PRIVACY POLICY.
Last updated: September 2026 · Sydney, New South Wales, Australia.
1. Who we are
NINEBASE is operated by Harrison Goddard, based in Sydney, New South Wales, Australia. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. For anything on this page, email hello@ninebase.au.
2. What we collect and why
Account details (name, email, password hash) so you can sign in and we can support you. Purchase details (product, amount, date, Stripe reference) so we can give you access and keep tax records. Coaching data (session bookings, film review uploads, coach notes, watch history, quiz and skill assessment answers) so coaching can actually be delivered and tracked. Contact form details (name, email, optional phone, message) so we can reply. Newsletter email address, only where you tick the opt-in box. Basic security logs (IP address, timestamps) generated by our hosting and database providers to prevent abuse.
3. Lawful basis (EU and UK visitors)
Where the GDPR applies, we process on the basis of: contract, for account, purchase and coaching data needed to deliver what you bought; consent, for marketing emails and the quiz funnel, which you can withdraw at any time; and legitimate interests, for site security, fraud prevention and answering enquiries. We do not carry out automated decision-making or profiling with legal effects.
4. Data minimisation
We only ask for what is needed to run the coaching service. We do not collect card numbers, government identifiers, or health records. If you choose to tell a coach about an injury, that information is stored only in your coaching notes and is visible only to you and NINEBASE coaching staff.
5. How long we keep it
Account and coaching data: for as long as your account is open, then 12 months after closure, then deleted. Purchase, invoice and tax records: 5 years from the transaction, as required by Australian tax law (7 years in the limited cases where that applies). Contact form enquiries: 24 months. Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not email you again. Quiz and assessment results: 24 months, or deleted sooner on request.
6. Who we share it with
Only the providers needed to run the service: Stripe (payment processing), our cloud database and hosting provider (secure storage of account and coaching data), and our email delivery provider (transactional and opt-in emails). Each is bound by its own privacy obligations. We do not sell, rent or trade personal information, and we do not share it with advertising networks. We may disclose information where legally required.
7. Overseas storage
Some providers store data on servers outside Australia, including in the United States and the European Union. We only use providers with recognised security and privacy standards and contractual protections for international transfers.
8. Security
All traffic is served over HTTPS with strict transport security. Passwords are hashed, never stored in plain text. Database access is protected by row-level security so members can only ever read their own records, and administrative access is limited to Harrison and approved coaching staff. Payment card details never touch our servers.
9. Your rights
You can ask us at any time to: give you a copy of the personal information we hold about you; correct anything inaccurate; export your data in a portable format; delete your account and associated data; or stop marketing emails. Email hello@ninebase.au and we will respond within 30 days, at no cost. If you are unhappy with our response you can complain to the Office of the Australian Information Commissioner, or your local data protection authority in the EU or UK.
10. California residents (CCPA / CPRA)
If you live in California you may request disclosure of the categories and specific pieces of personal information we have collected, request deletion, request correction, and opt out of any sale or sharing of personal information. NINEBASE does not sell or share personal information as those terms are defined under the CCPA and CPRA, and has not done so in the preceding 12 months. We will not discriminate against you for exercising these rights. Email hello@ninebase.au to make a request.
11. Children
The platform is intended for players aged 12 and over, and players under 18 must be signed up by a parent or guardian who consents to this policy on their behalf. We do not knowingly collect information from children under 12. If you believe we have, email us and it will be deleted.
12. Cookies
We use only essential browser storage and no advertising trackers. Every item is listed in the Cookie Policy.
13. Backups and data loss
Member data is held in a managed database with automated daily backups and point-in-time recovery. Backups are encrypted and retained on a rolling basis, and are used only to restore the service after a failure. If a data breach is likely to cause serious harm we will notify affected members and the OAIC as required by the Notifiable Data Breaches scheme.
14. Changes
We will update this page when our practices change and revise the date below. Material changes affecting members will be notified by email.
15. Contact
Privacy enquiries, access requests and deletion requests: hello@ninebase.au.
This policy is general in nature and does not constitute legal advice.