Privacy Policy

Last updated: 22 October 2026

This Privacy Policy explains how Villanueva Creative Pty Ltd ("we", "us", "our") collects, uses, and protects your personal information when you use The Villa platform, including our website, courses, and community spaces.

We believe in being straightforward about data. We collect only what we need, we never sell your information, and we give you control over your data.

1. Who We Are

The Villa is operated by Villanueva Creative Pty Ltd, an Australian company. We provide online AI education courses and a residents-only community.

Website: Hosted on Vercel (Next.js)
Payments: Processed by Stripe (USD pricing)
Community: Discord (gated access for residents), with our community bot, Pulse
Contact for privacy matters: hosts@enterthevilla.com

2. What Information We Collect

2.1 Information You Provide

Account information: Your name and email address when you create an account.
Payment information: Billing details provided during checkout. This is processed directly by Stripe. We never store your credit card numbers or full payment details on our servers.
Discord username: Linked to your account so we can grant you access to the residents-only community.

2.2 Information Collected Automatically

Course progress data: Which lessons you have completed and when, so we can track your progress and improve the learning experience.
Device and browser information: Basic technical data such as device type, browser type, and IP address, collected through Vercel Analytics. Vercel Analytics does not use persistent cookies and does not track you across other websites.
Cookies: We use session cookies to keep you logged in, and one small cookie that remembers which of our links brought you to the site (see Section 7). Neither is used for advertising.
Where you came from: If you arrive through a link we shared that carries a tag (for example our Instagram bio), we note which account and platform the link came from and keep that note with your newsletter signup or membership. When you join, it is passed to Stripe with your checkout. When you join, you can choose to tell us how you heard about us.

Sentry error reports and sampled replays are used only to find and fix faults and are kept for a limited period.

2.3 Community Participation and Recognition

Our community bot, Pulse, runs a recognition programme in the residents-only Discord. To run it, Pulse records:

Contributions in community channels: when you share work in progress or a win, help another resident, ask a question, check in, introduce yourself or say good morning, Pulse records the type of contribution, the date, the points it earned and a link to the message. It does not keep a copy of your message text.
Your points, level and preferences: your running points total, your level, and whether you have chosen to hide your ranking or leave the programme.

Pulse only looks at messages in shared community channels that every resident can already see. It never reads or records private messages for the programme.

To decide whether a reply was a genuine attempt to help, or whether a post is a progress update, Pulse sends the text of that message, and the question it answers, to our AI provider, Anthropic. The text is used only to make that decision and is not stored by Pulse afterwards. Pulse also uses Anthropic to write the community's regular channel digests and to answer questions sent to it.

Your level appears as a role on your Discord profile, and residents with the most points in a week may appear on the community leaderboard and in a weekly roundup. You can hide your level and your ranking, or leave the programme entirely, at any time from Pulse. Leaving stops new points and removes your level role.

3. How We Use Your Information

We use your information to:

Provide access to courses and community features.
Process payments through Stripe.
Send transactional communications such as payment receipts, access details, and account updates.
Send course updates including new content, platform changes, and relevant announcements.
Track your course progress so you can pick up where you left off.
Recognise community contributions through points, levels, the leaderboard and weekly roundups (see Section 2.3).
Improve the platform by understanding how residents use the site (via aggregated, non-identifying analytics).
Comply with legal obligations such as Australian tax and financial record-keeping requirements.

We do not sell your personal information. We do not share your data with third parties for their marketing purposes.

4. Lawful Basis for Processing (GDPR)

If you are located in the European Union or United Kingdom, we process your personal data under the following lawful bases:

Contract performance: Processing your account and payment information is necessary to deliver the courses and community access you have purchased.
Legitimate interest: We use analytics data and course progress tracking to improve our platform and your learning experience, and community participation records to recognise residents' contributions. We balance our interests against your rights and only process data in ways you would reasonably expect.
Legal obligation: We retain certain financial records as required by Australian tax law.
Consent: Where we send marketing communications, we do so with your consent, which you can withdraw at any time.

5. Third-Party Services

We use the following third-party services to operate The Villa. Most are based in the United States, which means your data may be transferred to and processed in the US (see Section 6).

