Privacy policy

The personal information we collect

We collect personal information that is necessary to deliver our learning programs, digital products and coaching services. This may include your name, email address, job title, organisation, location, and your responses to surveys, self-assessments or coaching tasks. We may also collect information you share in our programs, digital platforms or events. On the Platform that means:

• Account details: your name, email address, job title and organisation, and your role in a program (participant, facilitator, or a contact for your organisation).
• Program records: the cohort and sessions you are part of, attendance where it is recorded, and the commitments you make in a workshop.
• Assessment responses: your answers to the Capability Analysis and the Development Profiles, including where you flag a skill as over-used, and the results calculated from them.
• Feedback and evaluation answers: your ratings and written answers to pulse checks, program feedback and the other evaluation tools, and the activities you complete in a session.
• Technical data: when you use the Platform or our website we may automatically collect metadata such as your IP address, browser type, pages viewed and how long a page takes to load, for security, analytics and improvement.

Our AI-enabled tools work from program data that has already been de-identified wherever possible (section 6). We do not collect or process sensitive information, such as health information or details of your beliefs, unless you choose to share it in a written answer, and we ask that you do not.

How we collect and hold it

Most of what we hold comes directly from you: when you sign in, complete an assessment or survey, take part in a workshop, or contact us. Some comes from your organisation, such as a program sponsor telling us who is enrolled and how to reach you. Some is created by our tools, such as the result calculated from your assessment answers.

We hold personal information in cloud services with access controls, encryption in transit and at rest, and audit logs. The Platform's database is hosted in Sydney, Australia. What you can see on the Platform is decided by your role: participants see their own learning, facilitators see the sessions they deliver, contacts at a client organisation see their organisation's program dashboards, and the Thinka team see what they need to run a program. Nobody can create an account without an invitation from Thinka, and you sign in with a one-time code sent to your email address or a password you set.

Alongside the Platform we hold program and client records in our program management and CRM systems, and learning materials, notes and correspondence in our document and email systems.

How we use it

We use your personal information to support the successful delivery of Thinka's services. This includes tailoring programs to suit your needs, communicating session details and learning resources, and enabling access to personalised tools like diagnostics and digital learning modules.

We also use information to improve our content and services. Participant feedback and anonymised usage patterns help us understand what works, how people engage, and where we can enhance the experience. This extends to our AI-powered tools like Thinkabout, where the questions our team ask help us refine prompts, improve tone, and ensure our AI remains a helpful, human-centred enhancement to our programs.

Assessment and evaluation results are also used to report to the organisation that sponsors your program. What a sponsor sees, and the consent it rests on, is set out in the next section.

Your consent, and what your organisation sees

Before an assessment or survey result is saved, we ask you to read and accept a consent statement. There are two, and the tool tells you which applies.

• De-identified tools, such as pulse checks and workshop feedback: your name is not included in the results database, and your answers cannot be uniquely identified. They reach dashboards only as ratings in aggregate, and as written comments with names, email addresses and phone numbers removed. Any cut of results with fewer than five respondents is withheld, so that no one can be picked out.
• Program feedback, asked once at the end of a program: your answers are kept with your name, so that we can follow up with you about your program. Your organisation sees them only as ratings in aggregate and as written comments with names, email addresses and phone numbers removed, under the same five-respondent rule.
• Identified results, which are the Capability Analysis, the Development Profiles and the commitments you make in a workshop: with your consent your result is shared, with your name, with your facilitator and your program's sponsor at your organisation, and with nobody else. You can ask at any time for a result to be corrected or redacted (section 8).

Consent is voluntary. If you do not accept, your result is saved for you alone and reaches no one else.

Who we share it with, and where

We only share personal information when necessary to deliver services, ensure continuity, or meet legal obligations. Within our team, your information may be shared with Thinka facilitators, learning designers or project partners to ensure your experience is personalised, relevant and effective.

We use carefully selected providers to run our services, each protected by privacy settings and terms of use that meet Australian standards. At the date of this policy they are:

• Supabase, for the Platform's database and sign-in, hosted in Sydney, Australia.
• Vercel, which hosts the Platform, in the United States.
• Resend, which sends sign-in codes and program emails, in the United States.
• monday.com, for program and client records, in the United States and Israel.
• Anthropic, whose language model powers Thinkabout, in the United States.
• Microsoft 365, for documents, email and meetings.
• Canva for learning materials, Zoom for online sessions, AhaSlides and Mural for interactive workshop activities, and Otter for meeting notes and transcription.

