1. Introduction
SmashR ("we", "us", "our") operates the SmashR mobile application and website (getsmashr.com.au), collectively referred to as the "Platform". This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Platform.
We are committed to protecting your privacy in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
By using the Platform, you consent to the collection and use of your information as described in this policy.
2. Information We Collect
2.1 Information You Provide
- Account information: name, email address, phone number, date of birth, profile photo
- Player profile: preferred sports, skill level, location/suburb, play preferences
- Organiser information: business name, ABN (if applicable), bank account details for payouts
- Venue information: venue name, address, court details, operating hours
- Payment information: processed securely by Stripe; we do not store your full card number
- Communications: messages sent through session/tournament chat, support tickets
2.2 Information Collected Automatically
- Device information: device type, operating system, unique device identifiers
- Usage data: pages visited, features used, session duration, search queries
- Location data: approximate location (with your permission) to find nearby sessions and venues
- Log data: IP address, browser type, access times, referring URLs
2.3 Information from Third Parties
- Google Sign-In: name, email, profile picture (if you choose social login)
- Apple Sign-In: name, email (if you choose Apple login)
- Stripe: payment verification status, KYC verification results for organisers
3. How We Use Your Information
We use your personal information for the following purposes:
- To create and manage your account
- To match you with suitable sessions and players based on sport, skill level, and location
- To process bookings, payments, and refunds via Stripe
- To facilitate payouts to organisers and venues
- To send booking confirmations, reminders, and session updates
- To enable in-app chat for session and tournament coordination
- To verify organiser identity through KYC (Know Your Customer) procedures
- To detect and prevent fraud, disputes, and platform abuse
- To improve our Platform, features, and user experience
- To send marketing communications (with your opt-in consent)
- To comply with legal obligations
4. Payment Processing
All payments on SmashR are processed through Stripe, our authorised payment processor. When you make a payment:
- Your card details are entered directly into Stripe's PCI-DSS compliant payment form
- SmashR never sees, stores, or has access to your full card number
- Stripe stores and tokenises your payment information securely
- Platform fees are transparently displayed before you confirm payment
For organisers receiving payouts, Stripe processes identity verification (KYC) and bank account verification. This information is stored by Stripe under their own privacy policy.
5. Data Sharing and Disclosure
We do not sell your personal information. We may share your information with:
- Other users: Your public profile (name, skill level, sport) is visible to other players in sessions you join. Organisers can see participant details for sessions they host.
- Stripe: For payment processing, KYC verification, and payout management
- Supabase: For real-time data storage and authentication services
- Firebase (Google): For push notifications and app analytics
- Law enforcement: When required by law or to protect the safety of users
6. Data Retention
- Account data: Retained while your account is active, and for 2 years after account deletion
- Chat messages: Retained for 90 days for GDPR compliance and dispute investigation, then permanently deleted
- Payment records: Retained for 7 years as required by Australian tax law
- Session history: Retained for 2 years for platform improvement and dispute resolution
- Audit logs: Retained for 3 years for security and compliance
7. Data Security
We implement appropriate technical and organisational measures to protect your personal information, including:
- Encryption in transit (TLS/SSL) and at rest
- Secure authentication with JWT tokens and refresh token rotation
- Role-based access controls for admin operations
- Regular security audits and monitoring
- PCI-DSS compliant payment processing via Stripe
8. Your Rights
Under the Australian Privacy Act, you have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or outdated information
- Deletion: Request deletion of your account and personal data (subject to legal retention requirements)
- Opt-out: Unsubscribe from marketing communications at any time
- Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached
To exercise any of these rights, contact us at privacy@getsmashr.com.au.
9. Cookies and Tracking
Our website uses essential cookies for functionality and analytics cookies to understand usage patterns. You can control cookie preferences through your browser settings. Our mobile app does not use cookies but may use device identifiers for analytics.
10. Children's Privacy
SmashR is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. For users aged 13–17, parental or guardian consent is required at registration. Our Under-16 tournament categories require parental consent forms.
11. International Data Transfers
Your data is primarily stored in Australia (AWS ap-southeast-2 region). Some data may be processed by our service providers in other jurisdictions. Where this occurs, we ensure appropriate safeguards are in place in accordance with the APPs.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Continued use of the Platform after changes constitutes acceptance of the updated policy.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at:
SmashR Privacy Team
Email: privacy@getsmashr.com.au
Website: www.getsmashr.com.au