Privacy policy

Last updated: 4 October 2026

The Policy Reform Toolkit ("the Toolkit") is operated by King Raggatt Family Trust (ABN 19179665983) ("we", "us"). This policy explains what personal information we collect, how we use and protect it, and your choices. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Effective date: 5 October 2026

1. Information we collect

Waitlist: if you join the waitlist before the Toolkit opens, your email address and, if you choose to answer them, what best describes your role and the areas of policy you're interested in. These are held by our email service, Kit.
Account details: your email address and a password. Passwords are stored only as a secure hash by our authentication provider; we never see them.
Plan and account status: whether you have a Free or Premium plan, and whether your account has administrator access.
How you use the Toolkit: the days you use it, which domains you've opened, when you first ticked an item, and how many templates you've downloaded. We don't record which pages you read or what you do on each one.
Your use of the checklist (Premium): which checklist items you have ticked, when, and which domains you have chosen to show ("Customise your view"). The Toolkit does not currently collect free-text notes or documents from users.
Payment information: Premium subscriptions are processed by Stripe. Your card details go directly to Stripe and are never received or stored by us. Stripe also collects your billing address, and a business tax number (such as an ABN or VAT number) if you choose to provide one, to work out whether tax applies. We store only a Stripe customer reference and use your subscription status to provide Premium access. Stripe's handling of your information is covered by the Stripe Privacy Policy.
Technical information: our hosting providers record standard request information (such as IP address, browser type and pages requested) for security and reliability. We keep a log of server errors to fix problems; it does not contain passwords, payment details or the contents of your requests.

2. How we use your information

To create and secure your account and let you sign in.
To provide the Toolkit, including saving your progress and view preferences across devices (Premium).
To process your subscription and provide Premium access.
To send essential account emails, such as sign-up confirmation, password resets and receipts.
To send you emails about the Toolkit (see "Emails about the Toolkit" below).
To keep the service secure, diagnose problems and prevent misuse.
To show advertising to Free users who have agreed to it (see section 4).

We do not sell your personal information.

Emails about the Toolkit. When you create an account, we'll send you emails about getting started with the Toolkit, Toolkit news and product updates, using our email service Kit. If you haven't got started, or haven't used the Toolkit for a while, we may send you an email asking whether we can help and why; we use how you use the Toolkit (described in section 1) to decide this, and send at most one such email a month. Every one of these emails includes an unsubscribe link, and you can also turn them off under Email updates on your Account page. Unsubscribing doesn't affect essential account emails. We only send emails about the Toolkit on this basis. If you join the waitlist, we'll email you to confirm, to tell you when the Toolkit opens, and with occasional updates; you can unsubscribe from any of these emails at any time.

3. Cookies and similar technologies

Sign-in cookies (essential): keep you signed in. The Toolkit cannot work without them.
Ad-consent cookie (ad_consent, 12 months): remembers whether you chose to allow ads, so we don't ask on every visit.
Google advertising cookies: set only if you are a Free user and choose "Allow ads". See section 4.

Visitor statistics on our landing page: we use Vercel Web Analytics to count visits to the public landing page (the sign-up and waitlist page). It doesn't use cookies and doesn't identify you; it records anonymous information such as the page visited, the referring website, your country, and your browser and device type. It isn't used anywhere else on the site, including inside the Toolkit once you're signed in. We don't use any other analytics or tracking cookies.

4. Advertising (Free plan only)

Free accounts may display ads served by Google AdSense. Before any Google advertising code loads, we ask for your consent. If you choose "No thanks", no advertising code is loaded and the Toolkit works as normal without ads. If you choose "Allow ads", Google may use cookies and similar technologies to show, measure and personalise ads, as described in Google's advertising policies. You can change your choice at any time using "Ad preferences" at the bottom of the checklist. Premium accounts never load advertising code.

5. Who we share information with

We use the following service providers to run the Toolkit. They process information on our behalf and only as needed to provide their service:

Supabase: database, authentication and file storage (hosted in Sydney, Australia).
Vercel: website hosting (servers in Australia), and anonymous visitor statistics for our landing page.
Stripe: subscription payments.
Kit: our email service. It holds your email address and plan (Free or Premium) to send Toolkit emails, and records if you unsubscribe.
Google: advertising, only for Free users who allow ads.

Some of these providers store or process information outside Australia, including in the United States. We may also disclose information where required by law.

6. How long we keep information

Account, progress, view-preference and usage data: for as long as your account exists. You can delete your account at any time from your Account page. This immediately deletes your account, progress and preferences, cancels any subscription and stops Toolkit emails. Your email address is removed from our email service (Kit) within 30 days.
Payment records: kept by Stripe, and by us as required for tax and accounting purposes (generally 7 years).
Server error logs: deleted after 90 days.

7. Security

We protect your information using measures including encryption in transit (HTTPS) and at rest, database access controls that let each user access only their own data, and restricted administrator access. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.

8. Your rights and choices

You can ask to access or correct the personal information we hold about you.
You can delete your account at any time from your Account page, or ask us to do it for you.
You can manage or cancel your subscription at any time from your Account page (via Stripe's secure billing page).
You can change your ad choice at any time ("Ad preferences").
You can unsubscribe from Toolkit emails at any time, using the link in any of them or Email updates on your Account page.

To make a request or a privacy complaint, contact us at admin@policyreformtoolkit.com. We will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (https://www.oaic.gov.au).

9. Children

The Toolkit is intended for professionals and is not directed at children under 18.

10. Changes to this policy

We may update this policy. We will post the new version here and, for significant changes, notify account holders by email.

11. Contact

Policy Reform Toolkit, 19 Edward St, Blackwood, South Australia, Australia, 5051. Email: admin@policyreformtoolkit.com.