Privacy Policy

This Privacy Policy is issued by Tim's Severe Weather (ABN 44 002 468 286), trading as Tim's Severe Weather ("we", "us", "our"), the operator of Tim's Severe Weather Australia at https://timsweather.au and the paid weather-alerts service offered on that site.

We are an Australian small business. We voluntarily comply with the Privacy Act 1988 (Cth), the 13 Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme, even where we may not be a strictly-regulated "APP entity" under section 6C of the Act. We also comply with the Spam Act 2003 (Cth) and the Telecommunications Act 1997 (Cth) for SMS-based alerts.

This policy covers all personal information we handle in connection with the website, the paid alerts service, billing, support correspondence and any other interaction with us. If you do not agree with this policy you should stop using the site and cancel any active subscription. Continued use after a material change constitutes acceptance of the updated policy (see s.16).

The categories of personal information we collect are:

We do not deliberately collect "sensitive information" as defined in s.6 of the Privacy Act (health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, biometric or genetic data). Please do not send sensitive information to us through chat or support.

• Directly from you — when you sign up, sign in, set preferences, verify your phone, contact support or use the chatbot.
• From Google — if you choose to sign in with Google, we receive your email and Google account ID under your consent.
• Automatically — server logs, cookies (subject to your consent — see Cookie Policy) and security telemetry generated when you use the site.
• From Stripe — subscription state, invoice metadata and last-four card digits via webhooks. Full card numbers stay with Stripe.
• From delivery providers — delivery, bounce and unsubscribe events from our email and SMS providers.

We collect, hold and use personal information for these primary purposes:

• Create and operate your alerts account and authenticate you.
• Deliver weather, fire, flood, cyclone, earthquake and related alerts to the channels you chose.
• Take payment, manage subscriptions, send tax invoices and process refunds (Stripe).
• Prevent fraud, abuse and unauthorised access — including rate-limiting and security logging.
• Provide customer support and respond to your enquiries.
• Improve and develop the service (anonymous/aggregated analytics; debugging).
• Comply with our legal obligations under Australian law (taxation, anti-spam, telecommunications, lawful requests).
• Send transactional service messages (billing receipts, security notices, material policy changes).
• Direct marketing — only with your express consent, and only via channels with a functional unsubscribe (see s.8).

We will not use personal information for a secondary purpose unrelated to the above unless you would reasonably expect it, you consent, or the law requires or authorises it (APP 6).

You consent to this policy when you tick the Privacy Policy checkbox on signup and at checkout. We record the document, version, IP address, user-agent and timestamp of each acceptance for audit purposes (kept for at least 7 years to align with Australian record-keeping and statute-of-limitations periods).

You can withdraw consent at any time by deleting your account, unsubscribing from messages, revoking push permissions in your browser, or emailing info@timsweather.au. Withdrawing consent may prevent us from providing the service.

We share personal information only with the service providers ("subprocessors") we need to run the service, under written terms requiring them to handle it securely and only for our instructions. We do not sell, rent or trade personal information.

We may also disclose personal information if compelled by a valid Australian court order, warrant or law-enforcement request, or where reasonably necessary to protect our legal rights, property or safety (or that of users or the public).

Some of our subprocessors store or process personal information outside Australia, including in the United States, the European Union and Singapore (see s.6). Before disclosing your personal information to an overseas recipient we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, including by relying on contracts that bind the recipient to APP-equivalent obligations.

By accepting this policy you acknowledge that, where you have consented to a particular cross-border disclosure, APP 8.1 will not apply to that disclosure (s.8(2)(b) Privacy Act). We will still take reasonable steps in any event.

• We send transactional messages (billing, security, service status, alerts you subscribed to) without separate marketing consent — these are essential to the service you bought.
• We send direct marketing (newsletters, promotions, feature announcements) only with your express, opt-in consent.
• Every commercial electronic message we send identifies us, contains accurate sender details and includes a functional unsubscribe link or "STOP" keyword.
• Replying STOP to any SMS removes you from non-essential SMS within 5 business days. Replying HELP returns contact details.
• You can opt out of all marketing at any time at info@timsweather.au or in your account settings.

We use strictly-necessary cookies to keep you signed in and secure, and (with your consent) analytics and advertising cookies. Full details, categories and how to change your choices are in our Cookie Policy and Cookie Settings.

• All traffic is encrypted in transit with HTTPS / TLS.
• Database access is restricted with row-level security policies and least-privilege service roles.
• Passwords are hashed using industry-standard one-way algorithms. We never see your plaintext password.
• Payment card data is handled exclusively by Stripe (PCI DSS Level 1).
• Administrative access is limited to a small number of authorised personnel and is logged.
• We review and patch known vulnerabilities promptly.

No system is perfectly secure. If you suspect your account has been compromised, change your password and email info@timsweather.au immediately.

We destroy or de-identify personal information once we no longer need it for the purpose it was collected for, except where we are required by law to retain it.

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to fix anything inaccurate, out-of-date, incomplete, irrelevant or misleading.
• Deletion — request deletion of your account and associated data (subject to legal retention obligations).
• Portability — request a machine-readable export of the data you provided.
• Object / restrict — opt out of marketing, optional analytics and optional advertising at any time.
• Complain — see s.13.

Send requests to info@timsweather.au. We will respond within 30 days. There is normally no charge. We may need to verify your identity before disclosing or changing data.

If you believe we have breached your privacy, the Australian Privacy Principles or this policy, please email info@timsweather.au with the words "Privacy Complaint" in the subject line. We will acknowledge within 5 business days and aim to resolve within 30 days.

If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC) on 1300 363 992.

In the event of an eligible data breach as defined under Part IIIC of the Privacy Act, we will notify affected individuals and the OAIC as soon as practicable, in line with the Notifiable Data Breaches scheme.

Chatbot messages are sent to our AI provider (the Lovable AI Gateway and the underlying model vendor) to generate a response. Do not include personal, sensitive, medical, financial or confidential information in chat. Conversations may be retained in de-identified form to improve safety and quality.

The paid alerts service is intended for users aged 18 or over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, email info@timsweather.au and we will delete it.

We may update this Privacy Policy from time to time. When we do, we bump the version number at the top of this page. Material changes — for example, new categories of data, new subprocessors with materially different risk, or new uses — will be notified to active Subscribers by email at least 14 days before they take effect, and you will be re-prompted to accept the new version at next sign-in.

The service is operated from Australia and directed at Australian users. Nothing in this policy limits any non-waivable rights you may have under the EU GDPR, UK GDPR, California CCPA/CPRA or similar laws. If those laws apply to you, contact our Privacy Officer to exercise the rights they grant.

Tim's Severe Weather trading as Tim's Severe Weather

ABN 44 002 468 286

Privacy Officer: info@timsweather.au

Website: https://timsweather.au