Privacy Policy

We collect the information needed to run the booking platform for sports schools ("Schools") and their students. We keep it safe, and we never sell it and never share it with anyone outside the providers we use to run the platform, without explicit authorisation from the School or student it belongs to. The rest of this page explains the details.

Vento Orange ("we", "us") operates a booking platform for watersport and action-sport Schools, at ventoorange.com and its subdomains. For privacy questions, email ventoorange@gmail.com.

Schools — business name, contact name, email, phone, and location when you apply. After approval, we also hold the payment, email, and SMS credentials you connect so your booking system can send messages and take payments.

Students — when someone books through a School's page, we store what the School needs to run that lesson: name, email, phone, physical details relevant to safety, emergency contact, signed waiver, and booking/payment history. We hold this on the School's behalf — the School is responsible for it, and it's the School's agreement with the student, not ours (see our Terms of Service).

Marketing (opt-in only) — if a student explicitly agrees at booking, we keep their name, email, sport, and location in a separate list, used only for our own market research and to send them relevant offers about Vento Orange or guided tours. Never without that opt-in, and they can opt out any time.

Tour operators — when someone submits a listing to our free Tours directory, we collect and publish what they give us: operator name, contact details, location, dates, price, description, and images. This is meant to be public — it's not treated as private data.

Usage data — standard web logs (IP address, browser, pages visited) for security and improving the platform.

• To run the booking platform for Schools
• To send transactional messages — booking confirmations, password resets, OTP codes
• To process payments via Stripe on a School's behalf
• To send Schools billing and account updates
• With explicit consent only: market research and marketing about Vento Orange or guided tours
• To publish Tours directory listings, and do a basic check before publishing them
• To keep the platform secure and catch abuse

We don't sell personal information, and we don't use student data for third-party ad targeting without explicit consent.

We use a small number of providers to run the platform, and data may pass through them as a result. They're bound by their own privacy and data-handling agreements — we don't hand data to anyone else without explicit authorisation.

• Supabase — database and authentication (United States)
• Stripe — payments (United States)
• Twilio / ClickSend — SMS (United States / Australia)
• Resend / Gmail / SMTP — email delivery (United States)
• Mailchimp / Klaviyo — optional marketing sync, only if a School turns it on (United States)
• Cloudflare Turnstile — spam prevention (global)

Because some of these are based overseas, Australian Privacy Act protections may not follow the data once it leaves Australia (APP 8).

Student and booking records are kept for as long as the School is active, and up to 7 years after for tax and record-keeping reasons. Schools can ask us to delete their data any time; students linked to a deleted School are anonymised within 30 days unless the law requires otherwise.

Under the Australian Privacy Act, you can ask to access or correct your information, ask us to delete it (subject to legal retention rules), and withdraw marketing consent any time — email us or hit unsubscribe. Email ventoorange@gmail.com and we'll respond within 30 days.

We use encrypted connections, encrypted storage, row-level database security, rate limiting, and bot protection on public forms. No system is 100% secure — if you think something's gone wrong, tell us at ventoorange@gmail.com.

Just functional ones — session tokens needed to keep you logged in. No ad cookies, no tracking pixels.

Our platform is for school operators and their students. If a student is under 18, it's the School's job to get parental consent before collecting their information. We don't knowingly collect data directly from children under 13.

We'll update this page as needed and email Schools about material changes. Using the platform after a change means you accept it.

Not happy with how we've handled your information? Email ventoorange@gmail.com first. If that doesn't resolve it, you can contact the Office of the Australian Information Commissioner (OAIC).