Wu & Bishop Consultancy · Last updated 24 October 2026
1. The short version
This page explains what happens to your information when you use Wu & Bishop Consultancy. We tried to write it so you can actually read it.
- To use the courses you make an account. That means we store your email, a name you pick, your progress, and your practice portfolio. If you sign up for the weekly tip email, we store that email address too.
- If you switch on the Weekly Challenge in Twenty Years, other players see your score, rank and tier. Your row says "Unlisted player" unless you choose to show a game handle we make up for you. Never your email or the name you gave us.
- We run no ads, no analytics and no tracking pixels. We do not sell or rent your data.
- Your card details never reach us. Stripe handles payments.
- Your account data sits in a database run by Supabase, on servers in the United States — not in Australia.
- Loading this page tells a few other companies your IP address. Google is no longer one of them — the typeface is served from inside the page now, and Google only hears about you if you press play on the video. The full list is below.
- You need to be at least 13 to have an account. If you are under 18, talk to a parent or guardian before you pay for anything.
- You can ask us to show you your data, fix it, or delete it. Email wu.bishconsultancy@gmail.com.
We have tried to write this to line up with the Australian Privacy Principles and, for visitors in Europe and the UK, the GDPR. We are not lawyers, this page is not legal advice, and we are not claiming we have got every rule right — it is a plain description of what actually happens. If you spot something wrong, tell us and we will fix it.
2. Who runs this site
Wu & Bishop Consultancy is run by two high-school students in Victoria, Australia. We are not a company with a legal department. We are two people who built a website to teach other students how investing works.
The two of us are the people responsible for what happens to your data — the "data controller", if you have run into that phrase. You can reach us at wu.bishconsultancy@gmail.com. We do not have a data protection officer, and we do not have a representative in the EU or the UK.
Being small matters for two reasons. First, we deliberately collect as little as we can — every extra field is one more thing to lose. Second, we are not professionals, so read the security section below and judge for yourself.
This site is not a bank, a broker, or a financial adviser. The practice market uses fake money. We never hold your real money, we never see your bank or share trading accounts, and we will never ask you for them.
3. What we collect, and why
When you make an account, we store:
- Your email address — so you can log in, and so we can reach you about your account.
- The name you type into "what should we call you?" — used to greet you in the app. It does not have to be your real name, and we would rather it was not.
- A referral code that we generate for you.
- The date and time your account was created.
- Your password, which goes to Supabase and is kept by Supabase as a hash. There is a section on this below.
As you use the site, we store one block of data attached to your account. It holds:
- Which course you chose, and how far through each lesson you are — so you can pick up where you left off.
- Your daily streak, including the list of dates you visited the site — that is how the streak counter works.
- Whether you dismissed the upgrade message — so we stop showing it to you.
- Your practice portfolio: the weekly deposit amount you picked, your pretend cash balance, what you "hold", and a log of your practice trades. All of it is fake money.
- A star rating and written review, if you choose to leave one.
- When we asked your age, and whether the answer was under 18. Two fields, set once at sign-up. Not your date of birth — see section 11.
If you sign up for the weekly tip email in the box at the bottom of the homepage, or the one on the coming-soon page, we store the address you typed and the time you typed it, in the same database as everything else. That is all it holds. Nothing else about you is attached to it, and you do not need an account.
If you subscribe, we store a record of the subscription — which plan, when it started, and what it costs. Stripe handles the payments themselves, including each monthly charge, and keeps its own records.
If you leave a review, it stays attached to your account. We will not publish it on the site, or anywhere else, unless we ask you first and you say yes.
If you switch on the Weekly Challenge, we also store the following. We keep your moves so our server can work out your score itself — otherwise anyone could type in a fake one.
- Your player record: your game handle (and any earlier ones, so a report always reaches the right person), when you last changed it, whether you chose to show it, whether we have hidden it or taken you out of ranked play, when you left ranked play (if you did), which version of the ranked rules you agreed to and when, and when you first switched the challenge on.
- Each week you play: the week and the season; what you bought and sold each simulated year (in pretend dollars); when you locked each year and when you last locked; your net worth at the end of each year (the “Median player” and “Middle half” bands on the result chart are worked out from every finished game, and other players never see your own line); your score and its parts; your final amount and the computer player’s; how many trades you made; how much of your money sat in one company at its peak; how many years we held for you if the week closed before you finished; a summary of your choices (for example, whether you switched to the low-cost fund), used to show players how the whole field did, and a short code for each company trade you made (year, company and amount), which our server uses to check whether two players made the same trades; whether the game is still playing, finished, ran out of time or was voided; whether it was a staff game; which version of the game it was played on; how many years you locked; and when you started and finished it.
