Hi, I'm Cindy 🌱 I wanted this page to be one you can actually read, so here's what information I collect, why I collect it, who helps me handle it, and what you can ask me to do with it. It covers my website cindyzhu.com.au, my Instagram accounts, my Facebook Page, my emails, my free guides and AI System Club.
It also covers my app, Cindy Zhu Publisher, which I use only to manage my own Instagram account and Facebook Page through Meta's official tools.
When I say "I" or "me", that's me, Cindy Zhu, a sole trader based in Melbourne, Australia. I'm the one responsible for your information, and you can reach me any time at hello@cindyzhu.com.au.
The short version
- I collect what you give me, like your email address or your messages.
- I use it to send what you asked for, reply to you and run my programs.
- I never sell your information, and I never give it to the brands I work with.
- If my AI assistant ever replies to you, it's always labelled as AI.
- You can ask me to see, fix or delete it at any time.
What I collect
- Your email address (and first name, if you share it), when you join a waitlist, ask for a guide or sign up to my emails. This can happen on my website or in an Instagram message.
- Your Instagram messages and comments to my accounts, and comments or posts you leave on my Facebook Page, with your username, profile name, profile picture and when you sent them, so I know who I'm replying to.
- How you use my emails, like whether you opened one and which links you clicked, so I know what's useful.
- Purchase details, if you buy something: your name, email, billing country, what you bought, when, and the last four digits and type of your card. Your full card details go straight to the payment provider. I never see or store them.
- AI System Club activity, if you join: your profile, posts, comments, progress, and anything you share in the community or on live calls.
- Business emails, if you contact me about a partnership or press: your name, email, company and what we discuss.
- Basic website data. My hosting provider logs technical details like your IP address and browser type to keep the site working and secure. My website statistics are counted without cookies and don't identify you.
- Statistics about my own posts, audience and ads, which Instagram and Facebook give me as totals that don't identify you.
- Your voice, only if you use my voice practice demo. It's streamed to a voice AI service so it can talk back to you. My camera demos run on your device and nothing is uploaded.
- Public information from other Instagram business and creator accounts, like follower counts and public posts, which I look at for content research. More on this below.
You never have to give me your email. I just need it to send you what you asked for.
Why I use it, and my legal basis
Some privacy laws, like the GDPR in the EU and UK, ask me to name a legal reason for each use. Here they are.
- To send the guide or updates you asked for, and my weekly AI emails. Basis: your consent when you gave me your email, or my legitimate interest in sending you related emails. You can unsubscribe at any time.
- To reply to your messages and comments, including sending the link you asked for with a keyword. Basis: your request, and my legitimate interest in answering you.
- To deliver AI System Club or anything else you buy, and to handle refunds. Basis: our contract.
- To keep tax and accounting records. Basis: legal obligation.
- To schedule and publish my own posts and understand how they perform, and to research my niche using statistics and public information. Basis: my legitimate interests, which I weigh against yours.
- To keep my accounts, website and community safe and to stop spam and abuse. Basis: my legitimate interests.
No AI or automated tool makes important decisions about you on its own, meaning anything with a legal or similarly significant effect on you. Those are always made by me.
My emails
- You only get emails from me if you gave me your email address, for example for a guide, a waitlist or my newsletter. Along with what you asked for, I may send my weekly AI emails and AI System Club updates.
- Every marketing email says it's from me and has an unsubscribe link. I act on unsubscribes straight away.
- After you unsubscribe, my email provider keeps your address marked as unsubscribed so I never add you back by mistake. If you want it deleted completely, just ask.
Instagram, keyword replies and my AI assistant
Some replies on Instagram are automated. When you comment a keyword, a tool called ManyChat sends you the link you asked for. I'm also setting up an AI assistant, which uses Anthropic's Claude, to help me answer messages. At first it only drafts replies for me to check. Later it may send some simple replies itself. Either way:
- Every message from my AI assistant is labelled as AI, starting with the first message in each conversation.
- My AI assistant only replies to people who messaged me first.
- Anything about payments, refunds, partnerships or personal matters comes to me, not the AI.
- If you'd rather talk to me, just say so in the chat. Reply "stop" and the automated messages stop.
Content research on public accounts
To plan content, I look at public information from Instagram business and creator accounts, like profile details, follower counts, public posts and captions, all things anyone can see on a public profile. I use Instagram's official tools and research tools for this. I only use information those accounts have made public, I use it only for my own research, and I never sell it or share it. I delete it within 12 months. If it's about you and you want it gone sooner, just email me and I'll delete it.
Information from Instagram and Facebook
Anything I get through Meta's official tools, I only use for the reasons on this page. I don't sell it, license it or buy it, and I delete it when you ask or when I no longer need it.
Who helps me run this
I run a small business, so a few tools and people help me behind the scenes. They only use your information to do their job for me, under their own security and privacy terms.
- Meta (Instagram and Facebook), where your messages and comments are sent and stored.
- ManyChat, for keyword replies on Instagram.
- AI providers, including Anthropic (Claude), which help me draft replies and organise my work, and a voice AI service that runs my voice practice demo.
