Privacy Policy

1. About this Policy

This Privacy Policy explains how OCEANSKY ENTERPRISES PTY LTD (ABN 54 699 634 387), trading as Chance Lab, collects, holds, uses and discloses personal information in connection with the Service.

Chance Lab is operated from Australia. We manage personal information in accordance with applicable Australian privacy law and the commitments in this Policy.

2. Scope and key concepts

This Policy applies to the Chance Lab website, accounts, Free and Plus features, subscriptions, support and related communications. “Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

This Policy should be read with the Terms of Use and the Cookie and Similar Technologies Statement.

3. Information we collect

3.1 Account and profile information

We may collect your name or display name, email address, account identifier, authentication and account-status information, preferences and settings. We do not need to know or receive your password in readable form.

3.2 Subscription and transaction information

When you purchase or manage Plus, we may receive Stripe customer, subscription, checkout and payment-status identifiers; plan and Billing Period; status, transaction date, amount and currency; limited payment-method information such as card brand and last four digits; and cancellation, renewal, refund and subscription-status information. Stripe processes payment-card data. We do not intend to receive or store complete card numbers or security codes.

3.3 User-created data

We may collect permitted number combinations, saved selections, analytical choices and related information that you create, save or upload. Users must not upload official Powerball or other lottery draw datasets through user-combination features.

3.4 Technical and usage information

We may collect IP address, device type, operating system, browser type and version, approximate location inferred from IP, access dates and times, pages and features used, login and account activity, error, diagnostic, security and audit logs, referral information, and session or similar technical identifiers.

3.5 Communications

When you contact us or interact with our emails, we may collect contact details, enquiry content, correspondence, delivery, bounce and unsubscribe information, and records relating to support, privacy, deletion or complaints.

3.6 Information we do not request

Do not send complete card information, identity documents, health information or other sensitive personal information by email unless specifically requested through an appropriate secure process for a lawful reason.

4. How we collect information

We collect personal information directly from you; automatically from your browser, device and use; from Stripe for checkout, subscriptions and payments; from Google for email transmission and delivery administration; and from service providers acting for us.

If you do not provide information reasonably required for an account, subscription or requested function, we may be unable to provide it. Where lawful and practicable, general public information may be browsed without identification or an account.

5. Why we collect, use and disclose information

We may handle personal information where reasonably necessary to:

create, authenticate, administer and protect accounts;

provide Free and Plus features and permitted saved combinations;

process checkout, subscriptions, renewals, cancellations and refunds;

confirm payment and determine Plus access eligibility;

send verification, reset, receipt, subscription, service and security communications;

provide support and respond to requests;

operate, maintain, test and improve the Service;

understand feature use and product performance;

detect and prevent fraud, misuse, threats and unauthorised access;

maintain operational, security and audit logs;

enforce policies and comply with legal, taxation, accounting and record-keeping obligations;

establish, exercise or defend legal claims;

manage a genuine restructuring, financing, merger or sale; and

send marketing where consented or otherwise permitted by law.

We will not use personal information for a materially different purpose unless you consent or law authorises or requires it. We do not sell personal information.

6. Service communications and marketing

6.1 Service communications

We may send account verification, password reset, security alerts, receipts, subscription information, material service or policy notices, and responses to support or privacy requests. These are operational communications and may be necessary while an account or subscription remains active.

6.2 Marketing communications

Optional marketing emails are sent only with appropriate consent or another lawful basis. Marketing consent is separate from accepting the Terms and necessary service communications. You may unsubscribe through the email function or by contacting us. Unsubscribing does not stop necessary account, transaction, security or legal communications.

7. Cookies and similar technologies

We may use cookies, session identifiers and similar technologies reasonably necessary to keep users signed in, maintain security, remember settings, operate subscription-gated access, prevent fraud, diagnose errors and understand use of the Service.

Chance Lab does not currently use third-party advertising cookies, behavioural advertising pixels or third-party analytics tools. Details are in the Cookie and Similar Technologies Statement.

8. When we disclose information

We may disclose personal information to Stripe; Google through Gmail or Google SMTP; hosting, database, infrastructure, security, backup and technical-support providers; professional advisers; regulators, courts, law-enforcement or authorities where required or authorised; parties to a genuine corporate transaction under safeguards; and persons you direct or consent to.