- Flags: our server may flag a game for us to look at (for example, if years were locked unusually fast). We store the kind of flag, the numbers behind it (how long you took between locks, how closely your moves lined up with the next year's results, or how many of your company trades matched another game's that week), whether it is open, cleared or acted on, which game it was about, and when it was raised. We don't store which other game a match was with. A person looks at every flag and nothing happens automatically.
- Reports: if someone reports a player, we store which player, the handle they had then, which of three fixed reasons, the week, who sent it (we never tell the player), whether it is open, dismissed or acted on, and when it was sent and dealt with.
- Our decisions: whenever one of us changes something for a player (a new handle, hiding or unhiding a handle, voiding a result, taking someone out of ranked play or putting them back, or closing a report or a flag, including when the player asked us to), we keep a note of what we did, to which player, which game, report or flag it was about (if any), which of us decided, why we did it (words we type, which can include a private note), and when we decided and emailed them.
Other players see only your score, rank and tier (the band your score falls in), plus your handle if you chose to show it. Solo games are not stored in our database.
That is everything we put in our database. It is not the same as everything anyone can see: the companies that host and serve this site keep their own server logs, which include your IP address. Those are listed in their own section below.
Other than the month and year at sign-up described in section 11 — which is checked and discarded, never stored — we do not ask for your real name, address, phone number, date of birth, school or photo. We do not connect to any real bank, broker or trading account, and we never see your real balances or real trades. The only money-shaped number we hold is the weekly deposit figure you type into the practice market — a made-up number for a made-up portfolio, though if you set it to what you actually save, treat it as something you have told us.
4. What we do not do
- No analytics. We do not use Google Analytics, or Plausible, or anything like it, and there is no tracking script on the page. To be straight about it, that does not make us blind: we can see the things listed above — your lesson progress, the dates your streak counter recorded, your practice trades and, if you switch on the Weekly Challenge, your moves and when you locked each year — and our providers keep their own server logs. What we do not have is an analytics product watching how you move around.
- No advertising. No ad networks, no tracking pixels, no fingerprinting scripts.
- No session recording. Nothing on this site records your screen, your mouse, your scrolling or your keystrokes. There is no Hotjar, FullStory, LogRocket, Clarity or anything like them, and there never has been. What you type into a form reaches us only when you press the button that sends it, and only the fields that button sends — a password you type and delete, a half-written review you think better of, and a figure you put into a lesson tool are never transmitted at all. Since this is the kind of promise a site can break by accident, we have also made it structural: the page ships a Content Security Policy that lists the only places the browser is allowed to send anything, so a recorder added by mistake, or slipped in through a compromised library, would have nowhere to send what it captured.
- We do not sell, rent or trade your personal information, and we do not "share" it for cross-context behavioural advertising, which is the phrase some US state laws use. We never have, and nobody has ever offered. If that ever changed we would tell you first and it would be opt-in.
- No marketing partners. We do not hand your data to other businesses for their own purposes. The companies listed further down — Supabase, Stripe, Netlify and the rest — are service providers: they handle data on our behalf so the site works. That is a different thing, and it is the only kind of sharing that happens in normal operation. The narrow situations where anyone else could get your data have their own section below.
- No marketing emails you did not ask for. There are two lists, and they are separate on purpose: the weekly tip email, and the course waiting list, which exists only to tell you once that the courses have opened. Joining one does not put you on the other — the waiting list has its own tick box for the weekly email, and it starts unticked. The only way onto either is typing your address in yourself. Every email we send will carry a working one-click unsubscribe link and our postal address, you can leave from the Unsubscribe link in the footer of this site without needing an email in front of you, and replying to ask also works. Neither list has started sending yet.
The only emails you should get from us are account emails — confirming your email address, and a password-reset link if you have asked us for one — which are sent through Supabase's email service. The only other reason we would email you is something important about your account, a security problem, or a big change to this policy.
5. Passwords and payments
Passwords. Supabase Auth handles logins. When you sign up or log in, your password travels over an encrypted connection to Supabase, which stores it as a hash — scrambled in a way that cannot practically be turned back into your password. It is never stored in readable form, and we cannot see it or look it up. If you forget it, email us from the address on your account and we will help you get back in — there is no self-service reset yet.
