Legal
Contents
Roundtail ("Your Technology Adviser ABN 74 040 249 078", "we", "us", "our") operates a student nurturing and business intelligence platform for boutique yoga and fitness studios (the "Service"). We are committed to protecting the privacy of personal information we handle in connection with the Service.
This Privacy Policy explains how we collect, use, disclose, store, and protect personal information in accordance with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs").
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.
Roundtail is an Australian software-as-a-service ("SaaS") product operated by Your Technology Adviser. Our infrastructure is hosted in AWS ap-southeast-2 (Sydney, Australia). Our data residency is in Australia except where third-party processors noted in Section 7 operate outside Australia.
Contact details for privacy enquiries:
We collect personal information in two primary capacities.
When a studio owner, manager, or teacher creates an account or uses the Service, we collect:
Studios that integrate Roundtail with their Mindbody Online account authorise us to retrieve and cache the following student data via the Mindbody API:
This data is retrieved nightly and stored in our database solely to power the studio's nurturing dashboard. We do not use it for any purpose unrelated to the studio's service.
Note on health information: Class attendance records at a yoga or fitness studio may, in some circumstances, constitute "health information" as defined under the Privacy Act. We treat all student data with the heightened obligations applicable to health information.
We collect personal information in the following ways:
We collect only information that is reasonably necessary for one or more of our functions or activities (APP 3).
We use personal information for the primary purpose for which it was collected and for reasonably related secondary purposes.
We will not use personal information for direct marketing without your consent, and will not sell or rent personal information to third parties.
We do not disclose personal information to third parties except in the following circumstances:
We take reasonable steps to ensure that any recipient of personal information provides at least equivalent privacy protections to those in this Policy (APP 8).
We engage the following sub-processors. Unless noted otherwise, these providers act as data processors under our instructions and are bound by appropriate contractual terms.
Hosting, compute, and storage in ap-southeast-2 (Sydney, Australia). AWS infrastructure is also used in other AWS regions for some global services.
Serverless PostgreSQL database. Data may be stored in our configured ap-southeast-2 region. Neon operates under its Data Processing Addendum.
The studio's existing booking platform. Student data is retrieved from Mindbody via API at the studio operator's direction. Mindbody's own privacy policy governs data held in their platform.
Payment processing via Stripe Connect. Stripe processes payment card and transaction data under its own Privacy Policy and PCI-DSS certification. Roundtail does not store payment card numbers.
User authentication and identity management. Processes names, email addresses, device and session information for authentication purposes.
Transactional email delivery. Processes email addresses and delivery metadata.
SMS notifications. Processes mobile phone numbers for urgent service notifications (waitlist alerts, payment failure notices).
Product analytics. Collects anonymised usage events. We configure PostHog to minimise collection of personal information.
Cross-border disclosure: Several providers above are based in the USA. We take reasonable steps to ensure these providers comply with the APPs or an equivalent standard (APP 8), including through contractual data processing agreements. By using the Service, you consent to disclosure of your personal information to these overseas recipients to the extent necessary to provide the Service.
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure (APP 11):
We maintain and test an incident response plan. In the event of a data breach that is likely to result in serious harm to individuals, we will notify affected parties and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.
We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law:
When personal information is no longer required, we take reasonable steps to destroy it or ensure that it is de-identified.
You have the right to request access to personal information we hold about you. We will respond to access requests within 30 days. We may charge a reasonable fee for complex access requests.
You have the right to request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading. We will respond within 30 days.
Where practicable, individuals may interact with us anonymously or using a pseudonym. However, providing a genuine identity is generally necessary to use the Service.
You may opt out of non-essential communications at any time using the unsubscribe link in our emails. Transactional messages related to your account cannot be opted out of while your account is active.
If you believe we have handled your personal information in breach of the Privacy Act or the APPs, please contact us first at hello@yourtechnologyadviser.com.au. We will respond within 30 days.
If you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
Our web application uses cookies and similar technologies for:
You may configure your browser to refuse cookies, but some Service features may not function correctly if you do.
The Service is not directed at persons under 16 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.
Our Service may contain links to third-party websites or services. This Privacy Policy does not apply to those sites. We encourage you to read the privacy policies of any third-party sites you visit.
We may update this Privacy Policy from time to time. We will notify studio customers of material changes by email or by a prominent notice within the application at least 14 days before the changes take effect. The effective date at the top of this document will be updated accordingly.
Continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
For all privacy enquiries, access requests, correction requests, or complaints, please contact:
We aim to respond to all privacy enquiries within 30 days of receipt.