Privacy

1. About this policy and who we are

This site is operated by Bayani Mills ("we", "us", "our"), trading as Self-Driven Recovery (ABN 45 347 252 157), located in Sydney, Australia. This policy applies to selfdrivenrecovery.com, web.selfdrivenrecovery.com, and any other subdomains we operate.

If you have any questions about this policy or our handling of personal information, please use our contact form.

2. Information we collect

2.1 Information you provide directly

• Order information. When you place a hardware order, we collect your name, email address, shipping address, and any optional fulfillment notes you supply. We do not send automatic emails: we keep your email address so that we can follow up on your order by hand if needed. We also keep a short-lived keyed hash of your network (your IPv4 address or IPv6 /64 prefix), never the address itself, to limit abusive order spam; it is cleared when the order is paid or erased.
• NDIS details (optional). If you choose to pay by invoice you can add how the order is funded, a participant name, an NDIS number, a plan manager's name and email, and a support item. All of these are optional. We use them only to prepare your invoice, and we keep them with the order record. We do not use them for marketing and we do not pass them on, other than showing them on the invoice you receive.
• Contact form submissions. When you send a message through the contact, booking or facility enquiry forms, we collect what you enter: your name, email address, role, organisation, phone number, and message. We keep these in our own enquiry records, which only we can see, and use them to reply to you.
• Program data. The browser app stores the program on our server under an opaque session identifier so your editor and display can stay synchronized. Separate private read and write capabilities protect access; the identifier alone cannot open the program.

2.2 Information collected automatically

• Server logs. Our servers automatically record standard web access logs (IP address, request path, timestamp, user-agent string) for security and operational purposes.
• Session activity. We update the session's last-access time after an authenticated editor or display request so inactive sessions can be removed automatically.
• Aggregate page-view analytics. We count page views with Umami, an open-source analytics tool that we host ourselves. It sets no cookies, stores no IP addresses or persistent identifiers, and honours your browser's Do Not Track setting. The notice shown on your first visit lets you switch it off with "No thanks"; that choice is kept in your browser only. What we see is aggregate: which pages were viewed, roughly when, and the browser and screen type.

2.3 Information from third parties

We do not purchase, license, or otherwise acquire personal information from third parties.

3. How we use your information

We use the information we collect for the following purposes:

• To fulfil and ship orders, including providing receipts and shipping updates.
• To respond to enquiries and customer support requests.
• To operate, maintain, and improve the SDR website and display software.
• To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity.
• To comply with legal obligations, including tax recordkeeping requirements.

We do not sell or rent personal information. We do not use personal information for advertising or behavioural profiling.

4. Cookies and similar technologies

The public site does not set marketing, advertising, or analytics cookies. Page-view counting (section 2.2) runs without cookies; your choice about it is stored in localStorage under sdr.analytics. Your browser stores private session capabilities and an in-progress save queue in localStorage on the SDR origin so the editor can reconnect across visits. You can clear these values in your browser settings. The administrative console uses an authentication cookie.

5. Sharing your information

We share information only as necessary to provide the service:

• Shipping carriers receive the recipient name and address required to deliver hardware orders.
• Payment providers. Card payments are handled by Square, which has its own privacy policy. Other payment methods offered at checkout are handled by their own providers. We do not receive card details, exchange-account details, or wallet seeds. For invoice orders you pay by bank transfer, and your bank gives us the payment details on our own statement.
• Analytics. Page-view counts are processed on our own analytics server (analytics.blkstr.io), operated by us in Australia. No analytics data is sent to a third-party analytics company.
• Hosting infrastructure. Site and application data is processed by the infrastructure used to host SDR. Web fonts and core application assets are served directly from SDR rather than fetched from an advertising or font CDN at runtime.
• Legal compliance. We may disclose information if required to do so by law, valid legal process, or to protect the rights, property, or safety of any person.

We do not sell your personal information.

6. Data retention

• Sessions, program data, access hashes, and session events: automatically deleted after 120 days without authenticated access. Deleting a session from the editor removes the same set together.
• Hardware order records: paid orders are kept for as long as tax records require (5 years) and, where an order carries NDIS details, for as long as NDIS records may require (up to 7 years). We keep them for 7 years.
• Unpaid orders: including invoice orders that lapse after 14 days unpaid, the name, email, address, notes and any NDIS details are erased about 7 days after the order expires or is cancelled, and the empty record is deleted after 30 days. If a payment is detected on an unpaid order we keep its details so we can ship or refund it.
• Contact form messages: retained until you ask us to delete them.
• Server access logs: retained only for operational and security needs under the hosting system's log-rotation settings.

7. Data security

We use industry-standard measures to protect information, including TLS encryption for all connections to the site. Servers operate behind authenticated tunnels and only the public surfaces of the application are exposed to the internet. Backups are encrypted and held on the same premises as the primary system.

No security measure is perfect. While we take reasonable steps to protect information, we cannot guarantee absolute security.

8. Your rights and choices

Depending on where you live, you may have rights in relation to your personal information, including the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Request deletion of personal information, subject to legal exceptions (such as tax recordkeeping).
• Object to or restrict certain processing.
• Lodge a complaint with your local data protection authority.

Australian residents have rights under the Privacy Act 1988 (Cth) and may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

European Economic Area, United Kingdom, and Swiss residents have rights under the GDPR / UK GDPR.

California residents have rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of any sale of personal information. We do not sell personal information.

To exercise any of these rights, send a request via our contact form. We will respond within a reasonable time and in accordance with applicable law.

9. International data transfers

Our servers are located in Australia. If you access the site from outside Australia, your information will be transferred to and processed in Australia. By using the site you consent to this transfer.

10. Children's privacy

SDR is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us without parental consent, please notify us via our contact form and we will delete the information.

11. Changes to this Privacy Policy

We may update this policy from time to time to reflect changes in our practices, services, or applicable law. The date at the top of this page indicates the last revision. We encourage you to review the policy periodically.

12. Contact us

For questions, requests, or complaints about this Privacy Policy or our handling of personal information, contact us via our contact form.

Our Terms and Conditions also apply to your use of the site.