Privacy Policy

Last updated: March 2026

This Privacy Policy explains how Villanueva Creative Pty Ltd ("we", "us", "our") collects, uses, and protects your personal information when you use The Villa platform, including our website, courses, and community spaces.

We believe in being straightforward about data. We collect only what we need, we never sell your information, and we give you control over your data.

1. Who We Are

The Villa is operated by Villanueva Creative Pty Ltd, an Australian company. We provide online AI education courses and a residents-only community.

Website: Hosted on Vercel (Next.js)
Payments: Processed by Stripe (USD pricing)
Community: Discord (gated access for residents)
Contact for privacy matters: villanuevacreative@gmail.com

2. What Information We Collect

2.1 Information You Provide

Account information: Your name and email address when you create an account.
Payment information: Billing details provided during checkout. This is processed directly by Stripe. We never store your credit card numbers or full payment details on our servers.
Discord username: Linked to your account so we can grant you access to the residents-only community.

2.2 Information Collected Automatically

Course progress data: Which lessons you have completed and when, so we can track your progress and improve the learning experience.
Device and browser information: Basic technical data such as device type, browser type, and IP address, collected through Vercel Analytics. Vercel Analytics does not use persistent cookies and does not track you across other websites.
Session cookies: We use session cookies solely for authentication (keeping you logged in). These are not used for tracking or advertising.

3. How We Use Your Information

We use your information to:

Provide access to courses and community features.
Process payments through Stripe.
Send transactional communications such as payment receipts, access details, and account updates.
Send course updates including new content, platform changes, and relevant announcements.
Track your course progress so you can pick up where you left off.
Improve the platform by understanding how residents use the site (via aggregated, non-identifying analytics).
Comply with legal obligations such as Australian tax and financial record-keeping requirements.

We do not sell your personal information. We do not share your data with third parties for their marketing purposes.

4. Lawful Basis for Processing (GDPR)

If you are located in the European Union or United Kingdom, we process your personal data under the following lawful bases:

Contract performance: Processing your account and payment information is necessary to deliver the courses and community access you have purchased.
Legitimate interest: We use analytics data and course progress tracking to improve our platform and your learning experience. We balance our interests against your rights and only process data in ways you would reasonably expect.
Legal obligation: We retain certain financial records as required by Australian tax law.
Consent: Where we send marketing communications, we do so with your consent, which you can withdraw at any time.

5. Third-Party Services

We use the following third-party services to operate The Villa. All are based in the United States, which means your data may be transferred to and processed in the US (see Section 6).

Service	Purpose	What They Receive
Stripe	Payment processing	Name, email, billing and payment details
Discord	Community platform	Discord username; you also have a direct relationship with Discord under their own terms and privacy policy
Vercel	Website hosting and analytics	IP address, device/browser info (no persistent cookies, no cross-site tracking)
Email provider	Transactional and course update emails	Name and email address

Each of these services has their own privacy policy governing how they handle your data. We encourage you to review them.

We only share the minimum information necessary for each service to function. We do not share your data with any other third parties for marketing or advertising.

6. Cross-Border Data Transfers

Villanueva Creative Pty Ltd is based in Australia. However, the third-party services listed above are based in the United States. This means your personal information may be transferred to, stored, and processed in the US.

Where applicable (particularly for EU/UK residents), these transfers are protected by:

Standard Contractual Clauses (SCCs) and Data Processing Agreements with providers like Stripe.
The data protection commitments of each service provider.

By using The Villa, you acknowledge that your data may be processed outside your country of residence, including in the United States.

7. Cookies and Tracking

We keep things simple:

Session cookies: Used only for authentication (keeping you logged in). These expire when you close your browser or after your session ends.
Vercel Analytics: Collects basic, aggregated usage data (page views, device types). It does not use persistent cookies, does not track you across websites, and does not build advertising profiles.

We do not use Google Analytics, advertising cookies, or any cross-site tracking tools. Because we do not use persistent tracking cookies, no cookie consent banner is required.

8. Data Retention

We retain your information only as long as necessary:

While you are an active resident: We retain your account data, course progress, and related information for as long as your subscription is active.
After cancellation (account data): We retain your name, email, and course progress for up to 2 years after cancellation, in case you choose to return.
Financial records: We retain transaction records for 7 years after the relevant financial year, as required by the Australian Taxation Office (ATO).
Stripe records: Stripe independently retains payment records in accordance with their own legal and regulatory obligations.

After the applicable retention period, your data is securely deleted or anonymised.

9. Your Rights

9.1 All Residents

Regardless of where you are located, you can:

Request access to the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your personal data (see Section 9.3).
Unsubscribe from marketing emails at any time using the unsubscribe link in every email.

9.2 Additional Rights for EU/UK Residents

If you are located in the EU or UK, you also have the right to:

Data portability: Request a copy of your data in a structured, commonly used format.
Restrict processing: Ask us to limit how we use your data in certain circumstances.
Object to processing: Object to processing based on legitimate interest.
Lodge a complaint: Contact your local data protection authority if you believe your rights have been violated.

9.3 Requesting Deletion

To request deletion of your data, email us at villanuevacreative@gmail.com. We will process your request within 30 days.

Please note:

We may need to retain certain financial records for up to 7 years as required by Australian tax law.
Stripe retains payment records independently under their own legal obligations.
Your Discord account is managed by Discord directly. You will need to contact Discord separately regarding any data they hold.

10. Data Security

We take reasonable steps to protect your personal information:

All data transmitted to and from our website is encrypted using HTTPS/TLS.
Payment processing is handled by Stripe, which is PCI DSS compliant.
Data at rest is encrypted.
Access to personal data is restricted to authorised personnel only.

No system is 100% secure. While we take data security seriously and implement industry-standard protections, we cannot guarantee absolute security.

11. Children

The Villa is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from someone under 18, we will take steps to delete it promptly. If you believe a minor has provided us with personal information, please contact us at villanuevacreative@gmail.com.

12. Marketing Communications

We comply with the Australian Spam Act 2003 and equivalent international laws:

We will only send you marketing emails with your consent.
Every marketing email includes a clear unsubscribe link.
Every email identifies Villanueva Creative Pty Ltd as the sender.
You can unsubscribe at any time, and we will action your request promptly.

Transactional emails (such as payment receipts, access instructions, and essential account notifications) are not marketing and may still be sent as necessary to provide our service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you at least 30 days before the changes take effect, via email or a prominent notice on our website.

Minor clarifications or formatting changes may be made without advance notice.

We encourage you to review this policy periodically. The "Last updated" date at the top reflects the most recent revision.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

Email: villanuevacreative@gmail.com Entity: Villanueva Creative Pty Ltd Location: Australia