- Kit, which sends my emails.
- Netlify, which hosts my website and its sign-up forms. It uses Akismet to filter spam form entries.
- Cloudflare, which counts website visits without cookies.
- Circle, which hosts AI System Club once it opens, and Stripe, which processes its payments. Stripe also uses some payment information for its own fraud prevention and legal duties, under Stripe's privacy policy.
- Everyday business tools for email, notes, files, team chat, scheduling posts and research.
- A small team of contractors who help me edit content and run the community. They only see what they need for their work, and I ask them to keep it confidential.
Brands I work with
I never give your personal information to brands I partner with. They only see combined, anonymous numbers, like total views or which countries my audience is in. If I ever run a giveaway with a brand where your details would go to them, I'll ask you first.
Links and affiliate links
My guides link to other websites and tools. Some are affiliate links, which means I may earn a commission if you buy, at no extra cost to you. Those sites have their own privacy policies and may use cookies to track the referral. Once you're on their site, their policy applies. I can't control how they handle your information, so I'm not responsible for it.
Cookies and tracking
My website doesn't set cookies, and it doesn't track you across other sites. When a page loads, your browser fetches fonts from Google, which can see your IP address. Some browsers send a Do Not Track or Global Privacy Control signal. There's no cross-site tracking here for it to switch off, so every visit is treated the same either way.
I never sell your information
I don't sell your personal information, and I don't share it for targeted advertising (the kind of ads that follow you around other sites).
Where your information goes
I'm based in Australia. Many of the services I use store information in the United States, and some in other countries. Some of my contractors work from other countries, including in Asia. So your information may be handled outside the country you live in. Where the law asks for extra protection, I rely on safeguards like the European Commission's standard contractual clauses (and the UK's version), which are built into my main providers' data processing terms. For some providers, I rely on their certification under the EU-US Data Privacy Framework instead.
How long I keep it
- Email list: until you ask me to delete it. If you unsubscribe, your address stays marked as unsubscribed so you're never emailed again.
- Website sign-ups: kept in my website's form inbox while I need them for my waitlist and email list, or until you ask me to delete them.
- Instagram message records in my own tools, including my AI assistant: deleted after 12 months.
- Keyword reply contacts in ManyChat: deleted within 24 months of your last interaction.
- Instagram itself keeps messages and comments in my inbox until they're deleted there, and Meta keeps its own copies under its own policy.
- Purchase records: as long as tax law requires, usually 5 years.
- AI System Club: for as long as you're a member, plus 12 months, unless you ask me to delete it sooner.
- Comments and public research data: up to 12 months.
- Business emails: for as long as we work together and for as long as I need them for my records, including tax.
How I keep it safe
I use reputable providers, use two-step login on my main accounts, keep passwords and access keys private, and give my team access only to what they need. No system is perfectly secure, so I can't promise nothing will ever go wrong.
If something goes wrong
If a data breach is likely to cause you serious harm, I'll tell you as soon as I can, with what happened and what you can do. I'll also tell the relevant regulator where the law requires it, for example within 72 hours in the EU and UK.
Your rights
Wherever you live, you can ask me to:
- show you the information I hold about you, and give you a copy;
- correct it;
- delete it;
- stop using it for marketing (one click on unsubscribe does this).
If you're in the EU or UK, you can also object to how I use your information, ask me to limit it, or ask for a copy in a common format. Where I rely on your consent, you can withdraw it at any time, and that won't affect what happened before.
If you're in India, you can also nominate someone to act for you if you pass away or can't act for yourself, and you can complain to the Data Protection Board of India.
To make a request, email hello@cindyzhu.com.au or follow my data deletion page. It's free. I may ask you to confirm it's really you, so nobody else can get your information. I'll reply within one month. If a request is complicated, I may need longer where the law allows, and I'll tell you why.
If you're not happy
If something about how I've handled your information doesn't feel right, please email me so I can put it right. You can also contact your privacy regulator at any time, for example:
- Australia: the Office of the Australian Information Commissioner (oaic.gov.au)
- UK: the Information Commissioner's Office (ico.org.uk)
- EU: your country's data protection authority (listed at edpb.europa.eu)
- Singapore: the Personal Data Protection Commission (pdpc.gov.sg)
- India: the Data Protection Board of India
A note on age
My content, emails and programs are made for adults. Please don't sign up if you're under 16, or under 18 if you live in India. You need to be 18 or older to buy anything from me. I don't knowingly collect information from children under 13. If you think a child has given me their information, tell me and I'll delete it.
Testimonials
I only share your name, words or photo as a testimonial if you've said yes. I ask about your words and your photo separately.
AI System Club
What you post in the community can be seen by other members. Live calls may be recorded and shared with members, and the community platform may make transcripts or summaries of them. You can keep your camera off and use the chat instead.
Data protection contact
That's me, Cindy Zhu. For any privacy question at all, you can reach me at hello@cindyzhu.com.au.
If this page changes
If I change this policy, I'll update the date at the top. If it's a big change and you're on my email list, I'll let you know by email.
Thanks for reading all the way to the end. If anything here doesn't make sense, just email me and I'll happily explain 💌