Last updated: 4 November 2026.
At a glance
You can read public lessons without an account. Account and quiz records support features you request. Website measurement records visits and activity under the regional settings below; linking browsing history to a member profile requires a separate opt-in. Advertising choices are separate from study access and analytics. Use Privacy preferences to review measurement choices at any time.
Who we are and how to contact us
Accounting Ahead is operated by Bhavik Trivedi in Australia and provides independent accounting study resources and a student community at accountingahead.com.au. For privacy questions, access, corrections or complaints, email hello@accountingahead.com.au. This notice covers our website, accounts, learning features and community.
Reading without an account
You can read public study material without registering. Our hosting provider processes technical information such as IP addresses, browser details, request times and requested pages to deliver the site, identify errors and protect against abuse. We use rate limits and security records to protect accounts and services. Aggregate live counts and optional Google Analytics are described below. We do not run a Meta advertising pixel.
Live counts and optional analytics
The live dashboard separates active guest/member tabs from recognised browser sessions. Live tabs use a temporary token in page and server memory, expiring within 90 seconds without a report. Existing sign-in information supplies only the guest/member category. Private pages and active quizzes use generic live labels. Without enabled visit measurement below, live counts add no analytics cookie and do not identify visitors across pages or tabs.
For the overview’s recent activity buttons, the same accepted live signal saves grouped minute totals of public-page views for up to eight days. Repeat views are included; private-page addresses and private-page view counts are excluded. These grouped page totals contain no visitor identifiers. They are not used as visitor counts. With visit measurement enabled, recognised sessions are counted independently: pages, reloads and tabs using the same browser identifier share one session until 30 minutes without activity. Signing in promotes that session to Member without adding a second visit. Minimal session records contain a random session identifier, a hashed browser identifier, guest/member category and start/last activity times for up to eight days, including sessions that only open a private area; no private-page address or account identity is attached. The live dashboard shows recognised sessions separately from tabs without recognition. Different browsers, devices, cleared cookies and consent choices prevent a complete count of people.
We also save grouped hourly totals of public-page views, visible non-idle time, video plays, playing time and player finishes. These aggregate records contain the hour, public page, subject and guest/member category, without an IP address, name, account identifier, referral query, browser identifier or individual browsing trail. A separate in-memory page token prevents duplicate reports and expires after 30 minutes of inactivity; it is not stored in the database. Active time pauses when the page is hidden or idle, except while a visible video is playing. These hourly totals are retained for up to 395 days (about 13 months).
You can exclude this browser from grouped measurement in Privacy preferences. We respect saved rejections, exclusions and Global Privacy Control. Staff, test accounts and declared crawlers are excluded, although blockers and undetected automation affect coverage. Study access, saved progress and quiz results do not depend on measurement permission.
Browser-based visit history and returning browsers
For a new browser whose connection is estimated to be outside the EEA, UK, Switzerland and associated European territories, first-party visit measurement and Google Analytics start automatically unless you opt out. In those regions, or where the country cannot be determined, all visitor measurement, including browser recognition, IP connection records and Google Analytics, waits for your affirmative choice. Saved refusals and Global Privacy Control override these defaults. You can turn measurement off at any time in Privacy preferences. Accepting the terms or signing up is not used as analytics consent.
Visit measurement uses a random first-party browser identifier in a secure, HTTP-only cookie lasting up to 180 days. A hashed identifier is used in the database to recognise a later visit, without fingerprinting or matching IP addresses. These records are pseudonymous rather than fully anonymous. A visit ends after 30 minutes of inactivity. Clearing cookies, changing browsers or declining permission prevents reliable recognition across visits; a recognised browser is not necessarily one person.
To choose these regional settings, the server temporarily uses the connection address forwarded by our hosting provider for a local country lookup. We do not send the address to a geolocation service. The approximate country code is kept with measured visits; the separately controlled, short-lived IP record is described below. VPNs, proxies and database errors can affect accuracy. Country data is provided by DB-IP under CC BY 4.0, refreshed monthly. When the data is unavailable or stale, browser recognition and Google Analytics require a choice.
