1. Who we are and what this policy covers
1.1 RallyVora is operated by WEIPU PTY LTD (ABN 39 697 809 331) (we, us or our). Our website is https://www.rallyvora.com. We have appointed a Privacy Officer responsible for overseeing our compliance with this Privacy Policy and the Australian Privacy Principles (APPs). For privacy enquiries, access or correction requests and complaints, you may contact our Privacy Officer at weipuau@gmail.com. Correspondence may also be addressed to The Privacy Officer, WEIPU PTY LTD, 302/23 Frew Street, Adelaide SA 5000, Australia.
1.2 This policy explains how we collect, hold, use and disclose personal information when you use RallyVora, contact us or apply to provide services through it, in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Personal information includes information or an opinion about an identified or reasonably identifiable individual, including an individual coach, business operator or organisation representative. Our initial service region is Australia.
1.3 Users can discover and participate in activities, book venues or coaches, and join clubs. Clubs with the necessary permissions organise and publish activities; venues operate facilities and provide booking services; coaches provide lessons and booking services. A venue or coach does not obtain a separate right to publish activities merely by holding that role. This policy covers our handling of information; independent service providers are responsible for their own handling when delivering their services. Our Terms of Service, Payment, Cancellation and Refund Policy, and Service Provider Agreement address the associated contractual arrangements.
2. Information we collect and how we obtain it
2.1 We obtain information from you, from actions you take in RallyVora, from an organisation or service provider dealing with your participation or booking, and from the authentication and payment providers you use. Where we collect sensitive information (such as health or fitness information), we will only do so with your consent, unless an exception under the Privacy Act 1988 applies, and we will use or disclose it only for the purpose for which it was collected or a directly related purpose you would reasonably expect. Some information, such as an account, booking or payment status, is generated through the service. The categories below depend on the feature and your role. You do not need to provide every category.
2.2 Accounts and profiles. We handle your email address and/or phone number, account identifier, password verifier where password sign-in is used, chosen profile details, role, account status and creation/update records. Optional profile fields may include display name, avatar, gender, biography, city and sports preferences. RallyVora stores its password verifiers as hashes rather than readable passwords. The app also stores session credentials on your device to maintain sign-in.
2.3 Apple and Google sign-in. If you choose an enabled provider, we receive and verify its identity assertion and may receive a provider subject identifier and verified email claim. We record the provider, issuer, subject, account association and email claim where supplied. Matching email addresses do not automatically merge accounts. Linking a sign-in method requires proof of control of the existing RallyVora account and the provider account. We do not receive your Apple or Google password. An Apple authorisation grant may be held in encrypted form to support later revocation; it is not general access to your Apple account.
2.4 Email authentication. Where email registration, verification or recovery is offered through Supabase Auth and Resend, these services process the email address, authentication request and delivery information needed to provide it. Availability depends on the sign-in options offered in your release. Authentication emails are service messages, not permission for marketing.
2.5 Activities and participation. We handle activity descriptions and images, sport, timing, capacity, prices and rules, selected places, registrations, cancellations, check-ins and self-assessed sport level. Participation records may include groups, partners, rounds and court assignments. Activity summaries can be calculated from participation records and planned durations; they are not measurements from body sensors.
2.6 Bookings and coach requests. We handle the relevant user and provider identifiers, booking name, venue/court/lesson or requested service, selected slot or preferred time, time zone, sport, lesson format, notes, price, currency, order number, status and cancellation details. Free or pay-at-venue bookings can still create booking and order records. A coach contact request and a confirmed paid lesson order are different records. Please avoid placing unnecessary health information or other sensitive details in free-text notes.
2.7 Clubs and provider applications. We handle organisation information, memberships and roles, joining requests and messages, invitations, decisions and history. Provider applications may contain the representative's name and contact details, business details, ABN where applicable, addresses, services, prices, availability, authority to act, declarations and review history. Requested supporting files may include qualifications, insurance, first aid/CPR, child-safety, licence, occupancy, fire-safety or ownership evidence. Some material may contain sensitive information or information about another person. Only provide material necessary for the stated purpose, with authority to provide it, and redact unrelated details. Where sensitive-information consent is required, a general acceptance of this policy does not replace that consent.
2.8 Uploads and correspondence. Uploading a file sends it to RallyVora storage even if you have not yet submitted the rest of an application. We handle the file, owner, filename, type, size and related identifier or metadata. Messages and attachments sent to our contact mailbox are also collected. Complaints and payment disputes can include information supplied by the other party; section 3 explains the financial records involved. Submitting material privately does not by itself publish it in a provider listing.
