1. Introduction
The Grand Plan ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal information when you use our website thegrandplan.com.au, The Grand Plan app at my.thegrandplan.com.au, and related services.
2. Information We Collect
Information You Provide
- Email address — when you take the free assessment, create a Grand Plan account, buy a Season Pass, or subscribe to our emails
- Payment information — processed securely by Stripe (we do not store card details)
- Shipping address — only for physical orders placed in our former shop before October 2026
Information Collected Automatically
- Analytics data — only if you accept cookies, Google Analytics 4 records how visitors use our site (page views, referral sources, device information)
- Advertising measurement data — only if you accept cookies, the Meta (Facebook) pixel records page views and actions such as completing the assessment, so we can measure and improve our Facebook and Instagram ads
- Technical data — IP address, browser type, and operating system, collected automatically by our web server
3. How We Use Your Information
- To provide your free Leak Report, your Grand Plan account and your Season Pass
- To process payments, refunds and claims under The Mulligan Guarantee and The Break-90 Promise
- To fulfil and support orders placed in our former shop before October 2026
- To send account and payment emails, including the reminder 7 days before a Season Pass renews
- To send marketing emails if you have subscribed (you can unsubscribe at any time)
- To understand how our site is used and measure our ads, if you have accepted cookies
- To prevent fraud and ensure secure transactions
4. Third-Party Services
We use the following third-party services to operate our business:
- Stripe — payment processing. Stripe's privacy policy applies to payment data. stripe.com/privacy
- Postmark and Mailgun — transactional and marketing email delivery
- Google Analytics 4 (Google) — website analytics, only after you accept cookies. Google Privacy Policy
- Meta pixel (Meta Platforms) — ad measurement for Facebook and Instagram, only after you accept cookies. Meta may combine this with information it already holds about you, under its own policy. Meta Privacy Policy
We do not sell, trade, or rent your personal information to third parties.
5. Cookies, Consent & Local Storage
When you first visit, a banner asks whether you accept cookies for analytics and ad measurement. Until you click Accept, neither Google Analytics cookies nor the Meta pixel are loaded. If you click Decline, they stay off.
- Google Analytics cookies (e.g.
_ga) — measure how the site is used. Set only after you accept. - Meta pixel cookies (e.g.
_fbp) — measure which Facebook and Instagram ads lead to visits, assessments and sign-ups, and let Meta show our ads to people who visited the site. Set only after you accept. - localStorage — we store your cookie choice (
tgp_consent) in your browser so we don't ask again on every page.
Changing your mind
You can withdraw or change your choice at any time: change cookie settings. This clears your saved choice, stops analytics and ad measurement, and shows the banner again. You can also clear cookies and site data in your browser, use the Google Analytics Opt-out Browser Add-on, or manage ad preferences in your Meta Accounts Center.
6. Data Retention
- Account, subscription and order records are retained for as long as your account is active and as required for accounting and legal purposes
- Email subscriptions are retained until you unsubscribe
- Analytics data is retained per Google Analytics retention settings (14 months)
- Meta pixel data is retained by Meta under its own policy
7. Your Rights
You have the right to:
- Request access to the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Unsubscribe from marketing communications at any time
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)
To exercise any of these rights, contact us at ricky@thegrandplan.com.au.
8. Data Security
We take reasonable measures to protect your personal information, including:
- HTTPS encryption on all pages
- Stripe PCI-compliant payment processing (no card data stored on our servers)
- Restricted access to personal data on a need-to-know basis
No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
9. Australian Privacy Principles
We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). If you believe we have breached an APP, you may lodge a complaint with us or with the OAIC at oaic.gov.au.
10. Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated "last updated" date. We encourage you to review this policy periodically.
11. Contact
For questions about this privacy policy or your personal data, contact us at ricky@thegrandplan.com.au.