When visit measurement is enabled under the settings above, we retain visit start/last activity, guest/member category, approximate country, referring website, hourly public-page views, visible active time, video plays and playback time for up to 395 days. Referring websites are stored without their path, search terms or query string; missing referrals appear as Direct / unknown. Names, email addresses, account identifiers, private messages, quiz answers and private-page addresses are not part of these visit records by default. Search queries are not assigned to individual visits.
Signed-in members may separately choose to link future visit records to their member profile. Only then can the administrator see that member's display name with the recorded public-page activity and compare it with existing quiz service records. This option is not required for signup or study access. Removing profile-link permission removes the saved member links; withdrawing visit-history permission deletes the detailed history and overview-session records associated with the current browser and expires its identifier. Anonymous totals cannot be linked back for deletion. To request deletion of account-linked records from other devices, contact us. Production backups may retain deleted data until their normal rotation; they are restricted and are not used for routine analytics.
When visit measurement is enabled and the administrator has enabled connection records, we also store the visit's most recently observed IP address encrypted in a separate private record. This supports reviewing approximate location and connection context. Only the main administrator can view it in visit details; it is not shown publicly, sent as a field to Google, or used to merge people who share a network. It expires from the active database after seven days, with expired data hidden immediately and deleted during hourly cleanup. Database backups rotate within about seven further days and can temporarily retain encrypted older records. Withdrawing visit measurement removes this browser's active detailed and connection records. The administrator can disable IP records and clear them from the active database independently. IP addresses can be personal information. Browser IDs and associated visit histories are pseudonymous, not anonymous; encryption does not make them anonymous.
Google Analytics and Search Console
Under the regional measurement settings above, Google Analytics measures public-page visits, navigation and resource-link clicks, approximate engagement, broad device/location information and traffic sources. Google uses browser identifiers; these are pseudonymous, not a promise of anonymity. We do not send Google your name, email, account ID, answers, private messages or private-page addresses. No Google analytics tags run on private account, admin, sign-in, messaging or active quiz/result pages. Google may process data internationally under its privacy policy.
Google Analytics follows the regional consent rules described above. Browser choices are remembered for up to 180 days; review them on each device. A compact measurement choice is shown when needed, with Accept, Reject and Settings. Rejecting prevents browser recognition and Google Analytics; saved refusals are never silently changed. A record of submitted choices and the notice version is kept for up to 180 days. Blockers and choices mean Google totals are incomplete. Google advertising consent messages remain separate; these measurement settings do not grant advertising consent or enable personalised ads. Read how Google uses information from partner sites.
Administrators can enable generic browser notifications of increases in the recognised live-session count while their admin dashboard is open. These do not identify a visitor or prove a new unique arrival. Search Console supplies grouped search queries and clicks; these are delayed and never linked to individual visitors. Local learning reports use service records needed for study features, independently of optional analytics. Quiz starts, submissions and results can therefore be counted even when optional browsing measurement is off. First-party visit history is never sent to Google or used for ad personalisation. Newly recorded study-action history is retained for up to 13 months, report caches at most 24 hours and administrator configuration/export audits for 90 days. Detailed operational security records have a separate 30-day limit; they are not used to reconstruct analytics-refusing visits.
Accounts and Google or Facebook sign-in
We store your email address, display name, account status and, if you set a website password, its salted hash rather than a readable password. Hostinger provides our website hosting and sends account verification and password-reset emails through our mailbox service.
If you choose an available Google or Facebook sign-in option, the provider sends us an account identifier, display name and email address when available. We use these details to authenticate you and create or connect your Accounting Ahead account. We request only basic sign-in information, not access to Gmail messages, contacts, Facebook posts or friends. Provider tokens are used during verification and are not retained as account records. The provider handles your sign-in under its own Google privacy policy or Meta privacy policy.
Manage or disconnect a provider in Sign-in options. Disconnecting does not delete your learning records or your Accounting Ahead account. If you have no website password, use Forgot password to set one through your verified email before disconnecting. Signing up or accepting our terms does not consent to personalised advertising.
