Privacy Policy

Vento Orange ("we", "us", "our") is a software-as-a-service platform operated from Australia, providing booking management software to watersport and action-sport schools ("Schools"). Our platform is accessible at ventoorange.com and its subdomains.

For privacy enquiries, contact us at ventoorange@gmail.com.

School operators (tenants) — When a School applies to use our platform we collect: business name, contact name, email address, phone number, and location. After approval we also store: Stripe payment keys, email provider credentials, and SMS provider credentials provided by the School for the purpose of operating their booking system.

Students — When a student books a lesson through a School's Vento Orange–powered booking page, the following information is collected on behalf of the School: first and last name, email address, phone number, physical details (weight, height) required for safety briefing, emergency contact name and phone, signed waiver record, and lesson/payment history. This data is collected and stored as a data processor on behalf of the School (the data controller).

Platform marketing database — With the student's explicit consent at the time of booking, Vento Orange may retain the student's name, email, sport category, and geographic location in a separate cross-platform database for the purpose of marketing Vento Orange services and partner offers (such as guided tours and events) to students of the sports communities we serve.

Usage data — We collect standard web server logs including IP address, browser type, pages visited, and timestamps. This is used for security monitoring and improving the platform.

• To provide and operate the booking management platform for Schools
• To send transactional emails (booking confirmations, password resets, OTP codes)
• To process payments via Stripe on behalf of Schools
• To send Schools billing and platform communication (trial expiry, plan updates)
• Where consent has been given: to send students marketing communications about Vento Orange, guided tours, events, and affiliated partner offers relevant to their sport
• To improve the platform and detect abuse or security threats

We will never sell personal information to third parties. We do not use student data for advertising targeting on third-party platforms without explicit consent.

We use the following third-party services that may process data outside Australia. By using our platform, Schools acknowledge that student data may be transferred to these services:

• Supabase (database and authentication) — data may be stored in data centres in the United States
• Stripe (payment processing) — United States
• Twilio / ClickSend (SMS) — United States / Australia
• Resend / Gmail / SMTP (email delivery) — United States
• Mailchimp / Klaviyo (optional marketing sync chosen by each School) — United States
• Cloudflare Turnstile (spam prevention) — global CDN

These providers are bound by their own privacy policies and contractual data processing agreements. Australian Privacy Act protections may not apply to data once disclosed to overseas recipients under APP 8.

Student and booking records are retained for the duration of the School's subscription and for up to 7 years thereafter to meet taxation and record-keeping obligations. Schools may request deletion of their tenant data at any time. Student records linked to a deleted school will be anonymised within 30 days unless retention is required by law.

You have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate personal information
• Request deletion of your personal information (subject to legal retention requirements)
• Withdraw marketing consent at any time by emailing us or clicking unsubscribe in any marketing email

To exercise any of these rights, contact ventoorange@gmail.com. We will respond within 30 days.

We implement industry-standard security measures including encrypted connections (TLS/HTTPS), encrypted data storage, row-level security in our database, rate limiting on all public endpoints, and Cloudflare Turnstile bot protection on public forms. Sensitive credentials are stored as encrypted values accessible only to our server-side application.

Despite these measures, no system is completely secure. If you believe your data has been compromised, notify us immediately at ventoorange@gmail.com.

We use only functional cookies required for authentication (Supabase session tokens stored in browser localStorage). We do not use advertising cookies or third-party tracking pixels.

Our platform is directed to sports school operators and adult students. For students under 18, the School is responsible for obtaining parental consent before collecting their personal information. We do not knowingly collect data from children under 13 directly.

We may update this Privacy Policy from time to time. We will notify Schools of material changes by email. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

If you have a complaint about how we have handled your personal information, contact us at ventoorange@gmail.com. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).