Privacy Policy

Last updated 26 August 2026

This portal is operated by International Technology Management Pty Ltd, which runs The Mastermind and AI First Foundations. This policy explains what the portal records about you, why, who else sees it, and what you can do about it. It is written to describe what the software actually does rather than to cover every theoretical possibility.

What we collect

Your account. Your name and email address, and a password that is stored only as a bcrypt hash, so nobody here can read it. If you fill them in, your short bio, location, timezone and profile photo.

Your membership. Which programs you have access to, your role in each, and when you joined.

What you write. Community posts, comments and likes, messages you send to the support team, your 90 day plan and weekly check-ins, and your answers to the member intake questions.

What you do in the program. Lessons and modules you complete, course progress, event RSVPs, and whether you attended. Where an event asks for them, RSVPs can include a phone number, guest names, dietary requirements and any note you add.

Your AI conversations. What you ask the AI Advisor and what it answers back, kept so the conversation has memory and so we can tell when the assistant is getting something wrong.

Technical records. A session cookie, a push notification token if you allow notifications, a log of which tools you used and when, and standard web server logs which include your IP address.

What we do not collect

There is no advertising network, no tracking pixel and no analytics product embedded in the portal. Your data is not sold, and it is not shared with anyone for their own marketing.

Who else processes it

Running the portal means handing parts of it to services that do a specific job. Each sees only what that job needs.

• OpenAI and Anthropic. The AI Advisor sends your question, and relevant course material, to one of these models to generate a reply.
• Tavily. Used only when the assistant needs current information from the web. It receives the search query, not your identity.
• MailerSend. Sends the email the portal generates, such as password resets, notifications and the weekly digest.
• Apple Push Notification service, through Expo. Delivers push notifications to your phone. It receives the device token and the notification text.
• Jitsi. Powers the live video rooms. Your name is shown to other participants while you are in a room.
• Our own systems. Membership records sync to our CRM at incomm.themastermind.com.au, which we operate ourselves.
• Our hosting provider, which stores the database and uploaded files.

We will also disclose information where the law requires it, or where it is necessary to protect someone's safety.

What other members see

The community is private to paying members of your program. Other members in the same program can see your name, photo, bio, location, role and the posts and comments you choose to publish, along with your activity points and rank. They cannot see your email address, your messages to support, your AI conversations, your plan or your intake answers.

Your choices

• Edit or remove your details at any time under Account, in the app or on the web.
• Turn off email. The weekly digest and the reply and mention alerts each have their own switch under Account.
• Block a member. Blocking hides that person's posts and comments from you. They are not told, and you can undo it under Account.
• Report content. Every post and comment can be reported, and reports go to a moderation queue that our team reviews.

Deleting your account

You can delete your account yourself, under Account in the app or on this website. It asks for your password, and it cannot be undone. Here is exactly what happens.

Deleted outright: your name, email address, password, bio, location, timezone and profile photo, your access to every program, your messages to the support team, your notifications, your push tokens, your 90 day plan and check-ins, your intake answers, your AI conversations, your course progress and your event RSVPs.

Kept: posts and comments you published to the community, shown from then on as written by "Former member" with nothing linking them to you. This is deliberate. Those messages are part of conversations other members joined, and removing them would delete other people's replies along with them. If you want a specific post of yours taken down as well, delete it before you delete your account, or write to us and we will remove it.

Once deleted, the login stops working immediately and the account cannot be recovered or reactivated.

How long we keep it

While your membership is active, and afterwards for as long as we need it to run the business and meet our record keeping obligations. Backups are kept for thirty days on a daily cycle and then monthly, so a deleted account can persist in a backup for a period after deletion before it ages out.

Security

The portal is served over HTTPS. Passwords are hashed with bcrypt and are never stored or logged in a readable form. Access to the production database is limited to the people who operate it. No system is perfect, and we will tell you promptly if a breach affects your information.

Children

The programs are sold to businesses and business owners. The portal is not intended for anyone under 18, and we do not knowingly collect information from children.

Your rights

We handle personal information in line with the Australian Privacy Principles. You can ask for a copy of what we hold about you, ask us to correct it, or complain about how we have handled it, by writing to [email protected]. We will respond within 30 days. If you are not satisfied with our response, you can refer the matter to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If this policy changes in a way that matters, we will say so in the portal rather than quietly changing the date at the top.

Contact

International Technology Management Pty Ltd
[email protected]
Queensland, Australia

This policy is governed by the laws of Queensland, Australia.