Your study progress and saved items
When signed in, we store the subjects you explicitly add, topics you mark complete, completion dates, saved topics and the most recent written topics you visit. These support your private dashboard and Continue studying links. Removing a subject from the dashboard preserves its records. A dismissed subject suggestion is suppressed for 30 days.
Study progress is based on your completion choices, not reading time. We do not record study-page keystrokes or store audio/video playback positions in your account. Administrators can review learning records to support students and improve material; moderators receive no additional access to these records.
Quiz records
We store answers, marks, attempt dates, time limits and completion status. We also record active question viewing time, revisits, answer changes, skips and review flags for quiz timing and question-quality analysis. These measures do not establish exactly how long you were thinking. Your signed-in history and responses are private to you and authorised administrators. Public comparisons use aggregated results without student names.
Guest quiz previews use a browser identifier. Registering starts a fresh timed attempt; we record whether it followed a preview without copying preview answers. Browser storage can temporarily hold unsaved quiz answers and reminder state. Your answers, quiz results and learning records are not supplied to advertisers.
Profiles, posts and messages
Your account email is not displayed publicly by the site. Your professional profile stays out of the member directory unless you opt in. Profile settings control professional information, contact preferences and incoming messages. Public posts using your profile identity show your display name and optional photo even when your professional profile is private. Anonymous posts show your forum username and avatar; anonymity is from other visitors, not from authorised administration.
Posts and replies are visible to visitors who can access the community. Uploaded images are stored on the site. Supported image metadata is removed, but personal information visible in an image remains visible. Saved profile-photo and cover replacements remove unused originals from active site storage. Avoid posting private information or material you do not have permission to share.
Direct messages are available to participants. If a message is reported, moderators can review the reported message, and administrators can review that conversation for context. Reports do not expose the participants' unrelated conversations. Blocks, reports and moderation decisions are stored to protect the community. Members can remove their own posts and replies from public view; this may not immediately remove moderation records or backup copies. If you opt in to member email contact, our mail service processes the address and message for delivery without revealing your address to the sender.
Cookies, browser storage and external services
Essential cookies keep you signed in, protect forms and connect one-time sign-in requests. Browser storage also supports quiz recovery, cross-tab progress updates and quiz reminders. See Cookies and advertising for purposes, durations and controls. Clearing essential cookies signs you out and may disrupt an active attempt.
Google Fonts receives technical request information when our fonts load. Following an external resource link takes you to a separate provider with its own privacy practices. Google and Facebook sign-in are separate from advertising choices.
Advertising and your choices
We plan to support free resources with Google AdSense. Advertising is off until it is configured and enabled. Where ads are enabled, third-party vendors including Google use cookies or similar identifiers to serve and measure ads, prevent fraud and, where permitted, personalise advertising based on previous visits to this website and other websites. Google and its partners may combine those signals for ad selection. We do not send them your account email, study answers, scores or private messages.
For visitors in the EEA, UK and Switzerland, the advertising setup uses Google's certified consent message when advertising is enabled. Applicable consent and opt-out requirements in other regions also apply. You can refuse optional purposes or revisit the available choices through Privacy and cookie settings on a page displaying ads. Applicable regional opt-out links are retained. Choosing not to personalise ads does not necessarily remove ads or all advertising-related storage. Signing in and studying do not require consent to personalised advertising or clicking an ad.
See Google's use of information from partner sites, Google's advertising partners and Google My Ad Center for more information and personalisation controls. The consent message identifies applicable vendors and purposes. YourAdChoices offers controls for participating advertising companies. These services' choices can depend on your browser or signed-in account.
Advertising scripts are excluded from the private dashboard, active quiz attempts and result pages, administration, sign-in, account settings, community, profiles and messages. If an ad-blocker reminder is enabled on learning pages, it can be dismissed; it never requires an ad click or withholds quiz results.
Storage, service providers and overseas processing
We use Hostinger for hosting and email. Our selected website server location is Malaysia, so account and learning information is processed outside Australia. Provider support, email, backups and infrastructure may involve additional locations. Google and Meta operate internationally, including in the United States. Their policies explain their processing and safeguards; Hostinger's privacy policy explains its services.
