Privacy Policy

Effective date: 13 November 2026

1. About this policy

This policy explains what personal information is handled when you visit ryanbabbage.net (the "site"), read its content, use its free self-assessment tools, buy a paid report, subscribe to the newsletter, buy a product or book a session, and what choices you have about it.

The site is run by Ryan Babbage, an individual trading as a sole trader in Australia (ABN 40 844 930 305, registered for GST). I am currently based in Thailand. In this policy, "I", "me" and "my" refer to Ryan Babbage. The site is not operated by, and this policy does not cover, any company I am involved with.

Privacy contact: [email protected]. Postal address: Suite 1208, 530 Little Collins Street, Melbourne VIC 3000, Australia.

2. Which laws this policy is written for

I am an Australian small business. I may not be required to comply with the Privacy Act 1988 (Cth), but I follow the Australian Privacy Principles voluntarily as a standard for how I handle your information. Because readers and clients come from many countries, this policy also describes the rights that people in the United Kingdom and the European

Union have under the UK GDPR and the EU GDPR, and I handle personal information in a way that is consistent with Thailand's Personal Data Protection Act while I am based there.

For the purposes of the UK GDPR, the EU GDPR and Thailand's Personal Data Protection Act, I am the controller of your personal information.

3. What I collect, and how

I collect only what is needed to provide what you ask for. I do not ask for sensitive information (such as health, religious or political information), except as described in section 3.7 for in-person programs, and I ask that you do not send it.

3.1 When you simply browse

The site is a static website. It does not set its own cookies, does not run analytics or advertising scripts, and does not load third-party fonts, videos or social-media embeds. Fonts and images are served from the site itself.

When you load any page, the hosting provider (Cloudflare) necessarily processes technical data, such as your IP address, device and browser details, the page requested, the referring page and the time of the request. Cloudflare uses this data to deliver the page and to protect the site against attacks and abuse. Cloudflare may set a strictly necessary security cookie if it needs to check that a visitor is not an automated attack, for example when a security challenge is shown.

3.2 When you use the free self-assessment tools

The free tools on the site (including the Boardroom Diagnostics and the Five Capitals Assessment) are self-assessment reviews. Your responses are processed on your own device and are not sent to me by the free review. They are held only in the page's working memory while you use the tool, and closing or reloading the page clears them. If you print or save your summary as a PDF, your browser creates that file on your own device, and I do not receive a copy.

Your answers are sent to me only if you choose to buy a paid report, as described in section 3.3.

3.3 When you buy a paid report

If you choose "Get the full report", you give me your email address, your organisation's name, the country you are buying from and your answers to the review. I use them to produce your report, deliver it, let you download it again and apply your Session discount code.

• Before payment. Your answers and organisation name are passed to Stripe as part of the checkout session so that they can be matched to your payment. I do not store them on my own systems before payment is confirmed. If payment fails or the checkout expires, I store nothing about the attempt. Stripe keeps its own record of checkout sessions under its own privacy policy.
• After payment. Once Stripe confirms payment, I store your answers, organisation name, email address, country, order details, the version of the checkout wording you accepted and the time you accepted it. Your report is generated automatically from your answers using a fixed method and emailed to you as a PDF.
• Your reports account. To download a report again, or to submit the second review for a two-report order, you request a sign-in link by email. The link is signed and expires after 7 days. No password is created or stored.
• Quality checks. Reports are not reviewed by me before they are sent. I may look at a sample of generated reports afterwards to check that the system is working properly.
• Deletion. Your answers, PDFs, organisation name and email address are deleted 90 days after payment. A minimal record of the order and discount code (product, amount, currency, dates and status) is kept for tax and accounting purposes, as set out in section 8.

Your answers may describe your organisation's finances, ownership or disputes. Please do not include personal details about other people, such as names, health information or family matters, in your answers.

3.4 When you subscribe to the newsletter or join the book early-access list

To subscribe to Argued Properly (my newsletter) or to the early-access list for the online edition of Money Has a Family Name, you give me your email address and, on some forms, your first name. The form sends these details directly to my email service, Kit. Kit also records technical details of the sign-up (such as the time, the form used and your IP address) and whether links in my emails are clicked. I have switched off email open tracking.

Subscription uses double opt-in: you are added only once you confirm through the link Kit emails you. On forms for events and programs, joining the newsletter is a separate, optional tick box. You can unsubscribe at any time using the link in every email, or by contacting me. The forms include a hidden anti-spam field that is not shown to people and is not kept.

3.5 When you buy a session or other product

Purchases are paid through Stripe. You enter your payment details on Stripe's own checkout pages, not on this site. Stripe collects your name, email address, billing address and card or other payment details, and processes them to take payment, prevent fraud

and meet its own legal obligations. Stripe emails your receipt.

I receive from Stripe the details I need to fulfil and record your order: your name, email address, billing country or address, what you bought, the amount and currency, and the payment status. I do not receive or store your full card number.

3.6 When you book a session

After payment, session times are arranged through Cal.com, a scheduling service, or by email. When you book, you provide your name, email address, preferred time and time zone, and anything you choose to tell me about the decision you want to discuss. Cal.com syncs bookings with my Google Calendar so that I can manage my availability, and may send you confirmation and reminder emails. Sessions and Clinics are held on Google Meet (Google LLC, United States).