Payments. If you subscribe to a course, Stripe runs the checkout and the recurring billing. Your card number, expiry date and security code go straight to Stripe. They never touch this site or our database, and we never see them — including on renewals, which Stripe charges without us ever handling the card.
Because a subscription carries on over time, what we hold is a little more than a one-off sale would be: which plan you are on, when it started, whether it is currently active, when the next payment is due, and if and when you cancelled. We use it for exactly one thing — deciding whether to unlock your lessons. We do not hold a payment history; that lives with Stripe, and you can ask them or us for a receipt at any time.
Stripe keeps its own record of the payment under its own privacy policy. Stripe also collects information about your device and how you interact with its checkout in order to detect fraud — that is Stripe's collection rather than ours, and it is described in Stripe's policy.
If you are under 18, read the under-18 section before you pay for anything.
6. Where your data is stored, including outside Australia
Your account data lives in a database hosted by Supabase. Our project sits in a United States region. It is not in Australia.
So your email address, display name, streak, progress, sale record, practice portfolio and, if you switch on the Weekly Challenge, your game results leave Australia and are stored overseas. Data on US servers is subject to US law, which is different from Australian law, and in some situations US authorities can require access to data held there. We are telling you this plainly so you can decide.
The other companies below are outside Australia too. Stripe and Netlify are US companies. Google, our market-data provider and jsDelivr also operate overseas, and content delivery networks in particular serve files from whichever of their servers is nearest you, which could be almost anywhere.
Australian privacy law asks us to take reasonable steps to make sure an overseas recipient handles your information properly. Here is what that actually amounts to for us: we use established providers rather than obscure ones, we accept their published data processing terms, we turn on the security settings they offer, and we keep the amount of data we send them small. We are not in a position to audit any of them, and we are not going to imply otherwise.
If we ever move the database to a different region, we will update this page. If storing your data overseas is not acceptable to you, please do not create an account — you can read the whole site without one.
7. Every other company your browser talks to
When you open this site, your browser has to fetch files from other companies. Any company your browser asks for a file can see your IP address (a rough indicator of where you are), the time, and basic information about your browser. That happens automatically, whether or not you have an account. Here is the complete list and what each one gets.
- Netlify — hosts the site. It serves the pages to you, so it sees your IP address and which pages you asked for, and it keeps its own server logs.
- Supabase — handles accounts, the database, some server-side functions, and account emails. It receives your email address, your password (which it stores as a hash), everything listed in "What we collect", and your IP address whenever your browser talks to it.
- Stripe — handles payments. It receives your card and payment details, plus information about your device for fraud checks, but only if you actually start a checkout. If you never buy anything, Stripe never gets your details. The checkout is closed at the moment, so this cannot happen at all.
- Our market-data provider — supplies the ASX share prices and the price charts in the practice market. Your browser never talks to it: it asks a server of ours, and that server asks the provider. So the provider sees our server and the ASX codes requested, and it does not see your IP address, your name, your email or your account.
- Google Fonts — no longer used. The site used to download its typeface (Inter) from fonts.googleapis.com and fonts.gstatic.com, which told Google your IP address on every single page load whether or not you had a Google account. This page said we were going to stop, and we have: the font now travels inside the page itself, so nothing is fetched from Google to draw it and Google is told nothing. The only remaining way Google hears about you here is if you press play on the video, which is the next item.
- jsDelivr — a free code delivery network. Your browser downloads the Supabase JavaScript library from it, so jsDelivr sees your IP address too.
- YouTube (Google) — hosts our introduction video. Nothing is sent to YouTube unless you press play. The picture you see before that is an image file served from our own site, so simply loading the homepage tells Google nothing. If you do press play, the video player loads from youtube-nocookie.com and from that moment YouTube can see your IP address, that you watched this video, and — if you happen to be signed in to a Google account in the same browser — it can connect the view to that account. We use the no-cookie version of the player, which avoids tracking cookies for advertising, but it does not make the connection private. If you would rather Google knew nothing at all, don't press play.
Each of these companies has its own privacy policy and its own server logs, which we cannot see or control. We do not send them anything beyond what is described here. Things do come back to us, but only what the site needs to work: your own account data from Supabase, confirmation from Stripe that you paid and for what, and share prices from our market-data provider. None of them tell us anything about you from anywhere else, and none of them build us a picture of you.
