Privacy Policy
Last updated: 22 October 2026
1. Who we are
This policy explains how Dayle Keown ("we", "us") handles personal information when you use Brainwave Neurosim (the "Service"). Questions or requests: contact@brainwaveneurosim.com.
2. The short version
The Simulator runs entirely in your browser. It does not collect any clinical or patient data, because it never touches any — every signal it shows is computer-generated. We collect the minimum needed to give you an account, keep the Service working, and understand roughly how it is used.
3. What we collect
- Account information — your email address, and any name, role or institution you choose to give us when requesting or being granted access.
- Authentication records — sign-in events and one-time codes, handled by our sign-in provider (Auth0), and the signed session our own site keeps once you are in, used to let you in and to detect misuse.
- Usage record — when you first and last used the Simulator, how many times you have signed in, and for each day the number of minutes the Simulator was in use in each browser you used it from. Nothing about which settings, agents or displays you chose. We use it to administer memberships and to see whether the tool is being used; it is kept with your account record and deleted with it.
- Feedback you send us — anything you submit through a feedback form or email, including what you choose to tell us about your teaching context.
- Aggregate traffic statistics — request counts, approximate country and browser type, derived by Cloudflare from the technical logs below. We run no analytics script and set no analytics cookie: there is no tracking beacon in any page, so nothing follows you across sites or builds an advertising profile.
- Technical logs — standard server and security logs (including IP address) kept briefly by Cloudflare to operate and protect the Service.
- Billing information — your purchase status and invoices. Card payments are processed by Stripe; we never receive or store your full card number.
Your settings inside the Simulator are held in your browser for the session and are not transmitted to us. The only item stored locally on your device is a small flag recording that you acknowledged the educational-use disclaimer.
4. Why we use it
- to create your account and let you sign in;
- to operate, secure and troubleshoot the Service;
- to respond to your enquiries and feedback;
- to understand overall usage so we can improve the tool;
- to administer purchases and billing;
- to meet legal obligations.
We do not sell your personal information, and we do not use it for third-party advertising.
5. Who we share it with
We share personal information only with service providers who help us run the Service, and only as needed:
- Hosting and storage — Cloudflare (site hosting, the storage that holds your member and usage records, security, and email forwarding for our contact address).
- Sign-in — Auth0, a service of Okta (confirms you own your email address), and Resend (delivers the email containing your sign-in code).
- Feedback form — Google (Google Forms), where you choose to submit feedback through the form rather than by email.
- Purchases and billing — Stripe (payment processing).
We may also disclose information where required by law.
6. Overseas storage
Our providers operate globally, so your information may be stored or processed outside New Zealand and Australia — in particular on Cloudflare's global edge network, and in the United States, where Auth0 handles sign-in, where Google Forms feedback is held and where Stripe processes payments; and in Japan, where Resend sends the sign-in code email. We take reasonable steps to ensure it is protected by comparable safeguards, as required by Information Privacy Principle 12 of the NZ Privacy Act 2020 and Australian Privacy Principle 8.
7. How long we keep it
We keep your email address for as long as you have access, and for up to 12 months after your last sign-in, after which we remove it. You can ask us to remove it sooner at any time — see clause 10. Technical and authentication logs are kept only briefly, and for no longer than our providers retain them. Billing records, once paid plans exist, are retained as long as tax and accounting law requires.
8. Security
The Service is served over HTTPS and sits behind an authentication gate. We use reputable providers and limit access to personal information to those who need it. No system is perfectly secure, but we will notify you and the relevant regulator of any privacy breach that causes serious harm, as required by law.
9. Cookies
We use only what is necessary: a signed session cookie set by brainwaveneurosim.com itself so you stay signed in to the Simulator for 30 days, a short-lived cookie (10 minutes) that protects a sign-in while it is in progress, and the security cookies our sign-in provider (Auth0) sets on its own sign-in page while you sign in. There is no analytics cookie, because there is no analytics script. We do not use advertising or cross-site tracking cookies.
10. Your rights
You may ask us to access or correct the personal information we hold about you, ask us to delete it, or complain about how we have handled it — email contact@brainwaveneurosim.com. We will respond within 20 working days, which is the maximum allowed under the NZ Privacy Act 2020.
If you are unhappy with our response, you can complain to the Office of the Privacy Commissioner (New Zealand) or the Office of the Australian Information Commissioner.
11. Changes
We may update this policy. Material changes will be notified by email or in-app before they take effect, and the "last updated" date above will change.