Privacy policy
Last updated 3 November 2026
Learn to Lead Hub (ABN 22 767 904 430) is an Australian business. This policy explains what personal information we collect when you use learntoleadhub.com, why we collect it and what you can do about it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you're in the UK or European Union, this policy also explains the legal basis for each use.
The short version: we collect only what we need to run your courses, we don't use analytics or advertising trackers, and we never sell your information.
What we collect
| Information | When we collect it | Why |
|---|---|---|
| Your email address | At checkout, or when you ask for a sign-in link | To create your account, link your purchases to it, send sign-in links and the emails described below |
| Your name | Only if you add it on your account page or when you claim a certificate | To print on your certificate and show on its verification page |
| Learning records | As you use a course | To save your progress and decide when you've earned a certificate: chapters started and completed, your exercise responses (including any text you type in drafting and reflection exercises), and your knowledge-check and final assessment answers and scores |
| Purchase records | When you buy | To give you access and keep the records tax law requires: the course, amount, currency, date, and Stripe reference numbers for the checkout, payment and customer. We never receive your card details. |
| Sign-in and security records | When you sign in | To keep your account secure: one-time sign-in tokens and session tokens (stored only in scrambled, hashed form), when each was created and last used, and a hashed code made from your country and type of device, so a sign-in link only works on a similar device in the same country as the one that asked for it |
| Your IP address | When you ask for a sign-in link or send a message | To limit repeated requests and stop abuse. We keep it for no more than two hours for this purpose. |
| Email records | When we email you | Which email we sent and when, so we can investigate delivery problems |
| Messages you send us | When you use the contact form or email us | To reply. Contact-form messages are emailed to our inbox; we don't store them in our course database. |
| Admin actions | If we change your account | A log of changes we make, such as granting access or reissuing a certificate, so there's an accurate record |
You don't have to give us your name, and you can use the free exercise previews on our course pages without an account. Without an email address, though, we can't sell you a course or let you sign in.
Cookies and similar technology
-
One essential cookie. When you sign in, we set a cookie called
__Host-ltlh_sessionthat keeps you signed in for up to 30 days after your last visit. It's deleted when you sign out. We don't use any other cookies. - Your browser's local storage. If you try an exercise on a course page without signing in, your answers are saved in your browser only, so you can come back to them. They never reach us.
- Bot checks. Our sign-in and contact forms use Cloudflare Turnstile to check that a person, not a bot, is sending them. Cloudflare processes information about your browser and device to do this.
- Checkout. Checkout pages are run by Stripe and Link, which use their own cookies under their own policies.
We don't use analytics, advertising, social media pixels or any other tracking.
Emails we send
We send the emails needed to provide your course: sign-in links, purchase confirmations and certificate notices. If you have a chapter in progress, we may also send a reminder, at most once a week. You can turn reminders off with the link in any reminder or on your account page. We don't send marketing emails.
Who we share information with
We use a small number of service providers to run the site. Each processes personal information only to provide its service to us or as its own privacy policy explains:
- Cloudflare hosts the site, the course database and certificate files, protects the site from attacks and runs the Turnstile bot check.
- Stripe and Link run checkout, take payment, handle tax and issue receipts. When you buy, Link is the seller of record and collects the payment details it needs directly from you, under its own privacy policy.
- Postmark delivers our emails.
These providers operate internationally, so your information may be stored or processed in the United States, Australia and other countries. We choose providers that protect personal information to a standard comparable to the Australian Privacy Principles.
Certificates are public by design. Each certificate's verification page shows the name, course, date and status to anyone who has its ID or QR code. If you add a certificate to LinkedIn or share it, the people you share it with can see that information.
We don't sell, rent or trade personal information. We'll disclose it to anyone else only if the law requires it, for example under a valid court order.
Legal basis (UK and EU)
We process your information to perform our contract with you (providing your course, account and certificate), to meet legal obligations (keeping sales records), and for our legitimate interests in keeping the site secure and answering your messages. Reminder emails rely on our legitimate interest in helping you finish a course you paid for, and you can turn them off at any time.
How long we keep it
- Your account, learning records and certificates: until you delete your account.
- Sign-in links and sessions: deleted automatically soon after they expire.
- Purchase records: for five years after the sale, because Australian tax law requires it. If you delete your account, we keep these records without the link to your account.
- Contact-form messages and emails you send us: for as long as we need them to deal with your query.
- Backups: our hosting provider keeps a rolling history of the database for up to 30 days, so deleted information may remain in backups until that period ends.
Your choices and rights
- See and export your data: on your account page, download everything we hold about your account as a file.
- Correct it: change your name or email address on your account page, or ask us to reissue a certificate with a corrected name.
- Delete it: delete your account on your account page. This removes your account, progress, exercise responses and certificates straight away, and their verification pages stop working.
- Stop reminders: on your account page or with the link in any reminder.
You can also ask us for access to or correction of your information by emailing hello@learntoleadhub.com. If you're in the UK or EU, you also have rights to object to or restrict processing. We'll respond within 30 days.
Security
The site runs only over encrypted HTTPS connections. Sign-in and session tokens are stored only in hashed form, so a copy of our database couldn't be used to sign in as you. Access to our systems is limited to the people who run the service.
Children
Our courses are designed for adults in the workplace. Please don't use the site if you're under 16.
Complaints
If you have a concern about how we've handled your information, email us first and we'll try to fix it. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au , or to the data protection authority where you live.
Changes to this policy
If we change what we collect or how we use it, we'll update this page and its date. If a change materially affects you, we'll email you before it takes effect.