8. Cookies and localStorage
The long version of this section, including how to clear everything and what breaks if you do, is our Cookies Policy. The short version: we do not show a cookie banner because we do not use advertising or analytics cookies. The only browser storage on this site is what is needed to keep you logged in and to remember your settings. Here is all of it.
- Login session. Supabase Auth stores a session token in your browser so you stay logged in between pages. Without it you would have to log in constantly. Logging out clears it.
- localStorage: theme. We save whether you picked light or dark mode, under
wbTheme. - localStorage: price cache. We save the day's share prices, the price charts and a note of which codes had no data that day, so the site does not have to re-ask our market-data provider every time you open a page.
- localStorage: lesson tools. The figures you type into the budget, "find the money", emergency-fund, super-option, portfolio-split and ten-year-plan tools inside the lessons are saved on your own device so they are still there next time. They never leave your browser and we do not see them.
- localStorage: your solo games. One key,
wbGame:runs, holding a short summary of your last 60 Twenty Years solo games (final amount, the computer player’s, your score, how concentrated you got and when you played), plus the game you’re in the middle of (its random seed, your moves and when you started it) so you can carry on later. It never leaves your browser. Weekly Challenge games are not stored here. - sessionStorage: the age check. If the sign-up form stops someone under 13, we note that in this tab (
wbAgeGate) until it is closed, so the form doesn’t simply reopen. It never leaves your browser. - sessionStorage: a friend’s referral code. If you arrive on an invite link we hold the code until you close the tab, so it can be filled in for you at the checkout. Nothing is sent anywhere until you apply it.
The theme, the price cache, the lesson-tool figures, your solo-game history and the age-check note sit on your own device and we do not send any of them to our database or to anyone else. If you go through a Stripe checkout, Stripe sets its own storage on its own pages for fraud prevention — that one is covered by Stripe's policy, not this page. Clearing your browser's site data removes everything on our side; the theme, the prices, the lesson-tool figures and your solo-game history just reset.
9. How long we keep your data
Straight answer: we keep your account data for as long as your account exists. We do not currently delete inactive accounts automatically, which means data can sit there long after someone has stopped using the site. If you are done with us, ask and we will delete it.
If you ask us to delete your account, we will delete your database record and your login. We aim to do that within 30 days of your request. Supabase takes routine backups of the database, so a copy of your data may remain inside a backup for a while afterwards before it is overwritten — we cannot reach into a backup and pull out one person's record. Backups are not used for anything except restoring the site after a failure.
Two things survive deletion:
- Stripe keeps its own record of any payment you made. That is Stripe's record, not ours, and we cannot delete it.
- We keep a plain record that a purchase happened — what was bought, when, and for how much — because Australian tax rules generally require business records to be kept for around five years. That record does not need your progress, streak or practice portfolio, so all of that still goes.
Anything stored in your own browser (theme, cached prices, lesson-tool figures, solo-game history, login session) is yours to clear whenever you want.
Weekly Challenge results stay until about 12 months after each game finished (or, if it never finished, after it started). We clear them in batches, so it can take a little longer. After that:
- Games. We clear your moves, when you locked each year and when you last locked, your net worth for each year, your score’s parts, the summary of your choices and the code for each company trade, your final amount and the computer player’s, how many trades you made, how concentrated you got and how many years were held for you. What stays is your score, the week and season, which version of the game it was played on, how many years you locked, whether it finished, ran out of time or was voided, whether it was a staff game, and when you started and finished it.
- Flags. When we clear a game, we clear the details of any flag about it, and close any that is still open as cleared. What stays is its kind, whether it was cleared or acted on, which game it was about, and when it was raised.
- Reports. 12 months after a report is dealt with, we clear who sent it and the handle the player had then. What stays is which player it was about, the week, which of the three fixed reasons, whether it was dismissed or acted on, and when it was sent and dealt with.
- Our notes on decisions. 12 months after a decision, we clear the reason we wrote down. What stays is what we did and which game, report or flag it was about, which player it was about, which of us decided, and when we decided and emailed them.
Switch ranked play off and you leave the leaderboards straight away. Delete your account and your results, the reports about you and our notes about you go with it; if you reported someone and then delete your account, the report stays but no longer says who sent it.
10. When we would hand your data over, and what happens if we stop
Beyond the service providers listed above, there are only a few situations where anyone else would get your information. We would rather set them out than leave you guessing.
- If the law requires it. A court order, a warrant, or a lawful demand from a regulator. We would comply, and unless we were forbidden from telling you, we would tell you.
