Privacy policy

1. Who we are

UGuide is run by Co-Perform Pty Ltd (ABN 97 160 781 135), trading as UGuide, based in Victoria, Australia ("UGuide", "we", "us"). This policy explains what personal information we collect, why, who we share it with, and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

You can reach us about privacy through our contact form or at [email protected].

2. What we collect

If you have an account

• Your name and email address, and your password, which is stored only in a scrambled (hashed) form we can't read.
• When you signed up and last signed in.
• The entities (clubs, councils and organisations) and facilities you belong to, your role in each, and the email addresses of people you invite.
• Facility details: name, address, photos, the facility PIN, which members can see so they can pass it on, and the contact for visitors (a name, email address and phone number) if the facility's owners add one. Please only add someone else's details with their agreement.
• Everything you put in a guide: text, photos, videos, documents and video links. Guides are usually about buildings and equipment, but they can include personal information if you add it, such as a contact person's name and phone number. Please only include other people's details with their agreement.
• How you found us, if you came through a link or another website: the first UGuide page you opened, the site that sent you (without the rest of its address), any campaign tags on the link (such as an ad's or flyer's name, or the reference number Facebook, Instagram, Google or LinkedIn adds to its ads' links), and the kind of place you told our home page you look after. Your browser remembers this for up to 90 days, and it's saved with your account only if you sign up, so we know which of our marketing works.

If we're in touch with you about UGuide

We keep a list of people we talk to about using UGuide, such as club secretaries, council officers and accommodation owners. For each person we may keep their name, work email address and phone number, organisation and role, where we got their details (for example their organisation's website or a directory, an event, or because they got in touch), whether they've agreed to hear from us, notes of our calls, emails and meetings, and how far along they are with us. If your details are published for your role, we only use them to contact you about UGuide in that role. Only UGuide staff can see this list. If you later create a UGuide account with the same email address, we can see that you did.

Marketing emails

We send marketing emails, such as product news, only to people who've agreed to them, or whose published work details they relate to, as the Spam Act 2003 (Cth) allows. If you have an account, you only get product news if you turn it on on your Account page.

Resend sends these emails for us. It keeps the names and email addresses we send to, and tells us whether each email was delivered and opened (from a tiny invisible image, if your email app loads it) and which links were clicked (links go through Resend first). Links to our website also carry a tag naming the email, so we know which one brought you. Every marketing email says it's from us and has an unsubscribe link. Unsubscribing, or marking one as spam, stops them all and turns product news off.

If you use UGuide AI

When you ask UGuide AI to help write a guide, we send Anthropic, which runs it for us, what that request needs: the facility's name and suburb, the guide's title, description and section titles (or, for a new guide, the titles of the facility's other guides), the notes you type, and any instructions you ask it to improve. It doesn't get the text of other sections. We keep a record of each request (who asked, when, which guide and what it cost), and keep the notes you typed (and the file name of any guide you import) for 30 days to stop misuse, then delete them.

If you add photos or PDFs when UGuide AI writes a guide, suggests sections or drafts a section, it also gets a smaller copy of each photo and the text of each PDF (read in your browser), to place them in the right sections. We don't keep those copies; only the photos and PDFs you choose to add to the guide are stored, like any you upload yourself. Please don't add photos that show people. If you ask UGuide AI to find manuals online, we send Anthropic the make and model of the equipment and it searches the web for them; the manuals you choose are added to the guide as links to the maker's website.

If you import a guide you already have, as a Word document or PDF, UGuide AI gets its text, and a smaller copy of each picture in a Word document, all read in your browser. We don't keep the document, its text or those copies; only the pictures you choose to add to the guide are stored, like photos you upload yourself.

If you buy licences

Stripe handles payments. We receive the billing name, email, address and ABN you give Stripe, what you bought, and whether payments succeeded. Your full card number goes to Stripe, never to us. If an entity's only owner deletes their account and hands the entity over, we change its billing email at Stripe to the new owner's address, if it was still the old owner's.

If you scan a QR code

You don't need an account to read a guide, and we don't ask for your location. If a section needs a PIN, we record failed attempts against the facility (the time only, nothing about you) to stop guessing. A PIN you enter is remembered in your browser until you close the tab.

