Privacy policy

This policy is a draft and has not yet been reviewed by a lawyer.

This policy explains what personal information Gym Vision collects, why, who sees it and how you can ask us about it. We follow the Privacy Act 1988 and the Australian Privacy Principles (APPs).

Who we are

Gym Vision is run by Design Box Digital Pty Ltd (trading as Design Box), ABN 51 657 551 169. Postal address: 711/1 Queens Rd, Melbourne VIC 3004. In this policy, “we” means that business.

What we collect

• If you send an enquiry to a gym: your name, email address, phone number (if you give one), your message, which gym it is for, and the time you sent it.
• If you ask us to take down a photo: your name, email address, the reason and what you tell us, which photo it is about, and our decision.
• If a gym owner invites you to help manage a listing: your email address, collected from the owner who invited you, and the time of the invite. We use it only to send that one invite email. We do not send reminders or marketing to it.
• If you claim a gym listing: your email address, the sign-in code we send you, and any details you give us when you ask our team to review a claim by hand.
• If you are our staff: your work email address and sign-in details. Passwords are stored in a scrambled form.
• When you use the site: basic technical details needed to run it safely. We count how many times each gym page is loaded, and that count does not record who you are. To limit abuse we use short-lived codes made from your IP address and browser details that cannot be turned back into either. We do not keep your raw IP address for this.
• Anonymous traffic measurement: our host, Cloudflare, measures traffic with Cloudflare Web Analytics, a small script that reports aggregate figures such as page views, the site a visit came from, country, device and browser type, and how fast pages load. Cloudflare says this does not use cookies or local storage on your device, and does not track you across sites or build a profile of you.
• Cookies and security tokens: we use only the cookies needed for sign-in (a short-lived cookie while you verify a claim, and a sign-in cookie for gym owners and for our staff). We do not use advertising cookies. Our enquiry and claim forms use Cloudflare Turnstile, a bot check, which runs a small check in your browser to tell people from bots.

We do not ask for sensitive information such as health details. Please do not put any in an enquiry.

Why we collect it

• to pass your enquiry to the gym so it can reply to you;
• to check that a person claiming a gym listing runs that gym, and to run the owner and staff areas;
• to keep the site secure and stop spam and abuse, and to keep records of changes made on the site;
• to show gym owners simple counts of how many people viewed their listing; and
• to meet our legal obligations.

Enquiries and the gym

When you send an enquiry, the gym receives your name, email address, phone number (if given) and message. The gym is the recipient and is responsible for how it handles that information once it has it, including how it replies to you and how long it keeps it. Ask the gym directly about its own privacy practices. We pass your enquiry on and keep a copy so the gym can read it in its owner area.

Photos on gym listings

Gym owners upload photos and confirm they have the right to use them and that people shown in them have agreed. Our team checks each photo before it shows. If a photo shows you or your child and you did not agree, or it is your photo and you did not give permission, use the “Report this photo” link under it. A photo that shows a person or child, or that someone says is theirs, is hidden as soon as we get your request. We then decide, tell you the outcome and our reason by email, and tell the gym that a request was made. We do not tell the gym who made it.

Who else sees your information

We use service providers to run the site. They handle information for us and not for their own purposes:

• our hosting and database provider, Cloudflare, which also provides the Turnstile bot check and the anonymous traffic measurement described above; and
• our email delivery provider, Twilio SendGrid, which sends sign-in codes and notices to gym owners. It receives the recipient’s email address and the message, and it may process them outside Australia, for example in the United States.

Cloudflare and our email delivery provider may process information outside Australia, including in the United States and other countries where they operate. We take reasonable steps to make sure they handle it in line with the APPs. Our staff can see enquiries and claims where they need to in order to run the service.

We do not sell your personal information. We may also disclose it where the law requires or allows us to.

How long we keep it

• Enquiries: deleted by a daily clean-up once they are 365 days old (about 12 months), so one can stay up to a day longer.
• Photo takedown requests: deleted by the daily clean-up 365 days after we decide them. A photo we did not approve is deleted 30 days after our decision. A photo an owner removes is deleted straight away.
• Page-load counts: kept as daily totals. Gym owners see the last 30 days (or up to a year on some plans). The counts include visits from automated programs such as search engines, so they are an estimate and not a count of people.
• Logs: the change log (who did what on the site), sign-in sessions, claim event records, rate-limit counters and similar security logs are kept for up to 30 days and then deleted by a daily clean-up. This also means we cannot look back at them past that point.
• Team invites: deleted by the daily clean-up 30 days after the invite is used, revoked, replaced or expires. The invite link works once and expires after 7 days.
• Claim records: the record of a claim (the email address used, the outcome and any note a reviewer made) is kept for as long as we need it to run the service and handle disputes. We do not delete claim records automatically yet. You can ask us to correct or delete yours (see below).

When we no longer need personal information, we delete it or de-identify it.

Security

We protect information with measures such as encrypted connections, sign-in codes that are stored in a scrambled form, limits on repeated attempts, bot checks and staff access controls. No system is completely secure, so please tell us at once if you think your information has been misused.

See or correct your information

You can ask to see the personal information we hold about you, or to correct it. Contact us at sales@designbox.com.au. We aim to reply within 30 days. We may need to confirm who you are first. For an enquiry, tell us the email address you used and the gym you wrote to. If we refuse a request, we will tell you why in writing.

Complaints

If you are unhappy with how we have handled your information, contact us first at the address above and we will look into it. If you are not satisfied with our reply, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Marketing and email

We do not send marketing to people who send enquiries. We only send commercial messages with consent, and we follow the Spam Act 2003. Messages to gym owners about their listing, such as sign-in codes and enquiry notices, are service messages.

Listing information

The information on Gym Vision listings is to the best of our knowledge, and we can’t promise it is complete or up to date. Some listing details, such as a gym’s public phone number, come from public sources or from the gym. If a listing has your details and you want them corrected or removed, contact us. See also our terms of use.

Changes to this policy

We may update this policy. The current version is always on this page.