Privacy Policy

Ellie Holdings Pty Ltd (ABN 11 672 103 310), doing business as InnerSteps

This privacy policy describes how Ellie Holdings Pty Ltd (doing business as InnerSteps) ("we", "us", or "our") collects, stores, uses, and shares ("processes") your information when you use our services ("Services"), such as when you:

• download and use our mobile application (InnerSteps), or any other application of ours that links to this privacy policy;
• visit our website at innersteps.org, or any website of ours that links to this privacy policy; or
• engage with us in other related ways, including any sales, marketing, or events.

InnerSteps is designed for families. Accounts are created and managed by a parent or guardian, and children use the app under their parent or guardian's supervision and consent. We take our responsibilities around children's information seriously, and we deliberately collect as little information about children as possible.

Questions or concerns? Reading this privacy policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have any questions, contact us at info@innersteps.org.

SUMMARY OF KEY POINTS

What personal information do we process? We collect account information from the parent or guardian (such as your name, email address and login details), your child's first name, the setup preferences you choose for your child, your time zone, purchase records, and technical and usage information about how the app is used. We explain this in detail below.

Do we collect sensitive information? We do not ask for or collect medical, diagnostic, or health-record information about you or your child. During setup we do ask the parent or guardian to tell us which everyday situations their child finds difficult (for example, school mornings, or being apart from a parent), so that we can tailor the program. We treat these responses carefully, we do not use them for advertising, and we never share them with advertising partners.

Do we collect information about children? Only the minimum needed to run the app: a first name (so stories and the app can address your child) and in-app activity (such as which stories and games have been completed). We do not collect a child's surname, birthday, gender, contact details, photos, or precise location. Parents can review or delete their child's information at any time by contacting us.

How do we process your information? To provide and improve the Services, manage accounts and purchases, communicate with you, keep the Services secure, and comply with law.

Does the app track users? No. The InnerSteps app contains no advertising software, no attribution software, and no third-party analytics software. We do not link information collected in the app with third-party data for advertising purposes, and we do not share it with data brokers. We do use advertising measurement tools on our website, as described in Section 4.

Do we sell personal information? No. We do not sell personal information, and we never sell or share children's personal information for advertising purposes.

In what situations do we share personal information? With service providers who help us run the Services (such as our hosting and backend providers), with the app stores in connection with purchases, and in connection with a business transfer. Details are below.

How do you exercise your rights? Email us at info@innersteps.org. We will consider and act upon any request in accordance with applicable data protection laws.

TABLE OF CONTENTS

• WHAT INFORMATION DO WE COLLECT?
• CHILDREN'S INFORMATION
• HOW DO WE PROCESS YOUR INFORMATION?
• WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
• HOW LONG DO WE KEEP YOUR INFORMATION?
• HOW DO WE KEEP YOUR INFORMATION SAFE?
• MARKETING COMMUNICATIONS
• WHAT ARE YOUR PRIVACY RIGHTS?
• CONTROLS FOR DO-NOT-TRACK FEATURES
• INTERNATIONAL USERS
• DO WE MAKE UPDATES TO THIS POLICY?
• HOW CAN YOU CONTACT US ABOUT THIS POLICY?
• HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Information you provide to us

We collect personal information that you voluntarily provide to us when you register on the Services, make a purchase, express an interest in obtaining information about us or our products, or otherwise contact us. This may include:

• your name;
• your email address;
• your account login details (such as a password, or authentication tokens where you register using Sign in with Apple or Google sign-in);
• your child's first name (or a nickname you choose for them);
• the setup preferences you choose for your child, such as which everyday situations they find difficult, which skills you would like to focus on, and the time of day that suits your family;
• your contact preferences; and
• the contents of any messages or feedback you send us.

If we introduce features in the future that require additional information, we will explain what is collected and why at the point of collection, and update this policy.

Purchase information

In-app purchases are processed by the Apple App Store or Google Play. We receive confirmation of your purchase (such as the product purchased, purchase receipt, and entitlement status) so we can unlock your content on your account, but we do not collect or store your credit card or payment details.

Information collected automatically

We automatically collect certain information when you use the Services. This information does not directly identify you by name, but may include:

• device and technical information, such as device type, operating system, app version, language preferences, IP address, and general region derived from it;
• your time zone;
• usage information, such as features used, stories and games started and completed, in-app check-ins and activity responses, session times, and progress within the app; and
• diagnostic information, such as error reports and performance data, used to keep the app working properly.

We do not collect precise (GPS) location data.

Push notifications

With your permission, we may send push notifications regarding your account or features of the app. You can turn these off at any time in your device settings.

2. CHILDREN'S INFORMATION

InnerSteps is made for children aged 5-9 to use with the consent and involvement of their parent or guardian. We design our data practices around collecting as little information about children as possible:

• The only information we ask for about a child is a first name (or nickname), which is used so the app and stories can address your child, the setup preferences chosen by their parent or guardian, plus the in-app activity described above (such as progress through stories and games).
• We do not ask children for, or knowingly collect from children, contact details, surnames, birthdays, gender, photos, audio recordings, or precise location.
• We do not serve advertising in the app, and we do not use children's personal information for advertising or marketing of any kind.
• The app contains no advertising, attribution, or third-party analytics software, and no personal information or device information is sent from the app to third-party advertising partners.
• We do not make children's personal information publicly available, and the app has no public sharing, chat, or messaging features.
• We do not condition a child's participation in any activity on the disclosure of more personal information than is reasonably necessary for that activity.

