Privacy Policy
Effective Date: 2 August 2026 (supersedes the version dated 27 April 2026)
1. Who We Are and What This Policy Covers
This Privacy Policy explains how www.tools.fengshuitoday.com (“Website” or “Platform”), operated by Feng Shui Today / FST Feng Shui Tools, a service of Shantallow Partners Pty Ltd and Laguna Media (“we”, “us”, or “our”), collects, uses, discloses, and protects personal information.
We are based in Queensland, Australia, and handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”). Where the EU or UK General Data Protection Regulation (“GDPR”), Singapore’s Personal Data Protection Act (“PDPA”), or other local laws apply to you, we also comply with those laws to the extent they apply.
This Policy applies to the Website, the FST Platform, and any related services. It does not apply to third-party websites we link to.
Contact for privacy matters: contact email Entity: Shantallow Partners Pty Ltd, ABN 75495300172
2. Anonymity and Pseudonymity
Where practicable, you may deal with us anonymously or under a pseudonym, for example, general enquiries through our contact form.
This is not practicable for account applications. The Platform is a professional tool available only to verified practising consultants, and we cannot assess an application, verify professional standing, process payment, or provide support without identifying you.
3. Information We Collect
3.1 Application and verification information
When you apply for an account, we collect:
- Your full legal name
- Email address and telephone number
- Practice or business name, practice website address, and business details
- Country and city of practice
- Training background, school, teacher, and year qualified
- Professional association membership and membership number
- Referee details (see clause 3.2)
We collect this to assess eligibility, verify professional standing, and protect the Platform from unauthorised access. If you do not provide it, we cannot approve your application.
3.2 Information about other people
Our application process asks you to nominate a referee, an existing subscriber, association member, or your teacher. When you provide someone else’s name and contact details, you must have that person’s consent to do so, and you must tell them that their details will be given to us and that we may contact them to confirm your professional standing.
We use referee details only to verify an application, and we delete them once the application is decided unless the referee is themselves an account holder.
We may also contact a professional association you nominate to confirm your membership status.
3.3 Account and billing information
- Login credentials (passwords are stored hashed, never in plain text)
- Subscription status, renewal dates, invoices, and transaction records
- Payment method details, which are collected and held by our payment processor, we do not store full card numbers on our systems
3.4 Client and consultation data you enter
The Platform allows you to upload and store material relating to your own clients, including names, addresses, property details, floor plans, birth dates, birth times and birthplaces (for BaZi calculation), notes, and generated reports.
This is personal information about your clients, not about you. Our role in relation to it is set out in clause 5.
3.5 Technical and usage data
Collected automatically when you use the Platform:
- IP address, approximate location derived from it, browser type, operating system, and device identifiers
- Login times, session duration, and concurrent session activity
- Pages and features accessed, calculations run, and outputs generated
- Referring URLs and error logs
- Cookie and similar identifiers (see clause 8)
We log this data for security, licence enforcement, abuse detection, and service improvement. As set out in our Terms of Use, reports and outputs generated by your account may carry visible and non-visible watermarks identifying the account and date of generation.
3.6 Communications
Support enquiries, correspondence, and any feedback or testimonial you provide.
3.7 Sensitive information
We do not seek sensitive information as defined by the Privacy Act 1988 (Cth). Please do not enter health information, or information about racial or ethnic origin, religious beliefs, or sexual orientation, into free-text fields.
4. Why We Use Your Information, and Our Legal Basis
| Purpose | Legal basis (GDPR, where applicable) |
|---|---|
| Assess and verify account applications | Steps prior to entering a contract; legitimate interests in protecting the Platform |
| Provide and operate the Platform and store your data | Performance of a contract |
| Process payments, manage subscriptions and renewals | Performance of a contract; legal obligation (tax and accounting) |
| Provide support and send service notices | Performance of a contract |
| Security, fraud prevention, licence enforcement, detection of credential sharing or unauthorised extraction | Legitimate interests |
| Improve platform functionality, fix faults, and analyse aggregate usage | Legitimate interests |
| Send optional product news and updates | Consent (you may withdraw at any time) |
| Comply with legal, regulatory, and record-keeping obligations | Legal obligation |
We do not use your personal information, or your clients’ data, to train machine-learning or artificial-intelligence models, and we do not use it for automated decision-making producing legal or similarly significant effects. Application approval is a human decision.
5. Your Clients’ Data – Your Role and Ours
For client data you enter into the Platform, you are the controller (or, under Australian law, the entity responsible to your clients) and we act as a processor and service provider on your behalf.
Your responsibilities:
- Obtaining your clients’ consent to collect, use, and store their information
- Providing your clients with your own privacy notice
- Complying with the privacy laws applicable to you, including the APPs, GDPR, PDPA, or other local law
- Maintaining the confidentiality of client information and the security of your account credentials
- Responding to your clients’ own access, correction, and deletion requests
Our undertakings:
- We process client data only to provide the Platform, to comply with law, and on your instructions
- We do not access the content of your client folders except where necessary for support you have requested, to maintain or repair the service, to investigate a suspected breach of our Terms, or where required by law
- We do not sell, share, or use client data for our own commercial purposes
- We apply the security measures in clause 10
- We will notify you without undue delay if we become aware of a breach affecting your client data, so you can meet your own notification obligations
If you require a formal data processing agreement or GDPR Article 28 terms, contact us.
