"The Final Say" is a trading name of Mastery and Grace Pty Ltd (ABN 79703391155), a company registered in ACT, Australia. References to "we," "our," or "us" throughout this Privacy Policy refer to Mastery and Grace Pty Ltd. We are committed to protecting your privacy and being transparent about how we collect, use, and protect your personal information.
1. Data controller information
Mastery and Grace Pty Ltd, trading as The Final Say, is the data controller responsible for your personal information. You can contact us at:
The Final Say
PO Box 234, Moffat Beach, Queensland 4551, Australia
Email: [email protected]
2. Information we collect
Information you provide directly
Account information
Name, email address, password, and profile details (for the "By Your Own Rules" membership)
Communication data
Messages you send us, support requests, and feedback
Payment information
Billing address and payment method details (processed securely by our third-party payment provider. We do not store your full card details ourselves)
Self-audit responses
Your answers within the "Biology or Burnout?" self-audit or similar tools
Cohort intake and screening information
If you apply for or enrol in "On Your Own Terms," we may ask about your current wellbeing, relevant history, and support needs, so we can ensure the program is a safe and appropriate fit for you, and refer you elsewhere if it is not
Community content
Anything you share within the membership community space, if applicable
Information we collect automatically
Usage data
How you interact with our website and services, and time spent on pages
Device information
IP address, browser type, operating system, device identifiers
Analytics data
Performance metrics, error logs, and usage patterns
Location data
General geographic location based on IP address (used, for example, to help direct you to relevant regional resources)
Information from third parties
We may receive limited information from business partners or platforms you connect (such as a payment provider confirming a transaction), but only when necessary for providing our services.
3. Sensitive information: extra care
This section applies specifically to any information you share relating to your mental health, wellbeing, or personal circumstances, including self-audit responses and cohort intake/screening information.
We recognise that some of what you share with us, particularly during self-audits or cohort intake, is more personal than a typical customer record. This may be considered "sensitive information" under Australian and international privacy law, and we treat it accordingly:
We only use this information to provide you with relevant content, assess fit for our programs, and, where appropriate, refer you to a more suitable professional or service.
We do not use sensitive information for advertising or marketing purposes.
Access to this information within our team is limited to those directly involved in delivering our services to you.
We do not sell, and will never sell, sensitive information of any kind.
Please note: Our Service is not designed to store or manage information disclosed during a genuine mental health crisis. If you are in crisis, please use findahelpline.com to find a helpline in your country rather than relying on our Service.
4. How we use your information
We process your personal information for the following purposes:
Service provision (contract performance)
Creating and managing your account, delivering the self-audit, masterclass, cohort, or membership, processing payments, and providing customer support.
Assessing fit and safety (legitimate interest / consent)
Reviewing cohort intake and screening information to ensure our program is appropriate and safe for you, and referring you elsewhere if it is not.
Service improvement (legitimate interest)
Analysing usage patterns to improve our content and services, and conducting research on an aggregated, de-identified basis.
Communication (consent or legitimate interest)
Sending service updates, responding to enquiries, and sending marketing communications only with your consent.
Legal compliance (legal obligation)
Complying with applicable laws, responding to legal processes, and protecting our rights and the safety of our users.
5. Information sharing and disclosure
We never sell your personal information. We only share it in the following limited circumstances:
Service providers
We work with trusted third parties who help us operate our services, such as our website platform, payment processor, and email provider. These providers are contractually bound to protect your information and use it only to provide their service to us.
Referrals (with your involvement)
If, through cohort screening, we believe you would be better supported by another professional (for example, for trauma, substance dependency, or an eating disorder), we will discuss this with you directly. We do not share your information with a third-party professional without your knowledge and involvement.
Business transfers
If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
Legal requirements
We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to protect your safety or the safety of others.
Consent
We may share your information for other specific purposes with your explicit consent.
6. Data security
We implement reasonable security measures to protect your personal information, including encryption in transit, access controls limiting who on our team can view sensitive information, and regular review of our practices.
No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information, and treat information relating to your mental health or wellbeing with particular care.
7. Data retention
We retain your personal information only as long as necessary for the purposes outlined in this policy:
Account and membership data
For the duration of your membership, plus 90 days after cancellation
Transaction records
7 years, for tax and legal compliance
Self-audit responses and cohort intake/screening information
Retained only as long as needed to provide the relevant service, then securely deleted, unless you ask us to delete it sooner
Support communications
3 years
Marketing data
Until you withdraw consent, or after 2 years of inactivity
8. Your privacy rights
You have significant control over your personal information. Depending on your location, you may have the following rights:
Universal rights
Access, correction, deletion, portability, and withdrawal of consent for any information we hold about you, including self-audit or intake information.
EU/UK residents (GDPR)
The right to restrict or object to processing, to opt out of automated decision-making, and to file a complaint with your local data protection authority.
California residents (CCPA/CPRA)
The right to know what is collected, to request deletion, to opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information), and to non-discrimination for exercising your privacy choices.
To exercise your rights: Email us at [email protected]. We will respond within 30 days and may need to verify your identity first.
9. International data transfers
We may transfer your information to countries outside your country of residence, including Australia, where our servers or service providers are based. When we do, we ensure appropriate safeguards are in place and work only with providers who offer adequate protection for your data.
10. Cookies and tracking technologies
We use cookies and similar technologies to improve your experience on our website. See our Cookie Policy for details on the cookies we use and how to manage your preferences.
11. Age requirement
Our Service is intended for adults aged 18 and over, consistent with our Terms of Service. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from someone under 18, please contact us so we can delete it.
12. Changes to this policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes via email or a prominent notice on our website, and post the updated policy with a new effective date.
13. California "Do Not Sell" notice
We do not sell personal information as defined by California law, and we never will.
14. Contact information
For privacy-related questions, to exercise your rights, or to file a complaint:
The Final Say, Attention: Privacy Officer, PO Box 234, Moffat Beach, Queensland 4551, Australia
Response time
We respond to privacy requests within 30 days.
Regulatory information
EU/UK residents can file complaints with their local data protection authority. California residents can file complaints with the California Privacy Protection Agency.