2.9 Location and searches. With your device permission, the app can process coordinates and accuracy while you use location features to find nearby services, identify an area or calculate distance. These location features do not use background location tracking. You can select a city or place manually. We process search words and filters such as sport, date, city, distance, price and location. Selected places may be saved with coordinates, a Google Place ID, source and selection time. Locations included in a public activity or provider listing may be visible to others.
2.10 Training and assistant features. Available training content and activity summaries may use your selected sport, preferences, participation information or choices. These automated features do not make decisions that produce legal or similarly significant effects on you. If you have concerns about automated processing, you may contact us using the details in section 1. The assistant uses rules and available service records to suggest options and create local drafts; a draft does not itself book or pay for a service. These assistant functions do not send your conversations or training records to an external generative-AI provider. This policy does not give permission to use your content to train a general-purpose AI model. Any materially different AI processing requires appropriate notice and any necessary consent before use.
2.11 Notifications, local data and technical records. We handle in-app notifications and read status. Your device or browser may retain session credentials, language/region choices, sports preferences, reference data and drafts. Our infrastructure and service providers may process connection, request, security, error and operational records to run and protect the service. Clearing local storage or signing out does not delete server records. To raise a concern with our staff, use the contact in section 1.
3. Payments, financial permissions and Stripe onboarding
3.1 Payment information. Where online payment is offered, Stripe processes payments through the checkout integrated with RallyVora. Payment availability depends on the methods actually displayed for your order and device. Stripe receives payment credentials through its payment interface; RallyVora's business records do not store full card numbers or card security codes. Stripe may process device, connection, billing and risk information under its own terms and privacy notice.
3.2 Apple Pay and Google Pay. When one of these wallet options is available and you select it, Apple or Google processes the wallet request under its own terms. The wallet provides the payment information needed for the transaction to be processed through Stripe. These are wallet options in the Stripe payment flow, not three separate RallyVora collection systems. The wallet and Stripe may each process information needed for authentication, transaction handling and fraud prevention. Selecting a wallet does not give RallyVora your Apple or Google password, access to unrelated wallet transactions, or your device biometric information.
3.3 Order and transaction records. We keep information needed to operate the order and reconcile it: user, provider and order identifiers; service and price details; amounts and currency; payment-method category; payment attempts and Stripe references; authorisation, capture, expiry, cancellation, refund, dispute and settlement status; fees and adjustments; and relevant timestamps. A temporary authorisation and a completed charge are different events. Stripe receives the amount, currency, references, merchant/platform routing information and related metadata needed to process and report the transaction. The payment arrangement creates the payment on the platform's Stripe account and directs funds to the connected recipient; this does not mean every connected recipient can see all platform records.
3.4 Payment acknowledgement and cancellation evidence. Where you confirm payment terms or a cancellation/refund proposal, we record the relevant user, order and provider, the terms or proposal version, content snapshot and integrity identifier, order snapshot, confirmation and time. Cancellation and dispute records may include reasons, responsibility assessments, messages, supporting file references, fee quotations, proposals, party confirmations and outcomes. Chargeback records may include the payment reference, disputed amount, reason, evidence and response history. These records help establish what was shown or agreed and resolve the matter; accepting payment terms is not blanket consent for unrelated data use.
3.5 Provider onboarding. Where Stripe Connect onboarding is available, you enter Stripe's required verification and payout information in a Stripe-hosted flow. Stripe may request identity, business, contact, address, date-of-birth, tax, government-document and bank/payout details according to its requirements. We send account-setup and authorised contact information and retain Stripe account/platform identifiers, onboarding request history, verification and capability status, and outstanding requirements returned by Stripe. The hosted flow does not provide RallyVora with your Stripe password or full bank/card credentials. A temporary onboarding link is used to open that flow and is not a public profile link.
3.6 Financial access and audit records. Binding an account, requesting a refund, viewing financial records and managing financial access require separately assigned permissions for the individual acting for the provider. A club, venue or owner title alone does not give all those permissions. We record relevant grants, revocations, actors, scope and actions for accountability. Where a financial export is available, records can also include who exported it, the provider, period, purpose, record count and integrity identifier. We use financial information for reconciliation, disputes and applicable record-keeping obligations. We may disclose information to tax authorities where legally required.
4. Why we use information and who can see it
4.1 We collect, hold, use and disclose personal information for the following purposes: (a) to create and secure accounts and authenticate users; (b) to provide and administer platform services including bookings, payments, venue and coach listings, club management and customer support; (c) to personalise and improve the user experience and develop new features; (d) to comply with our legal and regulatory obligations; and (e) for any other purpose disclosed to you at or before the time of collection. We limit collection, use and disclosure to what is reasonably needed for the relevant purpose and applicable law.
