Spaces Privacy Policy

Hilltops App PTY LTD (ACN 698 610 007) operates Hilltops Spaces. We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

1. What we collect

• Identity and contact: email address, first name, optional phone number, and any profile photo you upload.
• Space details: venue name, address, city, capacity, bio, images, and answers to the profile questionnaire.
• Team and membership: the users you invite to help manage a space, and their role.
• Messages and inquiries: the content of inquiries from event organisers and the messages you exchange with them through the directory.
• Technical and audit data: sign-in timestamps, IP address, browser and device type, and audit entries for sensitive actions (invite redemption, role changes).

2. Why we use it

• To sign you in and operate your space listing.
• To surface your listing to invited event organisers on the Hilltops Business Portal and route their inquiries to you.
• To send you account, security, and product notification emails.
• To prevent abuse and comply with legal obligations.

3. How we share

Information you publish on your space listing is shared with event organisers who have access to the Hilltops directory. We share operational data with service providers acting on our instructions:

• Supabase / AWS Australia (Sydney) — primary database, authentication, and file storage.
• Vercel Inc. (US, global edge) — hosting and delivery of the Spaces directory.
• Resend (US) — transactional email (invites, sign-in, notifications).
• Cloudflare (global edge) — image delivery for uploaded space photos via media.hilltops.app.

We do not sell operator personal information. We may disclose information where required by law.

4. Where it lives and how long we keep it

Operator data is stored primarily in Sydney (Supabase / AWS Australia). We retain it for as long as your space account is active and for a reasonable period after closure for legal and dispute resolution purposes. Audit logs of sensitive actions are retained for at least 12 months.

5. Analytics

Hilltops Spaces does not run product analytics, session replay, or third-party marketing pixels in this v1 release. If we introduce analytics in the future we will update this policy and, where required by applicable law, gate them behind consent.

6. Your rights

You can:

• Access the personal information we hold about you by emailing support@hilltops.app.
• Correct inaccuracies via the dashboard or by contacting us.
• Delete your space account; some data may be retained as described in section 4.
• Complain to us first, and if unsatisfied, to the Office of the Australian Information Commissioner.

7. Security

We use TLS for data in transit, encryption at rest in the primary database, hashed magic-link tokens, row-level security policies that restrict each operator to their own space, and audit logs for sensitive actions.

8. Children

Hilltops Spaces is not directed at children. You must be at least 18 to register a space.

9. Changes

We may update this policy. When we make material changes we will notify operators by email or via the dashboard and update the "Last updated" date above.

10. Contact

Privacy questions or complaints can be sent to support@hilltops.app. We will acknowledge within 7 days and aim to resolve within 30 days.