you a code to confirm your address.
Your saved progress: for each lesson, your best quiz score and when you passed it, so your progress follows you across devices.
Sign-in details in your browser: after you sign in, your browser keeps sign-in tokens in local storage so you stay signed in.

Payments are processed by Stripe. From Stripe we receive and keep: your email address, the course, the amount and currency you paid (including the local-currency amount if Stripe converted the price), the date, Stripe’s payment references, whether the payment was later refunded and, if you arrived from a campaign link, its campaign tags. Your confirmation that you are 18 or older is recorded with the payment in Stripe. We never receive your full card details. Stripe collects your payment details itself and also uses them to prevent fraud, under Stripe’s privacy policy.

On top of the purchase details above, we keep your Stripe customer ID, the subscription’s status, its current billing period and price, whether it’s set to cancel, and the amount and date of each payment. Stripe keeps your payment method so it can charge each month’s renewal until you cancel. You can update or remove it in Stripe’s customer portal, which opens from your account page.

When you take a final assessment

We keep when you confirmed the honesty pledge, when you started each attempt, how many attempts you’ve made, your best score, whether you passed, and how long your last attempt took. Your answers are used to grade the attempt and are not kept afterwards. The score is calculated automatically against the answer key.

When you earn a certificate

We keep the name you enter, the certificate ID, the course, the edition, your score and the date it was issued. This is public by design: anyone with the certificate’s ID or link can see the name, course, edition, score and issue date on its verification page, so employers and others can check it is genuine. We only show a certificate to people who have its ID or link; we don’t publish a list of certificates.

When you opt in to update emails

If you tick the update-email option on your account page, we keep your email address, the date you opted in, and a token for one-click unsubscribing. We send a few emails a year at most, about new courses and significant course updates. Every email has an unsubscribe link, and you can also turn it off on your account page.

When you report a problem with a lesson

We keep what you send: the category, your message, any lesson text you quoted, the page, your browser’s user-agent string and, if you give it, your email address. Reports are also emailed to our inbox. To stop spam, we count reports per IP address in a short-lived record that expires after about two hours.

When you email us

We keep your message and email address so we can reply and keep a record of the request. Our inbox is hosted by Google (Gmail).

Server logs

Our servers write technical logs to find and fix problems. They can include an account ID or email address, for example when a purchase is recorded. Logs are deleted after 30 days.

How we use personal information

To provide the academy: your account, progress, access to courses you bought, final assessments and certificates.
To process purchases and refunds, and to keep the financial records the law requires.
To verify certificates when someone checks one.
To send emails you asked for, and essential messages about your account or purchase (for example, an important change to our terms or a course closing).
To answer reports and requests, and to improve our courses. For example, we look at progress figures to find lessons where many learners get stuck. Those figures are aggregated and show no names or emails.
To keep the academy secure and to prevent abuse and fraud.

We don’t sell or rent personal information, we don’t use it for advertising, and we don’t send marketing emails unless you opt in.

We share personal information only with the service providers that run the academy for us, and only as much as they need:

Provider	What they do for us	Where
Amazon Web Services	Hosting, database, sign-in (Amazon Cognito), sending emails	Our data is stored in AWS’s Sydney region. Pages and requests pass through AWS’s worldwide delivery network.
Stripe	Payments and refunds	Stripe processes data in several countries, including the United States
Google	Website fonts (Google Fonts) and our email inbox (Gmail)	Google processes data in several countries, including the United States

AI apps you use with our lessons, such as Claude Code, ChatGPT, Claude or Gemini, aren’t our service providers. What you type or upload into them goes to the company that runs them, under that company’s own terms and privacy policy, and we never see it. Our lessons explain what to keep out of them, such as ID and card numbers, passwords and medical records.

We may also disclose information where the law requires it, or to protect the rights, property or safety of our learners, the public or us. If the academy is ever sold or transferred to another business, the personal information we hold would transfer with it, under the same protections.

Overseas disclosure

Our main data is stored in Australia (AWS Sydney). Stripe and Google may store or process information outside Australia, including in the United States. We choose providers that protect personal information to a high standard, but their handling is also governed by their own privacy policies.

Security

Every connection to the academy is encrypted (HTTPS). Paid lessons are protected so only buyers can open them. Access to our systems is restricted to us, and our admin tools show only aggregated figures, without names or emails. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and, where required, the Office of the Australian Information Commissioner (OAIC).

How long we keep it

Information	How long
Account and saved progress	Until you ask us to close your account
Purchase, subscription payment and refund records	5 years after the end of the financial year of the payment, as Australian tax law requires
Final assessment results	Until you ask us to close your account
Certificates	Until you ask us to withdraw them, so they can be verified
Update-email subscription	Until you unsubscribe
Lesson reports	Until the report is resolved, then deleted within 12 months
Spam-prevention IP counters	About two hours
Campaign tags in your browser	30 days (with a payment, as long as the payment record)
Server logs	30 days
Firewall logs of blocked requests	30 days
Backups	Deleted information can remain in backups for up to 35 days

Anonymous lesson counts contain no personal information, so we may keep them.

Cookies and local storage

We don’t use advertising or analytics cookies. The academy uses only what it needs to work:

Access cookies: if you’ve bought a course or have All-access, your browser gets cookies that unlock paid lessons. They last up to 7 days for courses you bought and up to 24 hours for courses open through All-access, and are renewed while you’re signed in.
Sign-in cookies: the sign-in page runs on an Amazon Cognito address and uses its own cookies during sign-in.
Local storage: your progress, XP and streaks, your sign-in tokens, when your access was last renewed, which lessons have already been counted anonymously, and the campaign tags of the last campaign link you opened (forgotten after 30 days).

You can clear these at any time in your browser’s settings. If you’re not signed in, clearing them also deletes your progress.

Your choices and rights

Email forestlakesoft@gmail.com from your account’s email address to:

Get a copy of the personal information we hold about you.
Correct it. Certificate names can’t be edited once issued, so a verified certificate can never quietly change. If your name is wrong, we can withdraw the certificate so you can issue a new one with the correct name.
Close your account. We delete your account, progress, assessment results and email preferences. We keep the purchase records that tax law requires us to keep. Tell us whether to keep your certificate verifiable or withdraw it too. A withdrawn certificate no longer verifies.
Unsubscribe from update emails, using the link in any email or on your account page.

We will reply within 30 days. If you’re unhappy with how we handled your request or your information, tell us and we’ll try to fix it. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If you live in the European Union or the United Kingdom, you also have rights under the GDPR or UK GDPR, including the right to object to our use of your information and to complain to your local data protection authority. We use your information to provide what you asked for (performing our contract with you), to keep records the law requires (legal obligation), for security and course improvement (legitimate interests), and for update emails (your consent, which you can withdraw at any time).

Age

The academy is only for people aged 18 or older. We don’t knowingly collect personal information from anyone under 18. If you think someone under 18 has created an account, tell us and we’ll delete it.

Changes to this policy

We will post any update here with a new “last updated” date. If a change materially affects how we use information we already hold, we will also email account holders.

Contact

Privacy questions and requests: forestlakesoft@gmail.com. FLSoft, Queensland, Australia.