- If someone were in serious danger. If we genuinely believed someone was at risk of serious harm, we would pass on what was needed to the right people. We do not expect this to ever come up on a site about compound interest, but we are not going to write a rule we would break.
- If the site changes hands. If we ever handed this site to someone else, accounts would go with it. We would email everyone with an account before that happened, so you could delete yours first if you wanted to.
We are high-school students, and at some point we will finish school. If we decide to shut the site down, we will give notice by email and on the site, give you a chance to download your data, and then delete the database — rather than leave it sitting on a server nobody is watching.
11. If you are under 18
Most people using this site are high-school students, and plenty are under 18. So are we.
You need to be at least 13 to create an account. If you are under 13, please do not sign up. In the United States a law called COPPA says sites cannot collect information from under-13s without a parent's verified consent, and we have not built a way to do that — so the answer is simply 13 and over. If you are under 13 and want to learn from the site, ask a parent or guardian to email wu.bishconsultancy@gmail.com. If we find out an account belongs to someone under 13, we will delete the account and the data attached to it, at no cost and without arguing about it.
If you are in the EU, the UK, or somewhere with its own rule, the minimum age for agreeing to have your data handled online can be higher — depending on the country it is 13, 14, 15 or 16. If you are under that age where you live, get a parent or guardian's permission before making an account and ask them to email us so we have it on record. If we learn that an account belongs to someone under that age with no parent's permission behind it, we will delete it. This is a description of how we handle it, not legal advice about your country's rules.
What we actually ask, and what we keep. The sign-up form asks for the month and year you were born — not the day, and not your date of birth as a record. The answer is used once, in your own browser, to work out whether you are old enough. Then it is thrown away. What reaches our database is two things: the date and time we asked, and a single true/false for whether the answer was under 18. We keep the second one because somebody under 18 should not be walked into a recurring card charge without a parent knowing, and the checkout needs to know to say so.
Being honest about the limits: this is an age screen, not age verification. Anyone who wants to can put in a different year. It is deliberately laid out so it does not teach you which year to pick — it asks before it says anything about a minimum — and if an answer comes back under 13 we stop there and remember the refusal for the rest of that browser tab. That is a speed bump, not a lock, and we would rather say so than imply we can check. We are still relying on you telling the truth, and on parents and guardians contacting us if something is wrong. That is a large part of why we keep so little — there is not much here to get wrong.
Parents and guardians: email wu.bishconsultancy@gmail.com and you can ask what we hold about your child, have it corrected, get a copy of it, or have the account and its data deleted. We will ask a couple of questions to check the account really is your child's — that is to stop a stranger doing the same thing — and then do it. You do not have to give a reason, and there is no charge.
Before you pay for anything, talk to a parent or guardian. If you are under 18 you should not be putting a card into a checkout page without them knowing. If someone under 18 has bought a course without a parent knowing, email us and we will refund it.
One deliberate design choice: we do not ask for your real name, school, address, photo, phone number, full date of birth, or anything about your real money. The "what should we call you?" box does not need your real name — a nickname is completely fine, and honestly we would prefer it.
In Twenty Years, the Weekly Challenge starts switched off for everyone, and showing a handle is a separate choice that also starts off. Handles come from our own word list, so a handle can never be your real name. There is no chat, no messages and no friend list — no other player can contact you through the game. If you're under 18, we suggest a quick chat with a parent or guardian before switching it on.
12. Your rights, and how to use them
Wherever you live, you can ask us to:
- Show you everything we hold about you.
- Correct anything that is wrong — including your display name or email.
- Take you off the weekly tip email, and delete the address we hold for it.
- Delete your account and the data attached to it. The sale record described above is the one exception, and it stays on its own without the rest.
- Send you a copy of your data in a file you can keep.
You can also use the site without telling us your real name — the display name is yours to choose. We do need a working email address, because that is how logging in works.
How to do it: email wu.bishconsultancy@gmail.com from the address on your account and tell us what you want. If you email from a different address, we will have to ask you some questions first — otherwise anyone could write in and ask for your data.
We aim to reply within 7 days and to finish within 30 days. There is no charge. If something is going to take longer than 30 days, we will tell you why before the 30 days is up.
If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles apply, and the Office of the Australian Information Commissioner (OAIC) is the regulator; we treat everyone the same way wherever they live.
