Pilot privacy notice

Version 2026-10-23.v1 · 23 October 2026

Baxter Holt trading as Next Over, ABN 45861547018. Business contact address: 129 Spit Road, Mosman NSW 2088, Australia. The owner and privacy contact is Baxter Holt: bjh@baxterholt.com.

What we collect and why

We collect the adult contact name and email, applicant type, athlete age group, sport, location, optional cricket role and development priority. We record the submission time, source, privacy notice version and optional marketing preference. Authorised administrators may add follow-up status and internal notes. These details help us manage and respond to pilot interest; they are not payment or membership confirmation.

Independent athletes under 18 must ask a parent or guardian to register interest. Please do not submit health information or other sensitive personal details.

Member accounts and family sharing

Invited members additionally provide athlete preferred name, date of birth for eligibility and the age-18 access review, cricket role, playing level, weekly commitments, development time and up to two goals. Club/school and approximate budget are optional. We store saved onboarding drafts, family authorisations and revocations, invitation email and lifecycle timestamps, pilot entitlement reason and expiry, shared development plans and learning completion. No clinical records or private mental-health journals are collected.

Under-18 profiles are managed by an authorised guardian. Athlete logins require a guardian-authorised invitation to the athlete’s verified email. Adult athletes choose whether to invite a supporter. Previous guardian access stops at 18 until the adult athlete reviews ownership and chooses sharing. Linked family members can see shared development information; authorised administrators review onboarding and manage pilot access.

Payments, feedback and use

Stripe processes payments and holds card details; we do not store card numbers. We store your payer-to-membership link, provider identifiers, accepted terms version, billing periods, payment status and reviewed refund records. Support requests and feedback are retained for owner review. Minimal use tracking stores only one account/athlete/date record per day, alongside existing plan assignments and completion records; it does not record browsing paths or clinical information.

Marketing and repeat requests

Marketing is optional, unticked by default and not required to register interest. Contact us to withdraw. Repeat submissions from the same email do not change the existing contact details or marketing preference; contact the owner to request corrections.

Storage and access

Details are stored using Lovable Cloud. Recruitment records are restricted to authorised administrators; member development records are restricted to authorised family relationships and administrators. We do not send personal lead details to application logs or third-party analytics. A protected, pseudonymous request bucket is used to limit spam attempts. Follow-up exports contain only information needed to respond to interest.

Your requests

Contact bjh@baxterholt.com to ask for access, correction, deletion, withdrawal of marketing consent, or to raise a privacy concern. Account controls allow unlinking and deletion requests. A deletion request immediately removes family access; the owner reviews retained-data removal separately. We will verify the request before disclosing or changing a record.

Retention

We retain the personal information needed to provide and administer your membership while your membership is active. When membership ends, we review the information and delete or anonymise it when no longer needed, subject to legal, accounting, security, dispute or audit requirements.

Hosting and overseas processing

Database and authentication are provided through Lovable Cloud; private learning files use Lovable Cloud storage. The database connection region is AWS ap-northeast-2, Seoul, South Korea. Website publishing is Lovable-managed with a Cloudflare-compatible target; the actual production runtime provider is not independently confirmed. The residency of authentication data, private files and backups is not independently verified. We do not claim Australian-only hosting or that all data is stored in Seoul.