Service providers may access information only as reasonably necessary for their functions, subject to applicable contractual, security and legal obligations. We do not disclose user-created combinations as official Chance Lab lottery data.

9. Overseas storage and disclosure

Chance Lab is operated from Australia, but its principal application and user-data hosting is currently in the United States. Personal information may be stored in, accessed from or disclosed to recipients in the United States.

Stripe and Google operate internationally, and their processing locations may extend beyond Australia and the United States. Their current privacy information is available at stripe.com/privacy and policies.google.com/privacy.

Before an overseas disclosure, we take reasonable steps required by applicable law, which may include provider assessment, contractual protections, data minimisation, access controls, security measures and monitoring material changes. Overseas privacy protections and remedies may differ from Australia.

10. Security

We take reasonable technical, organisational and administrative measures against misuse, interference, loss, unauthorised access, modification and disclosure. Depending on the system, these may include access controls, authentication, limited administrative access, secure password handling, encrypted transmission, logging, monitoring, maintenance, vulnerability management, backups, recovery, vendor assessment, confidentiality obligations and incident response.

No electronic system is completely secure. We respond to suspected incidents and take reasonably required remedial action. You must protect credentials and promptly report suspected unauthorised access. Where applicable, we assess eligible data breaches and make notifications required under the Notifiable Data Breaches scheme or other law.

11. Data quality

We take reasonable steps to keep personal information accurate, current, complete and relevant. You should update account details and tell us about inaccuracies. Certain transaction records originate from Stripe, and payment-method corrections may need to be made through Stripe.

12. Retention and deletion

We retain personal information only as long as reasonably necessary for the purposes in this Policy or as required or authorised by law, considering account and subscription status, information type, purpose, security, fraud, disputes, legal and accounting obligations, backup cycles and legal claims. When no longer required, we take reasonable steps to delete or de-identify it.

12.1 Account-deletion requests

Users may request deletion through the account function. Before completion, we may verify identity and authority, address an active Plus subscription, preserve legally required or permitted records, prevent fraud or abuse, and explain backup or legal-record limitations. A deletion request does not itself cancel an active subscription. Backup information may be isolated and removed under the backup cycle. Aggregated or effectively de-identified information may be retained.

13. Access and correction

Subject to applicable law, you may request access to personal information and correction of inaccurate, outdated, incomplete, irrelevant or misleading information. Some information can be updated through account settings; otherwise contact us. We may verify identity.

We respond within a reasonable period and ordinarily do not charge for requests. Where law permits refusal or limitation, we ordinarily provide written reasons and complaint options unless prohibited.

14. Rights and choices

Depending on law and circumstances, you may access or correct information, update account details, unsubscribe from marketing, request deletion, withdraw consent where processing depends on it, object or complain, and contact a regulator. Withdrawal does not affect earlier lawful processing.

Some information is necessary for an account or subscription; deleting it or withdrawing necessary permission may prevent continued service. Chance Lab does not presently make decisions producing legal or similarly significant effects solely by automated processing of user-created number combinations.

15. Children and age-restricted services

Account, lottery-analysis and Plus functions are only for people aged 18 or older. We do not knowingly permit a person under 18 to create an account, use age-restricted analysis or purchase Plus.

If we learn that information was collected from a person under 18 through an age-restricted function contrary to our requirements, we will investigate and delete or appropriately handle it subject to legal obligations. A parent or guardian may contact us. General public educational content does not authorise under-18 account use.

16. Privacy complaints

Contact us, describe the issue with enough information for investigation, and do not send complete card details or unnecessary sensitive information. We will acknowledge and investigate within a reasonable period and seek to give a substantive response.

If dissatisfied, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. Another privacy or consumer authority may also be available depending on where you live.

Where practicable, use “Privacy Request” in the email subject. Do not email complete payment-card information.

18. Changes to this Policy

We may update this Policy for changes to services, data practices, providers, storage locations, law, security or operations. The updated document will be published on this page with its effective date.

If a material change is likely to adversely affect existing users, we will provide reasonable notice where practicable and obtain consent where required. We will not treat continued use as consent where express consent is required. Previous versions may be retained for legal, audit and governance purposes.