6. Disclosure of Information
We do not sell personal information.
We disclose information only to:
- Service providers who help us operate the Platform, web hosting and cloud infrastructure, content delivery, payment processing, email delivery, analytics, and error monitoring. These providers are bound by contract to handle data securely and to use it only for the services they provide to us.
- Professional associations and referees, strictly for the purpose of verifying an application, and only where you have nominated them.
- Professional advisers, our accountants and lawyers, where necessary.
- Legal authorities, where required or authorised by law, or to establish, exercise, or defend legal claims.
- A successor entity, in the event of a merger, sale, or restructuring, subject to the acquirer being bound by this Policy.
A current list of our material service providers is available on request.
7. Direct Marketing
We may send you service messages, renewal notices, security alerts, downtime notifications, and changes to terms. These are part of the service and cannot be opted out of while you hold an account.
Optional product news and promotional messages are sent only with your consent. Every such message includes an unsubscribe link, and you may opt out at any time by using it or by contacting us. We comply with the Spam Act 2003 (Cth).
8. Cookies and Similar Technologies
We use:
- Strictly necessary cookies – to authenticate you, keep you logged in, maintain session security, and support the shopping cart and checkout. The Platform will not function without these.
- Preference cookies – to remember your settings.
- Analytics cookies – to understand aggregate usage and improve the Platform.
Where required by law, we ask for your consent before setting non-essential cookies, and you may change or withdraw that choice at any time through the cookie settings link on the Website. You can also block or delete cookies through your browser, though this may prevent you logging in.
We do not use cookies for third-party advertising or cross-site tracking.
9. Data Storage and Location
The Platform is hosted on cloud infrastructure, and content is delivered through a global content delivery network. Data may be stored, backed up, or processed on servers located outside Australia, including in [insert primary hosting region: e.g. Australia, Singapore, United States].
Our payment processing, email delivery, and analytics providers may also process data outside Australia.
Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual protections. For transfers of EU or UK personal data outside those jurisdictions, we rely on Standard Contractual Clauses or another approved transfer mechanism.
10. Security
We take reasonable technical and organisational measures to protect information, including:
- Encryption of data in transit (TLS) and encryption at rest where supported by our infrastructure
- Hashed password storage
- Role-based access controls and authentication, with internal access limited to personnel who need it
- Session controls, activity logging, and monitoring for anomalous access
- Automatic backups, held securely and restricted in access
- Regular software and platform updates
You are responsible for choosing a strong, unique password, keeping your credentials confidential, and not sharing your account. Notify us immediately if you suspect unauthorised access.
No system is completely secure, and we cannot guarantee absolute security.
11. Data Breach Notification
If a data breach occurs that is likely to result in serious harm, we will assess it promptly and notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth), and any equivalent obligation under the GDPR or PDPA.
Where the breach affects client data you have stored, we will notify you without undue delay so that you can meet your own obligations to your clients.
12. Data Retention
| Data | Retention period |
|---|---|
| Account and profile information | While your account is active, and for 12 months after closure |
| Client data you have entered | While your account is active; deleted 90 days after account closure, unless you request earlier deletion or export |
| Billing and transaction records | 7 years, as required by Australian tax and financial record-keeping law |
| Unsuccessful applications and referee details | 6 months, then deleted |
| Security and access logs | 12 months |
| Support correspondence | 3 years |
Export before closure. Download or export any reports and client data you wish to keep before your account is closed. After the retention period lapses, deleted data cannot be recovered.
Data may persist in encrypted backups for a short period after deletion from live systems, after which it is overwritten in the ordinary backup cycle.
13. Your Rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct information that is inaccurate, out of date, or incomplete
- Request deletion of your personal information
- Object to, or request restriction of, certain processing
- Request a portable copy of information you have provided
- Withdraw consent where processing is based on consent
- Not be discriminated against for exercising these rights
Making a request. Contact us using the details in clause 17. We will verify your identity before acting, and will respond within 30 days. There is no charge for a reasonable request. If we refuse a request in whole or in part, we will tell you why in writing and explain how to complain.
Requests about your clients’ data should be directed to you, not to us, you hold the relationship with those individuals. If a client contacts us directly, we will refer them to you and let you know.
14. Children
The Platform is a professional tool and is not directed at, or available to, anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.
15. Third-Party Links
The Website may contain links to third-party sites, including video hosting and association websites. We are not responsible for their content or privacy practices. Review their policies before providing information to them.
16. Complaints
If you believe we have mishandled your personal information, contact us first using the details in clause 17. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you may escalate to:
- Australia — Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, 1300 363 992
- United Kingdom — Information Commissioner’s Office (ICO), www.ico.org.uk
- European Union — your local supervisory authority
- Singapore — Personal Data Protection Commission (PDPC), www.pdpc.gov.sg
17. Changes to This Policy
We may update this Policy from time to time. The effective date at the top of the page shows when it was last revised. Where changes are material, we will notify account holders by email before they take effect. Continued use of the Website after that date means you accept the updated Policy.
18. Contact
For questions, access requests, or complaints regarding this Privacy Policy:
Feng Shui Today / FST Feng Shui Tools A service of Shantallow Partners Pty Ltd and Laguna Media Email: privacy contact email Post: P.O.Box 1388, Noosa Heads, Queensland 4567 Australia Web: www.tools.fengshuitoday.com