Privacy policy

What SessionHQ collects, why, how long we keep it, and how you take it back.

About this policy

SessionHQ is operated by Zack Design (ABN 11 405 255 456), 39 Kent Road, Mascot NSW 2020. This policy describes how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For EU/UK users, the equivalent GDPR rights (access, rectification, erasure, objection) are covered below; to exercise them, email info@sessionhq.org.

Controller vs processor

For data entered by a studio operator (member lists, attendance records), the studio is the data controller and SessionHQ acts as the processor on their behalf. For your SessionHQ account itself, SessionHQ is the controller.

What we collect

• Account: name, email, phone, password hash
• Operational: check-in records, pass balances, attendance history
• Payment: Square-tokenised card reference and transaction metadata (never raw card numbers)
• Optional: member photos, emergency contact, medical conditions — only if the operator collects them
• Technical: IP address, user agent, session cookies

Sensitive information (health data)

If your studio collects medical conditions or similar health information, that data is treated as sensitive under APP 6 and APP 11. It is:

• Visible only to staff with an owner/admin/staff role in the tenant
• Excluded from default member-data exports
• Automatically redacted from our error-monitoring system before any engineer can see a crash report
• Scrubbed when a member is anonymised under your right to erasure

Why we collect it

• To provide the service — running check-ins, passes, payments
• Legitimate interests — preventing abuse, audit logging, security, support
• Legal obligations — retaining financial records (7–10 years under Australian tax law)
• Consent — marketing communications (always opt-in, never pre-ticked)

Website widgets

If a studio embeds SessionHQ widgets on their own website, those widgets show only the studio's classes, times, locations and prices. No member data is published, and class availability is shown as a band (“spots available”, “filling up”, “full”) rather than a number.

When a visitor loads a page containing a widget, their browser requests data from SessionHQ. That request carries their IP address and the address of the page they are on, which our hosting provider and error-monitoring provider process to serve the request and to detect faults. We do not use it to build a profile, we set no cookies from a widget, and we do not track visitors across sites. The studio that embedded the widget is responsible for its own website's privacy notice.

Where your data is stored

SessionHQ stores the primary database in Australia (Sydney) via Supabase. Some sub-processors are located outside Australia — see Sub-processorsfor the current list and each provider's region. By using SessionHQ you consent to this cross-border handling for the purposes described above.

Retention

Check-in and payment records are retained as required by tax and consumer law (up to 10 years). Inactive member profiles are automatically anonymised after 3 years of no check-ins. Backups follow a 30-daily + 12-monthly retention schedule and are destroyed at the end of their retention window.

Your rights

• Access — request a JSON bundle of your data
• Correction — correct inaccurate data via your profile or by contacting us
• Erasure — request anonymisation; PII is scrubbed while financial and audit records are retained as required by law
• Objection & withdrawal of consent — opt out of marketing at any time
• Complaint — escalate to a supervisory authority (see below)

Email

SessionHQ sends two kinds of email. Service messages are part of delivering the service and are sent without separate marketing consent: welcome and account-setup messages, member invitations, payment receipts, and pass expiry and renewal reminders. This also includes the follow-up you receive when you are checked in at a studio door as a guest — it contains a link to claim the account created from the name and email you gave at the door, so completing it is part of the service you engaged with. All of these identify the sender and include our business details.

Marketing messages— such as birthday offers, promo codes and “we miss you” prompts from your studio — are sent only where you have given a separate, explicit opt-in at signup (never pre-ticked), and each one carries a functional unsubscribe mechanism as required for commercial electronic messages under the Spam Act 2003 (Cth). You can withdraw marketing consent at any time.

Where your studio has connected an email marketing provider — Mailchimp or Brevo, one or the other, never both — these marketing messages are sent by that provider rather than by us, and your studio — not SessionHQ — controls what is sent. If you have opted in, we share your name, email address, phone number (if you gave one), the date you joined, the day and month of your birthday (we never store or share the year), and your current promotional codes and status labels with that provider so those messages can be personalised. Mailchimp holds this data in the United States; Brevo holds it in the European Union. See our sub-processorspage. If you have not opted in, or you later opt out, we do not place you in the studio’s audience at all. Unsubscribing with the provider also records your opt-out back in SessionHQ.

Data breach notification

We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988. If we become aware of a breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) without undue delay.

Complaints

Contact us first at info@sessionhq.org. If we can't resolve your concern, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au. EU/UK users may contact their national data-protection authority.

Cookies

See Cookies.

Contact

Privacy enquiries: info@sessionhq.org
Post: Zack Design, 39 Kent Road, Mascot NSW 2020, Australia