Parents and guardians can review, update, or delete their child's information, or withdraw consent to its collection, at any time by contacting us at info@innersteps.org. If we learn we have collected personal information from a child without appropriate parental consent, we will delete it.

We handle all personal information, including children's information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. For users located in the United States, our practices in relation to children under 13 are intended to be consistent with the principles of the Children's Online Privacy Protection Act (COPPA).

3. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal information for the following purposes:

• To provide the Services. To create and manage your account, personalise the in-app experience with your child's first name and your setup preferences, save progress, and deliver the stories, games and features you use.
• To manage purchases. To confirm and unlock in-app purchases made through the Apple App Store or Google Play.
• To communicate with you. To send administrative information such as account confirmations, changes to our terms and policies, support responses, and service updates.
• To send marketing communications. With your consent or as otherwise permitted by law, to send you emails about our products, features, and updates we think may interest you. You can unsubscribe at any time (see Section 7).
• To improve the Services. To understand how the Services are used, identify usage trends, diagnose problems, and evaluate and improve our products and your experience.
• To keep the Services safe. To maintain security, prevent fraud, and protect our users.
• To comply with our legal obligations. To comply with applicable law, respond to legal requests, and establish or defend legal claims.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We do not sell personal information. We share personal information only in the following situations:

• Service providers. We use trusted third-party providers to operate the Services. These currently include: Supabase (database, authentication and backend infrastructure); RevenueCat (managing purchase receipts and entitlement status); Resend (sending transactional and service emails); Apple and Google (sign-in authentication); and Cloudflare (delivering app content; no personal information is stored there). These providers process information on our behalf and are not permitted to use it for their own purposes. We may change or add providers from time to time; where we do, this policy continues to apply to how your information is handled.
• App stores. The Apple App Store and Google Play process your purchases under their own privacy policies.
• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company, provided the recipient agrees to handle your information consistently with this policy.
• Legal requirements. We may disclose information where required by law, regulation, legal process, or enforceable governmental request, or where necessary to protect our rights, our users, or the public.

Website advertising measurement

We use standard advertising and analytics tools on our website (currently including tools provided by Meta Platforms) to measure how well our advertising to parents is working — for example, how many people who see one of our ads go on to click through and download the app. These tools operate on innersteps.org only.

The InnerSteps app itself contains no advertising software, no attribution software, and no third-party analytics software. No information collected inside the app is shared with advertising partners, and no information about your child is used for advertising of any kind.

5. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep your personal information only for as long as necessary to fulfil the purposes set out in this policy, unless a longer retention period is required or permitted by law (such as for tax, accounting, or other legal requirements). When you delete your account, we will delete or de-identify your personal information, including your child's information, within a reasonable period, except where we are required to retain certain records by law. When we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it, or, if this is not possible, securely store it and isolate it from further processing until deletion is possible.

6. HOW DO WE KEEP YOUR INFORMATION SAFE?

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of the personal information we process. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security. We will comply with our obligations under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth) if an eligible data breach occurs.

7. MARKETING COMMUNICATIONS

If you have opted in, or where otherwise permitted under the Spam Act 2003 (Cth), we may send you marketing emails about InnerSteps products, features, offers, and updates. Every marketing email we send includes a working unsubscribe link, and you can also opt out at any time by emailing info@innersteps.org. We do not send marketing communications to children.

8. WHAT ARE YOUR PRIVACY RIGHTS?

We collect and process your personal information under the obligations and conditions set by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy satisfies the notice requirements of the Privacy Act, including what personal information we collect, from which sources, for which purposes, and the recipients of your personal information.

At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us using the details in Section 12.

If you choose not to provide the personal information necessary for a particular purpose, it may affect our ability to provide the Services, for example our ability to create your account, respond to your requests, or confirm your identity.

Withdrawing your consent. Where we rely on your consent to process your personal information, you may withdraw your consent at any time by contacting us. This will not affect the lawfulness of processing before the withdrawal.

Account information. You can review or change your account information at any time by logging in to your account settings, or by contacting us. Upon a request to delete your account, we will deactivate or delete your account and information from our active databases as described in Section 5.

If you believe we are unlawfully processing your personal information, you have the right to complain to us at info@innersteps.org. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting. No uniform technology standard for recognising and implementing DNT signals has been finalised, and we do not currently respond to DNT browser signals. If a standard is adopted that we must follow in the future, we will inform you in a revised version of this policy.

10. INTERNATIONAL USERS

Our Services are operated from Australia and are intended for users in Australia. However, your information is stored and processed on infrastructure operated by our service providers overseas. In particular, our primary database and authentication provider stores information in Japan (Asia-Pacific region), and some of our other service providers (including our email and purchase management providers) process information in the United States and other locations where they operate. Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

11. DO WE MAKE UPDATES TO THIS POLICY?

Yes, we will update this policy as necessary to stay compliant with relevant laws and to reflect changes to our practices. The updated version will be indicated by an updated "Last updated" date. If we make material changes, including any material change to how we handle children's personal information, we will notify you by prominently posting a notice or by sending you a notification, and where required by law we will seek consent before applying new practices to previously collected information.

12. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or comments about this policy, you may email us at info@innersteps.org or contact us by post at:

Ellie Holdings Pty Ltd (ABN 11 672 103 310)
8 Byrne Avenue
South Coogee, New South Wales 2034
Australia

13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you (or from your child), change that information, or delete it. To make a request, email us at info@innersteps.org and we will respond in accordance with applicable data protection laws.