Privacy Policy

Eco-Yoga Institute ACN 677 775 245 (“we,” “us,” “our”) · Website: ecology.yoga · Last updated: August 2026

This Privacy Policy explains what personal information we collect, how we use it, how we protect it, and your rights in relation to it. We handle your personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024.

1. Information We Collect

We collect personal information when you interact with the Site in the following ways:

Account registration. When you create an account, we collect your name, email address, username, and password. Depending on your membership tier, we may also collect a profile photo, biographical information, and other details you choose to provide.

Profile fields, including location. Your member profile includes optional fields, one of which is a location. If you complete it, that location is stored with your profile, is visible to other members according to your profile settings, and is used by the member directory’s search and “near me” features. It is optional: leave it blank and no location is stored. You can change or clear it at any time in your profile settings.

Membership and payments. When you sign up for a paid membership or purchase a product, your payment is processed by Stripe (including WooPayments, which is built on Stripe). We do not collect or store your card numbers, bank account details, or other payment credentials — these are submitted directly to the payment processor and never pass through our servers. We receive only confirmation of payment, transaction identifiers, and the billing details needed for invoicing and tax records. If we add another payment provider, this policy will be updated before it goes live.

Community participation. When you post in forums, groups, or comments, send messages to other members, or interact with the community, the content you post and your activity (posts, replies, group memberships, and any participation points or badges) are visible to other members in accordance with the Site’s community settings.

Courses. When you enrol in or complete a course, we collect enrolment records, progress data, quiz and assignment submissions, grades, and completion status. Your instructor can see your progress and submissions in the courses you are enrolled in.

Shop purchases. When you buy a product, we collect your name, email, billing and shipping address, and order details.

Events. When you register for an event, we collect your registration details and attendance.

Contact and correspondence. When you write to us by email or through a form on the Site, we collect what you put in the message.

Automatically collected information. Our servers and analytics tools collect technical information such as your IP address, browser type, operating system, referring URL, pages visited, and time spent on the Site. Podcast episodes served from the Site are logged in the same way when they are downloaded or streamed.

Cookies. We use cookies to keep you logged in, remember your preferences, run the shopping cart and checkout, and measure how the Site is used. Analytics cookies are set by Google Analytics (see Section 4). We do not use cookies for third-party advertising, ad retargeting, or behavioural profiling. You can configure your browser to refuse cookies, but some features — logging in and checkout in particular — will not work without them.

2. How We Use Your Information

We use the personal information we collect only for the following purposes:

To create and manage your account and membership.
To process payments, fulfil orders, and meet our tax and accounting obligations.
To deliver courses, record progress, and let your instructor mark your work.
To operate the community features of the Site — forums, groups, messaging, events, and member profiles.
To respond to your enquiries and provide support.
To send you service-related communications, such as account confirmations, billing notices, and membership updates.
To send you newsletters or updates where you have consented, or where we are otherwise permitted to do so. You can unsubscribe at any time from the link in any such email, or by writing to us.
To monitor and improve the Site’s performance, security, and functionality.
To detect, prevent, and respond to spam, security incidents, fraud, or misuse.
To enforce our Terms of Use and Community Rules.
To comply with legal obligations.

We do not use your personal information for purposes other than those described above without your consent.

3. What We Do Not Do

We do not sell, rent, or trade your personal information to anyone.
We do not serve third-party advertising on the Site.
We do not use your personal information for behavioural advertising or profiling.
We do not buy or use third-party marketing lists.
We do not use automated decision-making that significantly affects your rights or interests. If that ever changes, we will update this policy and tell you.
We do not read your private messages except where we are required to investigate a report of harm or a breach of our rules, or where the law requires it.

4. Third Parties and Data Sharing

We share personal information with third parties only as necessary to operate the Site. These are the services in use, and what each one receives:

Stripe / WooPayments — payment processing. Your card details go directly to them; we never see them.
WordPress, BuddyBoss and WooCommerce — the software the Site is built on. BuddyBoss provides the community, courses, quizzes, assignments and gradebook; WooCommerce provides the shop and memberships. This data is processed on our own hosting.
Google (Site Kit — Google Analytics and Search Console) — website analytics. Google receives your IP address and information about the pages you view, and sets analytics cookies. This is used to understand traffic and improve the Site, not to advertise to you.
Jetpack / Automattic — site statistics, image delivery through their content delivery network, and sharing posts to our social accounts. Requests for images and pages may pass through Automattic’s servers, which receive your IP address.
Akismet (Automattic) — spam filtering. When you submit a comment or registration, the content, your email address, username and IP address are sent to Akismet to be checked against known spam. This is how the Site stays usable.
MailPoet — newsletters and transactional email. Receives your name and email address to deliver messages, and records whether an email was opened or a link clicked.
Hosting provider — holds the Site’s database and server logs, including IP addresses, as part of providing hosting. Bound to handle it securely.
Embedded media — some articles embed video or audio from YouTube, Vimeo, SoundCloud or similar. When a page containing an embed loads, that provider may receive your IP address and set its own cookies under its own policy.
Affiliate programmes. The Site contains affiliate links, including the Amazon Services LLC Associates Program. If you click one and buy something, that retailer may track the visit under their own policy. We receive commission data only, never your personal information.
Legal requirements. We may disclose personal information where required by law, court order, or government request, or where we reasonably believe it is necessary to protect our rights, your safety, or the safety of others.

