← Back

Privacy Policy

TPJ Ventures Pty Ltd ("we", "us", "our") operates AI VA in a Box under the CRTFD brand. We are committed to protecting your privacy in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

1. Information we collect

• Identity information: your name and email address, provided when you create your account
• Payment information: processed securely by Stripe. We do not store card numbers on our servers
• Learning data: your lesson progress, submissions, competency results and portfolio pieces
• Photos you upload: a profile or badge photo, if you choose to add one. Uploaded photos are automatically compressed and stored so they display well while keeping storage small
• Community activity: your presence and contributions in The Operators community, if you join
• Usage and device data: login activity, browser and device identifiers for session security
• Communication data: messages you send us by email or chat

2. How we use your information

• Provide access to the portal, lessons and toolkit
• Track your progress and issue your certification
• Assess your submissions (see section 3) and give you feedback
• Process payments and manage your account and membership
• Connect certified graduates with placement opportunities, with your consent
• Improve the programme based on aggregate usage patterns
• Meet our legal obligations

3. How we share your information

We do not sell your personal information. We share it only with service providers who help us run VA in a Box:

• Stripe for payment processing
• Supabase for secure account, database and file hosting
• Anthropic (Claude) to assess the work you submit for competency feedback and grading
• Mailgun for transactional emails
• Netlify for website and portal hosting
• Employer partners: your name, certification status and portfolio, only for certified graduates who opt into the placement pipeline

These providers are bound by data processing agreements and handle information in line with applicable privacy laws.

4. Cookies and local storage

The portal uses minimal cookies and browser local storage to keep you logged in, remember your preferences (such as your collapsed sidebar) and secure your session. We do not use third-party advertising cookies or trackers. We may use basic analytics to understand page visits and improve the experience.

5. Data security

We take reasonable steps to protect your personal information from misuse, loss and unauthorised access, including HTTPS encryption, secure session management, limited internal access to personal data, and Stripe's PCI-DSS compliance for payment data.

6. Data retention

• Account and learning data: retained while your account exists and for two years after your last activity
• Certification records: retained indefinitely so your credential stays verifiable
• Payment records: retained for seven years as required by Australian tax law

7. Your rights

Under the Australian Privacy Principles you have the right to access the personal information we hold about you, ask us to correct it, and request its deletion (subject to legal retention requirements). You may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs. To exercise any of these rights, email mentor@crtfd.com.au and we will respond within 30 days.

8. International data

Our students are primarily in the Philippines and Australia. Some of our service providers (Stripe, Supabase, Anthropic, Mailgun, Netlify) may process data outside your country, including in the United States. We take reasonable steps to ensure these providers maintain data protection standards consistent with the APPs.

9. Children

VA in a Box is designed for adults (18+). We do not knowingly collect personal information from anyone under 18. If we become aware that we have, we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email, and the "last updated" date above reflects the most recent revision.

11. Contact us

For privacy questions or to exercise your rights: mentor@crtfd.com.au. Entity: TPJ Ventures Pty Ltd, New South Wales, Australia. Regulator: Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au.