1. Introduction
The Grand Plan ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal information when you use our website thegrandplan.com.au, The Grand Plan app at my.thegrandplan.com.au, and related services.
2. Information We Collect
Information You Provide
- Email address — when you take the free assessment, create a Grand Plan account, buy a Season Pass, or subscribe to our emails
- Payment information — processed securely by Stripe (we do not store card details)
- Shipping address — only for physical orders placed in our former shop before October 2026
Information Collected Automatically
- Analytics data — only if you accept cookies, Google Analytics 4 records how visitors use our site (page views, referral sources, device information)
- Advertising measurement data (browser) — only if you accept cookies, the Meta (Facebook) pixel records page views and actions such as completing the assessment, so we can measure and improve our Facebook and Instagram ads
- Advertising measurement data (our server) — unless you press Decline, when you take the assessment, create an account, finish onboarding, or buy a Season Pass, our server sends Meta the event together with a one-way scrambled (hashed) copy of your email address, first and last name, country and member number, your IP address and browser details, and the Meta cookie identifiers (
_fbp,_fbc) if you have them. At sign-up we save the Meta cookie identifiers, your IP address and your browser details against your account so a later purchase can be matched to the ad that led to it - Technical data — IP address, browser type, and operating system, collected automatically by our web server
3. How We Use Your Information
- To provide your free Leak Report, your Grand Plan account and your Season Pass
- To process payments, refunds and claims under The Mulligan Guarantee and The Break-90 Promise
- To fulfil and support orders placed in our former shop before October 2026
- To send account and payment emails, including the reminder 7 days before a Season Pass renews
- To send marketing emails if you have subscribed (you can unsubscribe at any time)
- To understand how our site is used and measure our ads (analytics and browser cookies only if you have accepted; server-side ad measurement unless you have pressed Decline)
- To prevent fraud and ensure secure transactions
4. Third-Party Services
We use the following third-party services to operate our business:
- Stripe — payment processing. Stripe's privacy policy applies to payment data. stripe.com/privacy
- Postmark and Mailgun — transactional and marketing email delivery
- Google Analytics 4 (Google) — website analytics, only after you accept cookies. Google Privacy Policy
- Meta pixel and Conversions API (Meta Platforms) — ad measurement for Facebook and Instagram. The browser pixel runs only after you accept cookies; the server events described above are sent unless you press Decline. Meta processes this data in the United States and other countries outside Australia, so your information is transferred overseas. Meta may combine it with information it already holds about you, under its own policy. Meta Privacy Policy
We do not sell, trade, or rent your personal information to third parties.
5. Cookies, Consent & Local Storage
When you first visit, a banner asks whether you accept cookies for analytics and ad measurement. Until you click Accept, neither Google Analytics cookies nor the Meta pixel are loaded. If you click Decline, they stay off, and we also stop sending ad measurement events from our server to Meta and delete the Meta identifiers, IP address and browser details we saved at sign-up. If you have not made a choice, server-side ad measurement events described in section 2 are still sent, so press Decline if you do not want that.
- Google Analytics cookies (e.g.
_ga) — measure how the site is used. Set only after you accept. - Meta pixel cookies (e.g.
_fbp) — measure which Facebook and Instagram ads lead to visits, assessments and sign-ups, and let Meta show our ads to people who visited the site. Set only after you accept. - Cookie choice — we store your choice (
tgp_consent) in your browser's localStorage and in a cookie of the same name that lasts 12 months. The cookie is shared by thegrandplan.com.au and my.thegrandplan.com.au, so you are asked once, and so our server can honour a Decline.
Changing your mind
You can withdraw or change your choice at any time: change cookie settings. If you had accepted, this records Decline: it stops analytics and ad measurement, including the server events sent to Meta. If you had declined, it shows the banner again so you can accept. You can also clear cookies and site data in your browser, use the Google Analytics Opt-out Browser Add-on, or manage ad preferences in your Meta Accounts Center.
6. Data Retention
- Account, subscription and order records are retained for as long as your account is active and as required for accounting and legal purposes
- Email subscriptions are retained until you unsubscribe
- Analytics data is retained per Google Analytics retention settings (14 months)
- Meta pixel and server event data is retained by Meta under its own policy
- Sign-up IP address, browser details and Meta cookie identifiers saved against your account are kept while your account is active, and deleted if you press Decline or ask us to delete your account
7. Your Rights
You have the right to:
- Request access to the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Unsubscribe from marketing communications at any time
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)
To exercise any of these rights, contact us at ricky@thegrandplan.com.au.
8. Data Security
We take reasonable measures to protect your personal information, including:
- HTTPS encryption on all pages
- Stripe PCI-compliant payment processing (no card data stored on our servers)
- Restricted access to personal data on a need-to-know basis
No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
9. Australian Privacy Principles
We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). If you believe we have breached an APP, you may lodge a complaint with us or with the OAIC at oaic.gov.au.
10. Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated "last updated" date. We encourage you to review this policy periodically.
11. Contact
For questions about this privacy policy or your personal data, contact us at ricky@thegrandplan.com.au.