We do not share personal information with anyone beyond those described above.

5. Overseas Data Transfers

Several of the services above — Stripe, Google, Automattic (Jetpack and Akismet), MailPoet, and the providers of embedded media — store or process data on servers outside Australia, principally in the United States and the European Union. Where personal information is transferred overseas, we take reasonable steps to ensure the recipient handles it in accordance with the Australian Privacy Principles. By using the Site you consent to those transfers where they are necessary to provide our services.

6. Data Security

We take reasonable technical and organisational measures to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include SSL/TLS encryption in transit, hashed password storage, access controls limiting who can reach personal information, regular software and security updates, and reputable hosting.

No method of electronic storage or transmission is completely secure. We cannot guarantee absolute security, but we are committed to maintaining and improving our practices in line with current standards and our obligations under the Privacy Act.

7. Data Retention

Account data is kept while your account is active. If you delete your account, we delete or de-identify your personal information within 30 days — except where retention is required for legal, accounting, or dispute-resolution purposes, and except for any article you have published on the Site, which stays published with your byline unless you specifically ask us to remove it (see Section 8).
Transaction and order records are kept for 7 years, as required by Australian tax and accounting law.
Course records — enrolments, submissions and completions — are kept while your account is active and for as long as needed to substantiate any credential issued.
Server logs containing IP addresses and technical data are kept for up to 12 months, then deleted or anonymised.
Community content remains on the Site unless you ask for its removal (see Sections 8 and 9).

8. Content You Post

Content you post — forum posts, group discussions, comments, course reviews, and profile information — is visible to other users, and in some areas to the public. Do not post personal information you do not want to be public, your own or anyone else’s.

Closing your account does not unpublish your articles. An article you have written — for the eMAG or for your own member blog — stays on the Site with your byline unless you specifically ask us to remove it.

This applies to articles. Your activity updates, forum replies and comments are part of the community stream and are treated differently — they go with the account when it closes, except where others have already replied and removing them would break the conversation. See section 16 of the Terms of Use.

We will remove your posted content at your request where practicable. We cannot guarantee removal of anything already copied, cached, or indexed by third parties such as search engines.

9. Your Rights

Under the Australian Privacy Principles you have the right to:

Access the personal information we hold about you. Most of it is visible and editable in your account settings.
Correct anything inaccurate, incomplete, or out of date.
Request deletion, subject to the exceptions above — for example where we must retain records for legal or accounting reasons, or where your posts form part of a thread others have replied to.
Withdraw consent for marketing at any time.
Ask how your personal information has been used or disclosed.
Deal with us anonymously or under a pseudonym where it is lawful and practicable to do so. A display name that is not your legal name is permitted; an account and an email address are still needed to log in.

To exercise any of these, write to admin@ecology.yoga with the subject line “Privacy Request.” We will acknowledge within 7 days and respond substantively within 30 days.

If you are in a jurisdiction with additional data-protection rights, such as the EU or UK under the GDPR, we will make reasonable efforts to honour them. Write to us to discuss your circumstances.

10. Data Breaches

If a data breach involving your personal information is likely to result in serious harm, we will contain the breach and mitigate the harm, assess it under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act), and notify the Office of the Australian Information Commissioner and affected individuals as the law requires. We maintain a breach response plan and will act promptly.

11. Children

The Site is not directed at children under 16, and you must be at least 16 to register. We do not knowingly collect personal information from children under 16. If we learn that we have, we will delete it promptly. If you believe a child under 16 has given us personal information, write to admin@ecology.yoga.

12. Changes to This Policy

We may update this policy to reflect changes in our practices, the services we use, technology, or the law. Updated versions are posted here with a revised “Last updated” date. If we make material changes — particularly to how we use or share your personal information — we will notify registered users by email before they take effect.

13. Complaints

If you believe we have breached the Australian Privacy Principles or otherwise mishandled your personal information, please complain to us first at admin@ecology.yoga. We will acknowledge within 7 days and investigate and respond within 30 days.

If you are not satisfied with our response, you may take the complaint to the Office of the Australian Information Commissioner (OAIC), the independent regulator:

Online: oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992
Post: GPO Box 5288, Sydney NSW 2001

The OAIC will normally ask that you have complained to us first and given us a reasonable time to respond.

14. Contact

Eco-Yoga Institute · ACN 677 775 245
Email: admin@ecology.yoga
Website: ecology.yoga