Some of these providers store or process information outside Australia, principally in the United States. When we work with offshore tools or providers we take the additional steps that APP 8 (cross-border disclosure) asks for: we choose providers whose privacy and security terms meet Australian standards, we limit what they receive to what the service needs, and we de-identify wherever we can.

If legally required, such as during audits or in response to safety or compliance concerns, we may also disclose information to authorities. At no point do we sell or trade personal data.

AI, automated processing and human oversight

Software calculates your assessment results from your answers. The Capability Analysis and the Development Profiles score each answer, place the result in a band or level, and select the feedback that Thinka's learning designers wrote for that level. These results support conversations between you, your facilitator and your sponsor about your development. Thinka does not make decisions about your employment, pay or performance, and our programs are not designed to be used that way.

Thinkabout is Thinka's own AI assistant, built on a language model provided by Anthropic. The Thinka team use it to ask questions of program data. Before program answers reach the model, names, email addresses and phone numbers are removed, and a question about an individual participant is never quoted. Anything Thinkabout drafts for a client dashboard is reviewed and published by a person. Our use of AI is always supported by human oversight; Thinkabout never replaces direct coaching or decision-making.

You can ask us to explain how an AI-enhanced service uses your information, and to have a human-led alternative available where AI is involved, in line with the principles of fairness, privacy and human-centred decision-making.

Keeping it safe, and if something goes wrong

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure: access by role, row-level security in the database, sign-in by one-time code or password, encryption in transit and at rest, and regular review of who has access to what.

If a data breach is likely to result in serious harm to anyone, we will notify the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

Access, correction and redaction

You have full control over your personal information. If you would like to know what information we hold, you can request access at any time. You are also welcome to request corrections to anything that is inaccurate, outdated or incomplete, and to ask for a result you have given us to be redacted.

Your profile page on the Platform shows what Thinka has linked to your email address. To request access to or a copy of your information, correct something, or have a result redacted, email service@thinka.me or write to Thinka Pty Ltd, PO Box 5298, South Melbourne VIC 3205. We will confirm we have received your request within seven days and respond within 30 days. There is no charge. If we cannot agree to a request we will tell you why in writing, and how to complain.

We value transparency. If you are unsure how your data is used, especially with AI-enhanced services, we are happy to explain.

How long we keep it

We keep personal information while it is needed to deliver your program and to report on it, including comparing results from before and after a program. After that we de-identify it or destroy it, unless the law requires us to keep it or you ask us to, for example to carry a development profile into a later program. De-identified, aggregated results may be kept to improve our programs.

Marketing

You will only receive promotional or marketing messages from us if you have opted in. These are usually related to upcoming programs, new tools or thought leadership: never spam, and always with the option to unsubscribe.

Cookies and analytics

The Platform does not use advertising or tracking cookies. It stores your sign-in session in your browser so that you stay signed in, and your preference for light or dark mode. We use Vercel Speed Insights to measure how quickly pages load; it does not identify you. Our website, thinka.me, may use cookies for analytics, and its own notice applies there.

Complaints

If you think we have breached the Australian Privacy Principles, contact us at service@thinka.me with "Privacy complaint" in the subject line, or write to Thinka Pty Ltd, PO Box 5298, South Melbourne VIC 3205. We will acknowledge your complaint within seven days, look into it, and give you a written response within 30 days. If you are not satisfied with our response, or would rather go straight to the regulator, you can complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au or on 1300 363 992.

For more information on your rights and data protection in Australia, we recommend the OAIC and Australia's AI Ethics Framework.

Changes to this policy

Thinka is committed to maintaining ethical, transparent and human-first privacy practices. We regularly review our privacy policy and data handling procedures to align with changes to Australian legislation, including the reforms to the Privacy Act, and to reflect evolving best practice in AI governance. The date at the top of this page tells you when it last changed.

We believe technology should empower people, not replace them. That is why we keep human connection at the core of everything we do, whether through live workshops, digital learning, or AI-supported tools like Thinkabout.

If you ever have questions, concerns or feedback about your data, please contact us.

Contact us

Thinka Pty Ltd, ABN 53 659 914 780. Email service@thinka.me, or write to PO Box 5298, South Melbourne VIC 3205.