4.2 Published activities and provider listings may be visible to other users or visitors. Activity participant lists can show display name, avatar and self-assessed level; ordinary account email and phone number are not public participant-list fields. Listings may show selected business contact details. Information intentionally made public may be copied by others. Avoid including private contact, identification or health information in material intended for publication.
4.3 The relevant organiser, venue, coach or authorised staff can receive information needed to administer participation, deliver a service or resolve its booking. Provider applications and supporting evidence are handled as private material for the applicant and authorised reviewers, rather than public listing content. Financial access is separately controlled as described in section 3.6. We do not treat all provider staff as entitled to all user or financial information.
4.4 We share relevant information with the technical providers described in section 5 and with authorised personnel or advisers dealing with support, accounting, legal, safety or security matters. To address a cancellation, complaint or chargeback, relevant facts and evidence may be shared with the other party, authorised reviewers, Stripe and payment institutions involved. Only material needed for the matter should be supplied or disclosed; unrelated personal information should be removed where practicable. Authorities may receive information where required or permitted by applicable law.
4.5 Independent providers may create and keep their own service, attendance, accounting and complaint records. Their obligations and privacy notices apply to their independent handling. This does not remove our responsibility for information we handle or disclosures we make. Contact us if you are unsure which organisation holds the information you seek.
4.6 Service communications about accounts, bookings or payments are distinct from direct marketing. Using RallyVora or receiving service messages does not by itself constitute consent to marketing or unrelated commercial disclosure. Before using personal information for a purpose requiring additional notice or consent, we will provide that notice and obtain the required consent. Any direct marketing must include the choices and opt-out arrangements required by applicable law.
5. External services and overseas handling
5.1 We use external services for hosting, authentication, maps, email, payments and weather where the corresponding feature is enabled. Personal information may be disclosed to overseas recipients located in countries including the United States (AWS, Stripe, Google), Norway (met.no), and other countries where our service providers operate, in accordance with APP 8. Overseas handling may include hosting, backups, customer support and verification. We take the steps required by applicable law in connection with overseas disclosures. Accepting this policy does not waive those obligations.
5.2 AWS and website infrastructure. We use AWS-hosted infrastructure for application services, business records and uploaded media. Hosting and network services also handle connection and operational information. Information held for these purposes may be processed in the service provider’s hosting, backup and authorised support locations.
5.3 Apple, Google and maps. Apple and Google handle their sign-in and wallet services as described above. Google Maps Platform processes map/place queries, selected locations or coordinates and associated technical requests where those features are used. Opening an external map link also sends the place and connection information to the map provider. These providers' own notices apply to their processing; our disclosure and integration responsibilities remain ours.
5.4 Authentication, delivery and correspondence. Supabase Auth and Resend process email-authentication and delivery information where that feature is enabled. Google Gmail processes messages and attachments sent to our privacy contact mailbox.
5.5 Stripe. Stripe handles payment, verification, risk and connected-account information described in section 3 under its applicable arrangements and privacy notice (https://stripe.com/au/privacy). We separately hold our order, consent, dispute and provider-access records. Closing a RallyVora account does not automatically erase information Stripe must retain under its own applicable obligations.
5.6 Weather. Our server requests forecasts from the Norwegian Meteorological Institute, met.no, using a rounded location or selected city coordinates and service identification. This shares the requested location and server connection information, rather than forwarding your RallyVora sign-in token or device request headers. It is not permission for background tracking.
5.7 Website and local storage. Our company-information website uses local assets. Its hosting services may process access records. The app or browser may store session credentials, preferences and drafts needed for the features you use. You can manage local storage through your device or browser; doing so does not delete server records and may affect functionality.
6. Security, storage and retention
6.1 We use access restrictions, password hashing, session controls, private-file checks and relevant audit records to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Safeguards must be appropriate to the sensitivity and volume of information. Only authorised people should access information for their assigned work. No transmission or storage method is completely secure. We do not represent these controls as a security certification or promise that all device data is encrypted.
6.2 Retention is determined by record category and purpose, not a universal period after account closure. Account/profile data, drafts and technical logs are kept only while reasonably needed for the service, security or another applicable purpose. Company financial records that explain transactions and financial position must generally be retained for at least seven years after the transactions covered by the records are completed; most tax records have a five-year requirement, subject to the applicable starting point and exceptions. Where both apply, the longer applicable requirement is followed. Booking, payment, consent and dispute evidence is retained to the extent needed for outstanding services, legal claims, reconciliation or an applicable record-keeping obligation. Provider verification documents and sensitive evidence require a separate purpose and retention assessment; they are not automatically all seven-year financial records. Legal holds are limited to the relevant records. When information is no longer needed and no legal or court requirement justifies retention, we take reasonable steps to destroy or de-identify it. Backups require controlled expiry or deletion and restricted use; we do not promise that account closure immediately removes every backup. Contact the Privacy Officer for the handling applicable to a particular record.