Service	Purpose	What They Receive
Stripe	Payment processing	Name, email, billing and payment details
Discord	Community platform	Discord username; you also have a direct relationship with Discord under their own terms and privacy policy
Vercel	Website hosting and analytics	IP address, device/browser info (no persistent cookies, no cross-site tracking)
Email provider	Transactional and course update emails	Name and email address
Supabase	Database hosting (Sydney, Australia)	Account, membership and course progress records, and community participation records
Railway	Hosting for our community bot, Pulse	The information Pulse handles, as described in Section 2.3
Anthropic	AI provider for Pulse	The text of individual community messages Pulse is assessing or summarising, and questions sent to Pulse
Sentry	Error monitoring and session replay	Error reports with IP address, browser and page details; for about one visit in ten, a replay of page interactions with text masked and media blocked

Each of these services has their own privacy policy governing how they handle your data. We encourage you to review them.

We only share the minimum information necessary for each service to function. We do not share your data with any other third parties for marketing or advertising.

6. Cross-Border Data Transfers

Villanueva Creative Pty Ltd is based in Australia. However, most of the third-party services listed above are based in the United States. This means your personal information may be transferred to, stored, and processed in the US.

Where applicable (particularly for EU/UK residents), these transfers are protected by:

Standard Contractual Clauses (SCCs) and Data Processing Agreements with providers like Stripe.
The data protection commitments of each service provider.

By using The Villa, you acknowledge that your data may be processed outside your country of residence, including in the United States.

7. Cookies and Tracking

We keep things simple:

Session cookies: Used only for authentication (keeping you logged in). They keep you logged in for up to 30 days, or until you log out.
Vercel Analytics: Collects basic, aggregated usage data (page views, device types). It does not use persistent cookies, does not track you across websites, and does not build advertising profiles.
Link source cookie: If you arrive through one of our tagged links, a small cookie set by our own site remembers which account and platform the link came from, for 30 days, so we can see which posts bring people to The Villa. It is not shared with other websites and is not used for advertising.

We do not use Google Analytics, advertising cookies, or any cross-site tracking tools.

8. Data Retention

We retain your information only as long as necessary:

While you are an active resident: We retain your account data, course progress, and related information for as long as your subscription is active.
After cancellation (account data): We retain your name, email, course progress and community participation records for up to 2 years after cancellation, in case you choose to return.
Financial records: We retain transaction records for 7 years after the relevant financial year, as required by the Australian Taxation Office (ATO).
Stripe records: Stripe independently retains payment records in accordance with their own legal and regulatory obligations.

After the applicable retention period, your data is securely deleted or anonymised.

9. Your Rights

9.1 All Residents

Regardless of where you are located, you can:

Request access to the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your personal data (see Section 9.3).
Unsubscribe from marketing emails at any time using the unsubscribe link in every email.
Leave the recognition programme at any time from Pulse, or by emailing us.

9.2 Additional Rights for EU/UK Residents

If you are located in the EU or UK, you also have the right to:

Data portability: Request a copy of your data in a structured, commonly used format.
Restrict processing: Ask us to limit how we use your data in certain circumstances.
Object to processing: Object to processing based on legitimate interest.
Lodge a complaint: Contact your local data protection authority if you believe your rights have been violated.

9.3 Requesting Deletion

To request deletion of your data, email us at hosts@enterthevilla.com. We will process your request within 30 days.

Please note:

We may need to retain certain financial records for up to 7 years as required by Australian tax law.
Stripe retains payment records independently under their own legal obligations.
Your Discord account is managed by Discord directly. You will need to contact Discord separately regarding any data they hold.

10. Data Security

We take reasonable steps to protect your personal information:

All data transmitted to and from our website is encrypted using HTTPS/TLS.
Payment processing is handled by Stripe, which is PCI DSS compliant.
Data at rest is encrypted.
Access to personal data is restricted to authorised personnel only.

No system is 100% secure. While we take data security seriously and implement industry-standard protections, we cannot guarantee absolute security.

11. Children

The Villa is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from someone under 18, we will take steps to delete it promptly. If you believe a minor has provided us with personal information, please contact us at hosts@enterthevilla.com.

12. Marketing Communications

We comply with the Australian Spam Act 2003 and equivalent international laws:

We will only send you marketing emails with your consent.
Every marketing email includes a clear unsubscribe link.
Every email identifies Villanueva Creative Pty Ltd as the sender.
You can unsubscribe at any time, and we will action your request promptly.

Transactional emails (such as payment receipts, access instructions, and essential account notifications) are not marketing and may still be sent as necessary to provide our service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you at least 30 days before the changes take effect, via email or a prominent notice on our website.

Minor clarifications or formatting changes may be made without advance notice.

We encourage you to review this policy periodically. The "Last updated" date at the top reflects the most recent revision.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

Email: hosts@enterthevilla.com Entity: Villanueva Creative Pty Ltd Location: Australia