Access is restricted by account role. Connections use HTTPS, passwords are hashed, and provider connection secrets are encrypted on the server. These protections reduce risk but cannot guarantee absolute security. We may disclose relevant information to service providers delivering the site, to deal with security or abuse, or where required by applicable law. We do not sell account, learning or private-message records.
Retention and deletion
We retain account and study records while needed to provide your account and saved history. Removing a dashboard subject or disconnecting Google/Facebook does not erase that history. Expired sign-in and reset requests and temporary security limits are periodically cleared. Backups are rotated and are not used as an active member directory.
Request account deletion, a copy of your information or a correction using your registered email. See Account and data deletion. We verify ownership before acting. Information needed for legal obligations, unresolved abuse reports or security may be retained for those purposes; we will explain relevant exceptions. Deleted information can remain in restricted backups until they expire. Deleting an account does not automatically remove copies others have made of public posts.
Privacy questions and complaints
Email hello@accountingahead.com.au with the relevant page or feature and your concern. Do not send passwords or provider secrets. We aim to respond within 30 days and will let you know if more time or information is needed. You may also contact the Office of the Australian Information Commissioner or your local privacy regulator where applicable.
Changes to this notice
We update the date above when this notice changes. Material changes will be explained on the site; where a change requires a new choice or consent, we will request it. This notice does not give us permission to use your information for undisclosed purposes.
Contact forms and bug reports
When you use our contact form or bug-report form, we store your supplied name, email, category, subject, message, related page address and submission time. If signed in, the request may be associated with your member account. Authorised administrators and moderators can review ordinary enquiries and bug reports; account and privacy requests are restricted to administrators. These requests are not public forum posts. The form does not verify the supplied email address. We may separately verify identity before acting on an account request.
We keep staff replies, internal notes, status changes and email-delivery status to handle the request. Staff can send replies through our configured email provider. Replies you send by email are handled in our support mailbox and are not automatically imported into the website request history. Do not submit passwords, verification codes or unnecessary sensitive information. Attachments are not accepted by these forms.
Private chat invitations let guests and signed-in members exchange messages with the administrator who created the link. We store the conversation label, messages, display labels, timestamps, shared images and short-lived activity status. Anyone holding a link can access its conversation and earlier messages until expiry or revocation, so share links privately. Guest display names are not verified; signed-in senders are labelled Member. JPEG, PNG and WebP attachments are checked and converted to a still WebP image before storage, with embedded metadata removed. Original uploaded files and filenames are not retained. Only share images you are entitled to share, and avoid sensitive information. The invitation is stored in your browser tab session to keep the chat open after refreshing. Chat pages do not load advertising or optional analytics. Administrators can revoke access or delete a conversation; transcripts and attached images are automatically removed from the live system 90 days after link expiry. Routine backups rotate separately and may temporarily retain deleted records. Do not share passwords or other sensitive credentials in chat.
Administrators can separately enable browser notifications for incoming chat messages. This requires browser permission and an open administrator tab. The preference and notification deduplication markers are stored locally for that administrator and browser. Notifications use a generic new-message alert rather than showing message text or images; the administrator can turn them off in the chat notification controls or browser settings.
A first-party, essential security cookie (aa-help or __Host-aa-help) binds the CAPTCHA to your browser for up to 30 minutes. Security challenges expire after 10 minutes and are single-use. Short-lived hashed rate-limit keys help prevent spam; they expire within one hour. When enabled, Google reCAPTCHA v2 verifies contact and bug-report submissions. Loading the widget sends technical information, including your IP address and browser/device information, to Google for abuse prevention and may set security cookies. Google’s Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms) apply. Verification tokens are single-use and expire after two minutes. We do not send the contents of your message to Google for this verification. If you prefer not to use the widget, email hello@accountingahead.com.au. Until Google reCAPTCHA is configured, a first-party security challenge is used. A CAPTCHA reduces automated abuse but cannot guarantee that all spam is prevented.
Open requests are kept while being handled. Closed or spam requests and their staff history are removed from the active request database after 12 months, with cleanup running when the help service is used. Restricted backups and support mailbox copies follow their separate retention arrangements. Contact us if you need access, correction or deletion of this correspondence; deleting a member account does not automatically erase separately stored support requests.