If you think we have mishandled your information, tell us first and give us a chance to fix it. If you are in Australia and you are not satisfied with how we deal with it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
13. Extra rights if you are in the EU or the UK
If you are in the EU or the UK, the GDPR gives you rights on top of the ones above: access, correction, erasure, restricting how we use your data, portability (a copy in a usable format), objecting to processing, and withdrawing consent at any time.
The legal bases we rely on:
- Performing a contract — your email, display name, course choice, lesson progress, practice portfolio and, if you switch on the Weekly Challenge, your handle, moves and scores. We need these to give you the account and the course you asked for, and to run the challenge you joined.
- Legitimate interests — keeping the site working and secure, preventing abuse, keeping an accurate record of sales, and keeping the Weekly Challenge fair — the lock times, the flags our server raises, and reports other players send. Our tax obligations are Australian rather than European, so for people in Europe we point at this basis for the sale record rather than at "legal obligation".
- Consent — the optional star rating and written review, and showing your Twenty Years handle on leaderboards. You can withdraw the review at any time and we will delete it; untick "Show my handle" or leave ranked play to withdraw the handle.
Giving us an email address is a requirement of having an account; without it we cannot create one. Everything else is either optional or generated as you use the site.
Transfers out of Europe. Your data goes to servers in the United States through Supabase, and Stripe, Netlify, Google, our market-data provider and jsDelivr all operate outside Europe. We rely on the standard contractual clauses in those companies' published data processing terms. We have not carried out our own transfer risk assessment on top of that, and we would rather say so than imply a level of diligence we have not done.
We do not make automated decisions about you that produce legal or similarly significant effects, and we do not build advertising or behavioural profiles.
We are based in Australia and we do not have a representative in the EU or the UK. You can complain to the data protection authority in your country. In the UK that is the Information Commissioner's Office at ico.org.uk.
14. If you are in the United States
Several US states — California among them, and a growing list of others — give residents their own privacy rights. Rather than work out which state you are in, we offer the same things to everyone: email us and we will show you what we hold, correct it, give you a copy, or delete it. There is no charge, and we will not treat you any differently for asking.
In the language those laws use, for the record: we do not sell personal information, we do not share it for cross-context behavioural advertising, we do not use it for targeted advertising, and we do not profile in a way that produces legal or similarly significant effects. We do not knowingly collect anything from a child under 13 — see the under-18 section.
15. Security, honestly
What we actually do:
- The site is served over an encrypted connection (https).
- Passwords are hashed by Supabase Auth. We never see them.
- Card details never reach us — they go straight to Stripe.
- The two of us are the only people with a login to the database, and we deliberately keep the amount of data we collect small. Supabase runs the servers, so Supabase's own systems and staff can reach the infrastructure the database sits on — that is true of any hosted database, and it is worth you knowing.
What we are not going to pretend:
- We are high-school students, not security engineers. We have had no security audit and we hold no certification. If you ever see "bank-level security" written about this site, it did not come from us.
- No system is perfectly secure. A bug in our code, a mistake by us, or a breach at Supabase, Stripe, Netlify, jsDelivr or our market-data provider could expose data. We cannot promise that will never happen.
- One weakness we used to list here has been fixed: our market-data key used to be visible in the page's code. It now lives only on a server of ours and never reaches your browser. The old key was public for a while, so we are treating it as compromised and replacing it. It only ever fetched public share prices — it could not reach your account, your data, your password or any money.
Two things you can do: use a password you do not use anywhere else, and do not type anything into this site that you would be upset to see leaked.
If there is a data breach that affects you, we will email the address on your account and put a notice on the site as soon as we understand what happened. Where the rules require it, we will report it to the Office of the Australian Information Commissioner, and for anyone affected in the EU or the UK, to the relevant data protection authority within the time limits those rules set.
16. Changes to this policy
If what the site does with data changes, this page changes. The "last updated" date at the top tells you when it last did.
For small things — clearer wording, a corrected detail, a typo — we just update the page and the date.
For anything that actually changes what happens to your data — a new company receiving your information, a new type of data collected, a new use for data we already have — we will put a visible notice on the site and email people with accounts, before the change takes effect or as soon as it does. We are not going to rewrite this page quietly.
17. Contact us
Email wu.bishconsultancy@gmail.com. It reaches the two of us and nobody else — though like any email, it lands in an inbox held by an email provider, which is one more company that ends up holding whatever you send us.
Use it to: see your data, correct it, delete your account, ask a question as a parent or guardian, report a security problem you have spotted, or tell us that something on this page is wrong, unclear or out of date.
If we have got something wrong, tell us. We will fix it and update this page.