Privacy Policy

1.1 We collect personal information that is reasonably necessary for the operation of the Platform and the provision of our services. The types of personal information we collect include:

1. (a) Identity and contact information: full name, email address, phone number, and business name;
2. (b) Payment and billing information: credit or debit card details, billing address, and transaction history (processed via our payment processor, Stripe);
3. (c) Usage and analytics data: how you interact with the Platform, features accessed, session duration, click-stream data, and performance metrics;
4. (d) Device and browser information: IP address, browser type and version, operating system, device identifiers, and referring URLs;
5. (e) Location data: approximate geographic location derived from your IP address or, where you grant permission, precise location data from your device;
6. (f) User-generated content and AI inputs: content, data, text, instructions, queries, and other information you input into the Platform, including content processed by our AI features; and
7. (g) Account and profile information: login credentials (stored in encrypted form), account preferences, and subscription details.

1.2 We collect personal information directly from you when you register for an account, use the Platform, contact us for support, or otherwise interact with us.

1.3 We may also collect information automatically through cookies and similar tracking technologies as described in clause 7 of this Privacy Policy.

2.1 We use the personal information we collect for the following purposes:

1. (a) to provide, operate, and maintain the Platform and our services;
2. (b) to process payments and manage your subscription;
3. (c) to communicate with you about your account, including sending service-related notices, updates, and support messages;
4. (d) to respond to your enquiries and provide customer support;
5. (e) to analyse usage patterns and improve the functionality, performance, and user experience of the Platform;
6. (f) to detect, prevent, and address technical issues, fraud, and security incidents;
7. (g) to comply with our legal obligations; and
8. (h) to send you marketing communications where you have consented to receive them (you may opt out at any time).

2.2 We will not use your personal information for a purpose other than the primary purpose for which it was collected, unless:

1. (a) you have consented to the secondary use;
2. (b) you would reasonably expect us to use it for that secondary purpose; or
3. (c) we are required or authorised by law to do so.

3.1 The Platform incorporates AI-powered features that process content and data you input ("AI Inputs"). By using these features, you acknowledge and agree to the following:

1. (a) Processing and storage: AI Inputs are processed and may be stored by us to deliver the AI features and to maintain the functionality of your account. AI Inputs may include text, instructions, queries, and other content you submit to the Platform.
2. (b) No use for model training: We do not use your AI Inputs to train, fine-tune, or improve our underlying AI models without your explicit prior consent. If we propose to do so in the future, we will notify you and provide a clear opt-out mechanism.
3. (c) Third-party AI providers: Our AI features are powered by Amazon Web Services Bedrock ("AWS Bedrock"), operated by Amazon Web Services, Inc. (United States). Where your AI Inputs are transmitted to AWS Bedrock for processing, we take reasonable steps to ensure that provider is bound by appropriate data protection obligations. AWS's privacy practices are governed by the AWS Privacy Notice, available at aws.amazon.com/privacy. We will update this Privacy Policy if we engage additional material third-party AI providers.
4. (d) Automated decisions: The Platform may use AI to generate recommendations, insights, or outputs relevant to your fitness studio management. These outputs are provided as tools to assist your decision-making and do not constitute binding decisions about you.

3.2 You are responsible for ensuring that any personal information you input into the AI features has been collected and may be shared in accordance with applicable privacy laws.

4.1 We may disclose your personal information to the following categories of third parties:

1. (a) Payment processors: Stripe, Inc. (United States), which processes payment transactions on our behalf. Stripe's privacy practices are governed by its own privacy policy, available at stripe.com/privacy;
2. (b) Cloud infrastructure and hosting providers: Amazon Web Services, Inc. (United States), which hosts and operates the Platform's infrastructure in the AWS Sydney (ap-southeast-2) region. AWS's privacy practices are governed by the AWS Privacy Notice, available at aws.amazon.com/privacy;
3. (c) Analytics and performance tools: providers that help us understand how the Platform is used, such as website analytics services;
4. (d) Customer support tools: platforms used to manage and respond to support requests; and
5. (e) Professional advisors: lawyers, accountants, and auditors, where necessary and subject to confidentiality obligations.