6.3 Payment acknowledgements, dispute evidence and financial-access records are retained only for the applicable purposes and requirements described above. Access to retained information must remain limited to authorised purposes. Copies in backups and records held by independent providers require their own handling; account closure does not necessarily remove every copy immediately.
7. Access, correction and account deletion
7.1 Contact us using section 1 to request access to or correction of your personal information. We may ask for reasonable information to verify identity and locate records, without requesting unnecessary sensitive documents. We will respond within a reasonable period and explain any applicable refusal and available complaint options. Updating a profile does not automatically change an independent provider's records; we can help identify the relevant holder.
7.2 You can contact us to request account deletion. If a self-service deletion option is available for your account and release, it requires identity verification, which may use your password or a fresh proof from a bound sign-in provider, and explicit confirmation. A supported request records its status and may require resolution of blockers before it can complete. Please use the email contact if the option is unavailable, fails or does not support your linked identity.
7.3 Deletion may require decisions about active bookings, club or provider responsibilities, refunds, financial records and disputes. We will explain the applicable handling and any justified retention. A technical blocker is not itself a legal basis for retaining information indefinitely. Removing your profile does not necessarily erase material another person or independent provider lawfully holds. Identity-provider revocation, provider-held records, logs and backups require their own handling; we do not promise immediate deletion from every system.
7.4 Signing out, uninstalling the app or unlinking a sign-in method is not account deletion. Revoking a linked identity does not necessarily end every session held by that identity provider. A deletion request is also distinct from cancelling a booking or obtaining a refund under the Payment, Cancellation and Refund Policy.
8. Children and young people
8.1 Information about children requires particular care. APP 1.3 concerns having a clearly expressed, up-to-date privacy policy; it is not a rule authorising collection of sensitive information about children. Collection must meet applicable APP 3 requirements, including necessity and consent for sensitive information unless an exception applies, and applicable APP 5 collection-notice requirements. Capacity to consent must be assessed in the circumstances; a child's capacity is not established merely by accepting general terms. When providing a child's information, supply only what is necessary and ensure you have authority and any required consent. Do not put private contact details, identity documents or health information in public content. Contact our privacy address about inappropriate handling. Service eligibility is separately addressed in the Terms of Service and the relevant service conditions.
9. Choices and privacy complaints
9.1 You can manage location and photo permissions through your device or browser and avoid supplying optional profile information. Where processing depends on your consent, contact us or use the relevant available setting to withdraw it. Withdrawal does not undo earlier lawful processing or remove a separate lawful retention requirement. We will explain any effect on the service. Without information necessary to authenticate, book, pay or verify a provider, we may be unable to provide that particular feature. You may make a general enquiry without giving your full identity where practicable.
9.2 Send privacy questions or complaints to weipuau@gmail.com or the correspondence address in section 1. Describe the issue and the outcome you seek, and avoid unnecessary sensitive attachments. We will review the information, respond within a reasonable period and explain the outcome or further steps. We may ask for information reasonably needed to understand the issue or verify your authority to make the request.
9.3 If the matter falls within the jurisdiction of the Office of the Australian Information Commissioner (OAIC), you may complain to it after first giving us a reasonable opportunity to resolve the matter. Information is available at OAIC privacy complaints (https://www.oaic.gov.au/privacy/privacy-complaints). This policy does not limit your rights under applicable law or require you to waive a complaint or remedy.
10. Data incidents and policy changes
10.1 If we become aware of a data incident, we will assess and respond to it promptly and make any notifications required by applicable law. Where the Australian Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 applies, we will follow its assessment and notification requirements, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required. Our NDB notification will include a description of the breach, the type of information involved, recommended steps individuals should take to protect themselves, and our contact details for further information.
10.2 We will update this policy when our practices change and provide at least 14 days' prior written notice of material changes via email or in-app notification. Where a new use or disclosure of personal information is materially different from the purposes for which it was originally collected, we will obtain your explicit consent before the processing begins, unless an exception under the Privacy Act 1988 applies. Continued use is not blanket consent to all future purposes. A revision date identifies a document version; it does not by itself prove an individual's consent.
Contact
Privacy questions: weipuau@gmail.com
Account closure and data requests: Account deletion.