Privacy policy

01Who is responsible for your information

OBA, The Online Business Academy, is a trading name of Next Collective LLC, a limited liability company formed in the State of Wyoming, USA. It is not an Australian company. Next Collective LLC is responsible for the personal information described in this policy, and handles it in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

For anything about your information, email support@oba.au.

02What we collect

We keep data collection to what OBA actually needs. Depending on how you use it, that is:

• Account details: your name and email address, and your password, which is stored only as a secure one-way hash. If you sign in with Google, we receive your name and email address from Google instead.
• Purchase details: what you bought, the price, the billing name and address you gave at checkout, your card brand and its last four digits, and the payment reference. Full card numbers go straight to our payment provider and never touch our systems.
• Info pack requests: your first name, email address, phone number, the course or subject you asked about, and which page you asked from.
• The OBA Advisor, the chat on our website: your name, email address and phone number, what you type to the advisor and what it replies, the page you were on, the courses it recommended and any you tapped to enrol on, and whether you asked us to ring you. To stop the chat being abused we keep a scrambled, one-way form of your IP address for two days.
• Learning activity: the lessons and steps you complete, your answers, quiz and assessment results, the notes you write, XP and streaks, your answers to the three questions when you first log in, and the certificates you earn, including the name you choose to print on them.
• The OBA Tutor and Career Centre: the questions you ask the OBA Tutor, the resumes you upload or build, job descriptions you paste in, and your interview practice answers, including audio recordings if you choose to record them.
• Messages: anything you send through the contact form, and your email address if you join the newsletter.
• Calls you book: your name and email address, your phone number if we are ringing you, what you would like to talk about and anything you add, the time you chose and your time zone, and the page you booked from. The call goes into our team's Google Calendar, with a Google Meet link if you chose a video call. If you ask us to ring you instead, we keep your name, email address, phone number and the part of the day that suits you.
• The pages you visit: on our marketing pages, and only if you allow analytics, we keep our own record of which pages you look at, when, the site or advert that brought you to us, how long each page was in front of you and how far down you scrolled. It is kept against a random code in a cookie (oba_vid), not your name, and we never keep your IP address, your device details or an advertising click code. If you allow it, Google Analytics records similar information, along with basic details of your device. Until you choose, we only add one to a count of how often that page was seen that day, with nothing about you.
• If you then ask for an info pack, join a list, write to us, make an account or start a checkout, we link the pages that browser visited to your record, so whoever helps you choose a course can see what you have already looked at. If somebody else then fills in a form on the same browser, we start a fresh record for them rather than mixing the two.
• Technical data: when we email you, we record whether the email was delivered and which of its links you clicked (each link goes through our own website first); we do not track whether you opened it. When somebody checks at checkout whether an email has an account, we keep a scrambled, one-way form of their IP address for a day, only to stop that check being abused.

03How we use it

We use this data to:

• Run your account, deliver your courses, track your progress and issue your certificates.
• Take payments, send receipts and handle refunds.
• Run the OBA Tutor, mark short answers and power the Career Centre tools.
• Send you the info pack you asked for, and follow up by phone or email to help you choose a course when you have asked for the info pack, chatted with the OBA Advisor or asked for a call.
• Arrange the call you booked: confirm it, remind you the day before and an hour before, and let you move or cancel it from the link in your email.
• Answer your questions in the OBA Advisor chat and recommend a course that fits what you tell it.
• Send the emails you have chosen in your email preferences, and the account and order emails every learner gets.
• Keep a record of your enquiries, orders, chats and the emails we have sent you, with notes from our team, so whoever you speak to knows what you have already asked. We also work out a simple score from what you have asked for, so the team knows who to ring first. It never decides anything about you on its own.
• Keep OBA secure and stop abuse, such as the same email being tried over and over at checkout.
• See which pages and courses you looked at before getting in touch, if you allowed analytics, so our team can help you choose.
• Improve the product by understanding how lessons, tools and pages are used.

04Marketing emails

We send marketing emails (news, offers and course recommendations) only when you have said yes: by ticking the box that says so, joining the newsletter or signing up on our website. Every one of these emails tells you who sent it and lets you unsubscribe in one click, and we act on an unsubscribe straight away. When you ask for an info pack, book a call or start a chat with the OBA Advisor, we contact you about what you asked for, and you can tell us to stop at any time.