4.2 We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

4.3 We may also disclose personal information where required or authorised by law, including to law enforcement agencies, courts, or regulatory bodies.

5.1 Some of the third parties to whom we disclose personal information are located outside Australia, including in the United States (for example, Stripe, Inc.).

5.2 Where we disclose personal information to overseas recipients, we take reasonable steps to ensure that those recipients handle your information in a manner consistent with the Australian Privacy Principles, including by entering into data processing agreements or relying on the recipient's binding corporate rules or equivalent protections.

5.3 By using the Platform, you acknowledge that your personal information may be transferred to and processed in countries outside Australia, including the United States, which may have different privacy laws to those in Australia.

6.1 We retain personal information for as long as necessary to fulfil the purposes for which it was collected, to provide our services, and to comply with our legal obligations.

6.2 Upon closure of your account, we will delete or de-identify your personal information within 7 days, except where:

1. (a) we are required by law to retain it for a longer period;
2. (b) it is necessary to resolve a dispute or enforce our agreements; or
3. (c) it forms part of aggregated, de-identified data that does not identify you.

6.3 Where your account is inactive, we will retain your personal information indefinitely unless you request deletion in accordance with clause 9 of this Privacy Policy.

6.4 We maintain a defined deletion process to ensure personal information is securely destroyed or de-identified when it is no longer required.

7.1 The Platform uses cookies and similar tracking technologies (such as pixels and web beacons) to enhance your experience, analyse usage, and support the operation of the Platform.

7.2 The types of cookies we use include:

1. (a) Essential cookies: necessary for the Platform to function and cannot be disabled;
2. (b) Analytics cookies: used to collect information about how you use the Platform, including pages visited and features accessed, to help us improve the Platform; and
3. (c) Preference cookies: used to remember your settings and preferences.

7.3 You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the Platform.

7.4 We do not currently use advertising or remarketing cookies. If we introduce these in the future, we will update this Privacy Policy and, where required, seek your consent.

8.1 The Platform is designed for use by fitness studio operators and their staff. We acknowledge that some end users of fitness studios may be under 18 years of age ("children").

8.2 We do not knowingly collect personal information directly from children without the consent of a parent or guardian. If you are a fitness studio operator using the Platform to manage information about children, you are responsible for ensuring you have obtained all necessary consents and have appropriate authority to share that information with us.

8.3 If you believe we have inadvertently collected personal information from a child without appropriate consent, please contact us at privacy@waywize.com.au and we will take steps to delete that information promptly.

8.4 We are monitoring the development of the Australian Children's Online Privacy Code and will update our practices and this Privacy Policy as required when that Code comes into force.

9.1 Subject to applicable law, you have the right to:

1. (a) Access: request access to the personal information we hold about you;
2. (b) Correction: request that we correct personal information that is inaccurate, incomplete, or out of date;
3. (c) Deletion: request that we delete your personal information, subject to our legal obligations and legitimate business needs;
4. (d) Opt out of marketing: unsubscribe from marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us; and
5. (e) Complaints: lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your personal information.

9.2 To exercise any of these rights, please contact us at privacy@waywize.com.au. We will respond to your request within a reasonable time and in any event within 30 days.

10.1 We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification, or disclosure.

10.2 Our security measures include encryption of data in transit and at rest, access controls, and secure infrastructure. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

10.3 If we become aware of a data breach that is likely to result in serious harm to any individual, we will notify the affected individuals and the OAIC in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), where applicable.

11.1 The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies before providing any personal information.

12.1 We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

12.2 We will notify you of material changes by posting the updated Privacy Policy on the Platform and updating the "Last Updated" date at the top of this document. Where required by law, we will seek your consent to material changes.

12.3 Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

13.1 If you have any questions, concerns, or complaints about this Privacy Policy or our handling of your personal information, please contact us at:

13.2 If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.