3.7 When you take part in a session, clinic, workshop or program

During an Executive Decision Session, Decision Clinic, Strategy Day, workshop or The Gulf Decision program, you may share information about yourself, your business, your family or your plans. I use it only to prepare for, deliver and follow up on that engagement, including the written perspective note. Please share only what you are comfortable sharing, and share other people's personal information only if you are entitled to do so.

For in-person programs, I may need travel dates, emergency contacts and, if you choose to tell me, dietary or accessibility requirements. Dietary and accessibility requirements can reveal health or religious information. I ask for them only when needed, use them only to arrange the program, share them only with the venue or caterer, and delete them after the program ends. Providing them is optional.

Sessions and clinics are not recorded or transcribed, including by AI note-taking tools.

3.8 When you email me

If you contact me, I receive your email address and whatever you include in the message, and I use it to reply.

4. Why I use personal information

I use personal information to: deliver the site and keep it secure; produce, deliver and re-deliver paid reports and apply discount codes; send the newsletter and early-access updates you asked for; process payments and deliver what you bought; arrange, prepare for and deliver sessions, clinics, workshops and programs; reply to your messages; keep business, tax and accounting records; and meet legal obligations and establish or defend legal claims.

I do not sell personal information. I send marketing emails only to people who have asked for them or who have bought from me (see section 5), and I do not use personal information for third-party advertising. Paid reports are generated automatically from your own answers using a fixed method. This does not produce decisions with legal or similarly significant effects on you.

For people in the UK and EU, the legal bases are:

• Performance of a contract: producing, delivering and storing paid reports, orders, discount codes and bookings.
• Consent: the newsletter and early-access list, and optional dietary or accessibility requirements. You can withdraw consent at any time.
• Legitimate interests: site security, responding to enquiries, record keeping, checking report quality and the one reminder about an unused discount code.
• Legal obligation: tax and accounting records.

5. Direct marketing

I send newsletter emails only to people who have opted in. Every email identifies me and includes an unsubscribe link. Buying a report, product or session does not add you to the newsletter.

Emails about your order, such as report delivery and sign-in links, are service messages. If you buy a report, I will also send you one reminder before your Session discount code expires. That reminder includes a way to opt out.

6. Service providers I rely on

I use the following providers to run the site and the business. Each processes personal information on my behalf, or as an independent controller for its own purposes, under its own terms and privacy policy.

I may also share information with my professional advisers (such as my accountant or lawyer), with a payment provider or bank to resolve a dispute, or where the law requires it.

7. Overseas transfers

Most of the providers above are based in, or store data in, the United States, and some process data in other countries, including Australia and the EU. I am currently based in Thailand, so I may access information from there. This means your information is likely to be handled outside your country.

I choose established providers that publish privacy and security commitments and offer data processing terms. For people in the UK and EU, transfers rely on adequacy decisions (including the EU-US Data Privacy Framework and its UK Extension, where a provider is certified) or on the standard contractual clauses and UK addendum included in each provider's terms.

8. How long I keep information

• Free self-assessment answers: not kept at all (section 3.2).
• Paid report answers, report PDFs, organisation name and email address: deleted 90 days after payment.
• Order and discount records, and purchase and payment records: five years from the relevant transaction, as required by Australian tax law.
• Newsletter subscribers: while you remain subscribed. After you unsubscribe, a suppression record may be kept so that you are not emailed again.
• Session and booking records, and perspective notes: two years after the engagement ends.
• Dietary and accessibility requirements: deleted after the program ends.
• General correspondence: two years after our last contact.
• Hosting and security logs: for the period set by Cloudflare.

9. Security

I use reputable providers, secure (HTTPS) connections, multi-factor authentication on my accounts where available, and signed, expiring links for report downloads, and I limit what I collect. No system is completely secure, so I cannot guarantee security. If a data breach is likely to cause you serious harm, I will tell you promptly, and I will notify any regulator where the law requires it.

10. Your choices and rights

You can:

• unsubscribe from emails at any time;
• ask to see the personal information I hold about you, and ask me to correct it;
• ask me to delete your stored report answers and PDFs before the end of the retention period, which also ends access to re-download them (your discount code stays valid until it expires);
• complain about how I have handled your information.

If you are in the UK or EU, you also have the right to erase, restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting earlier processing).

You can deal with me anonymously or under a pseudonym where practical, such as when reading the site or using the free tools. It is not practical for purchases, reports or bookings. To make a request, email [email protected]. I may need to confirm your identity. I will reply within 30 days.

11. Complaints

Please contact me first at [email protected] and I will try to resolve your concern. If you are not satisfied, you may be able to complain to: in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the data protection authority where you live or work; or in Thailand, the Personal Data Protection Committee (pdpc.or.th).

12. Children

The site and its services are intended for adults in business and family-enterprise roles. They are not directed at anyone under 18, and I do not knowingly collect their personal information.

13. Links to other sites

The site links to other websites, including Stripe checkout pages, Cal.com booking pages and my separate site, ryanbabbage.ai. Those sites have their own privacy policies, and this policy does not cover them.

14. Changes

I may update this policy as the site or the law changes. The effective date above records the most recent revision. If a change is significant, I will take reasonable steps to let subscribers and customers know.

15. Contact

Ryan Babbage, sole trader, ABN 40 844 930 305

Email: [email protected]

Post: Suite 1208, 530 Little Collins Street, Melbourne VIC 3000, Australia