05Who we share it with

We never sell personal data. Not to advertisers, not to data brokers, not to anyone.

Our customer records (your enquiries, orders, chats, our team's notes, the emails we have sent you and, if you allowed analytics, the pages you visited) are kept in our own database in London, not with a separate customer relationship provider.

We use a small number of service providers to run OBA. They process data on our behalf and only for the job we use them for:

• Supabase, for our database, sign-in and file storage, hosted in London.
• Vercel, which hosts the website and the app. Our servers run in London.
• Stripe, which takes payments, including Link if you choose to save your payment details with it. Stripe also uses some payment data for its own fraud prevention, under its own privacy policy.
• Resend, which sends our emails and tells us whether each one was delivered.
• OpenAI, which powers the OBA Tutor, short-answer marking, the Career Centre tools and the OBA Advisor chat, and receives what you send to those features.
• Vimeo, which plays the lesson videos.
• Google, for Sign in with Google, for our team's calendar and Google Meet when you book a call, and for Tag Manager and Analytics on marketing pages.
• Meta and LinkedIn, whose advertising tags may run on marketing pages to measure whether our advertising works.

06Where your information goes

Your personal information is held outside Australia. Our database is in London, in the United Kingdom, and the website runs on servers in London. Next Collective LLC and some of the service providers listed above handle information in the United States or elsewhere outside Australia; our email provider, for example, sends from Japan.

We choose providers who protect personal information to a standard comparable with the Australian Privacy Principles, and we take reasonable steps, including the terms of our agreements with them, to make sure they do.

07How we keep it safe

Your data is encrypted in transit, every table in our database is locked down so each learner can reach only their own records, and the people who work on OBA see only what their job needs. Our back office has no way to open your resume or your interview recordings.

When you choose a password, we check it against a public list of passwords exposed in data breaches. Only the first five characters of a one-way hash of it leave our servers, which is not enough to work out the password, so the password itself is never shared.

08How long we keep it

• Your account and learning record: for as long as your account is open. If you ask us to delete your account, we delete it after 30 days, which gives you time to change your mind.
• Order and payment records: for as long as tax and accounting law requires, even after an account is deleted.
• Interview sessions and recordings: until you delete them, which you can do yourself in the Career Centre. Resumes: until you ask us to delete them.
• Info pack and contact requests, calls you book, and OBA Advisor conversations: until you ask us to delete them or to stop contacting you. Chats our spam filter catches are deleted after a week.
• The pages you visited: 13 months after that browser was last on our site, then deleted automatically. The daily counts of how often each page was seen, which say nothing about anybody, are kept for 25 months.

09AI and automatic decisions

The OBA Tutor, short-answer marking, the OBA Advisor and the Career Centre tools give you answers and feedback generated by an AI model, not by a person, and it can be wrong. None of them makes decisions about you with legal or similarly significant effects.

Certificates are issued automatically when you reach the published pass mark for a course. If you think a result is wrong, email support@oba.au and a person will look at it.

10Accessing and correcting your information

You can ask to see the personal information we hold about you and ask us to correct anything that is wrong. Using these rights costs nothing. Email support@oba.au: we confirm within 1 working day and respond in full within 30 days. You can:

• Get a copy of the personal information we hold about you. You can download most of it yourself, any time, from your account settings.
• Ask us to correct anything that is wrong, out of date or incomplete.
• Ask us to delete your information. Some records, like order history, we must keep for legal and tax reasons.
• Stop marketing emails with the link at the bottom of every one, or on your email preferences page.
• Say no to analytics, or change your mind, with Cookie settings at the bottom of every page. Saying no deletes our record of the pages that browser visited straight away. If your browser sends a Global Privacy Control signal, we treat it as a no.

11Complaints

If you think we have handled your personal information badly, email support@oba.au and tell us what happened. We reply within 1 working day and aim to resolve it within 30 days.

If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

12Changes to this policy

If we change how we use your data, we update this page and the date at the top, and we tell you by email first if the change is significant.