1) Who we are
Controller: Spoken Past (Australia). Contact: [email protected].
This policy explains what we collect, why we collect it, and your choices.
2) What we collect
We keep data collection limited to what is needed to run the site, provide accounts and purchases, respond to messages, measure performance, and show advertising. We allow user accounts, but we do not provide public comment features.
- Account registration and login: name, email address, an internally generated account identifier, email-verification status, password-reset records, authentication sessions, and account settings. Passwords are securely handled by the Spoken Past account system and are not displayed to Spoken Past administrators.
- Contact form: name, email, subject, and your message. Used to read and reply. Submissions are processed through our website form system and may be delivered to our email inbox.
- Newsletter: email address, subscription status, signup source, and signup date. Duplicate subscriptions are not created for the same address.
- Purchases and donations (Stripe Checkout): name, email address, amount, currency, payment status, purchased items, and Stripe customer/payment identifiers. Spoken Past stores a donation record and receipt-delivery status in WordPress. Card data never touches our servers and is handled by Stripe.
- Logs & performance: standard hosting/edge logs (IP, user agent, page path, timestamps) for security and diagnostics.
- Analytics: Vercel Analytics & Speed Insights, plus Google Analytics, to understand aggregate usage and improve the site.
- Advertising: Google AdSense and its partners may use cookies, device identifiers, IP address, page views, and interaction data to serve, limit, measure, and personalize ads where permitted.
- Local preferences and guide progress: your theme preference and visited guide stops may be stored locally in your browser. This information is not an account profile field.
We do not intentionally collect special category data.
3) Cookies & consent
We use cookies and similar technologies for account sessions, checkout, security, analytics, advertising, and remembering preferences. Account access uses first-party session cookies issued by the Spoken Past frontend and validated by the Spoken Past website service. Third-party vendors, including Google, may place and read cookies in your browser or use web beacons, IP addresses, and other identifiers as a result of serving ads. Google's use of advertising cookies enables it and its partners to serve ads based on visits to this site and/or other sites. Read how Google uses information from sites that use its services and manage ad personalization at Google Ads Settings.
We use Consentmanager to present cookie choices and record your preferences. Where consent is required, we rely on the choices you make through that tool before using non-essential cookies or similar technologies. You can revisit your choices through the consent control shown on the Site. For a fuller description of the technologies and providers involved, see our Cookie Policy.
4) Why we use data (legal bases)
- Contact & replies: Legitimate interests (to answer you).
- Accounts, purchases, and donations: Contract (to provide account access and process transactions) and legal obligation (records/tax).
- Security & anti-abuse: Legitimate interests.
- Analytics: Legitimate interests; consent in the EEA/UK for Google Analytics.
- Advertising: Legitimate interests and/or consent where required for personalized ads, ad measurement, cookies, or similar technologies.
5) Who processes data for us
- Spoken Past CMS: account records, email verification and password reset, newsletter subscriptions, purchased-resource access, contact form entries, and content management.
- Vercel (hosting/CDN; also Vercel Analytics & Speed Insights): logs and performance metrics.
- Stripe (Checkout & receipts): processes purchases and donations; we can see customer email, payment status, item, and amounts in Stripe.
- Google: Google Analytics, Google AdSense, and related advertising technologies.
- Consentmanager: records and applies cookie-consent choices.
- MapTiler and OpenStreetMap: supply map tiles for interactive site guides; they receive the information needed to deliver those tiles, such as your IP address and request details.
- YouTube: plays embedded videos in some guide content using YouTube's privacy-enhanced domain. Playback may still result in YouTube processing data.
- Resend: sends account verification and password-related emails when needed.
- Cloudflare Turnstile: helps prevent abusive registration attempts.
Data may be processed in the EU, US, and other locations. Where required, transfers rely on appropriate safeguards (e.g., Standard Contractual Clauses).
6) Retention
- Account records: kept while your account remains active. The account settings page provides a password-confirmed deletion process; some transaction records may still be retained where legally required.
- Contact form messages: kept only as long as needed to handle your request; deleted afterwards.
- Purchase and donation records (Stripe): retained 7 years for tax and record-keeping.
- Server/edge logs: typically ~30 days (hosting defaults).
- Analytics: retained per provider defaults; we use aggregate reporting.
- Advertising data: retained according to Google AdSense and advertising partner settings and policies.
7) Your rights
Where applicable (e.g., under GDPR/UK GDPR), you may request access, rectification, erasure, restriction, portability, or objection. Contact [email protected].
You may lodge a complaint with your local authority (e.g., OAIC in Australia, an EU Data Protection Authority, or the UK ICO).
California (CCPA/CPRA)
We do not sell personal information for money. Some advertising activity may be considered "sharing" for cross-context behavioral advertising under CPRA. California residents have rights to know, delete, correct, opt out of sale/share where applicable, and to non-discrimination for exercising those rights. Contact us to make a request.
8) Security
We use HTTPS, least-privilege access, and provider-level protections. Payment card data never touches our servers (Stripe handles it). No method is perfect, but we work to keep your data safe.
9) Children
The site (including accounts, purchases, and donations) is intended for users aged 16+.
10) Changes
We may update this policy. The effective date above will change, and we will provide a notice on the site if the changes are material.
11) Contact
Email: [email protected]