If you use Report a problem, we email what you write, any photos or videos you add, your name, email address and phone number (if you give it), and which part of the guide it's about, to the contact the facility has listed and to the people who look after the facility in UGuide (unless they've turned these emails off), so they can fix it and reply to you. If the facility's licence includes reporting (Basic and above), we also keep your report, with those details, photos and videos, so the people who look after the facility can see it in UGuide and keep track of it until it's fixed. Otherwise we delete your photos and videos a day after you send them. Photos are made smaller before they're sent, which also removes the location your phone may have stored in them; videos are sent as they are. To stop abuse, we keep a scrambled version of your internet (IP) address for one day.

So facilities can see whether their guides are used, we count how often each QR code's page is opened each day, how often its PDF is downloaded, and how often it's read in another language and which one. If you use Search this guide, we keep the words you searched for and how many answers they found. None of this is linked to you: we don't keep your IP address, device or anything else that identifies you with it, and the facility's people only see the totals and the words searched. Visits by the facility's own people while they're logged in aren't counted.

If you choose to read a guide in another language, the parts of the guide you can see (its title, description, section titles and instructions, and captions) are sent to Google Cloud Translation to be translated. That's the facility's text, which can include details it has added such as a contact's name or phone number; nothing about you is sent with it. We keep the translation to show the next reader who chooses that language, until the guide changes. Your choice of language is remembered in your browser.

If you contact us

Your name, email, organisation, phone number if you give it, your message and any photos or videos you add, and the page you wrote from. Emails you send us and our replies are kept with your enquiry. To stop abuse of the contact form, we keep a scrambled version of your internet (IP) address for one day. If you write from the Help button, we also keep what you searched the help centre for just before. Our email replies contain a tiny invisible image, so when your email app shows it we note the time you first opened the reply, and our team can see you've read it. If your email app doesn't load images, we don't find out.

If you book a demo or training

What you give us on the form is kept with your request, as for the contact form: also the kind of place, how many buildings or which session, and the link that brought you to our site if it named one. We add you to the people we're in touch with, but asking for a demo doesn't sign you up for marketing emails. The calendar you pick a time in is Cal.com's booking page: it receives your name, email address and anything you add there, and sends you the invitation.

If you use the help centre

To find out which answers are missing, we keep the words people search the help centre for, and how many answers they found, for 90 days. We don't record who searched. When you answer "Was this article helpful?", we only count the answer; your browser remembers it so you can change your mind.

Technical information

Like any website, our hosting providers process your IP address, browser type and the pages you request, to deliver the site and protect it from attacks. We don't use third-party analytics or advertising trackers; the guide counts described above are our own and don't identify anyone.

When something goes wrong in UGuide (a page crashes, or our servers hit an error), we record what happened so we can fix it: the error, the page it happened on, your browser and device type, the steps just before it (the pages you opened, not what you typed), and your account if you're logged in. Email addresses and links' private parts are removed first. These records are stored with the rest of UGuide's data in Sydney, and only UGuide staff can see them.

To keep UGuide fast, about 1 in 10 page loads also records how quickly the page appeared and responded, and how long its requests to our servers took. These timings include the kind of page (not which facility or guide) and nothing about who you are.

3. How we collect it

• From you, when you sign up, build a guide, pay, contact us, or report a problem at a facility.
• From other users: for example, an entity owner gives us your email address to invite you.
• From public sources and people we meet: work contact details an organisation publishes, such as on its website or in a directory, and details people give us at events or when they suggest someone we should talk to.
• From Stripe, about your payments, and from Google, when you choose an address from its suggestions.
• Automatically, through our hosting providers, as described above.

4. How we use it

We use personal information to:

• provide UGuide: run your account, store and show your guides, and let your team work together;
• send emails the service needs, such as confirming your email address, password resets, invites, receipts and replies to your enquiries;
• take payments, issue tax invoices and keep the business records the law requires;
• help you when you ask for support, and fix problems;
• keep UGuide secure, prevent misuse and enforce our terms;
• improve UGuide, using information about how the service is performing;
• tell people about UGuide, and see which of our marketing works, as described above; and
• meet our legal obligations.

We don't sell personal information and we don't use it for advertising. Marketing emails only go to people who've agreed to them, or whose published work details they relate to, and every one has an unsubscribe link.

5. Who sees it

• Your team. Members of your entity and facilities see your name and email address, and the content you add.
• The public. A published guide is meant to be read: anyone at the facility who scans its code can see its public sections, and the facility's contact for visitors if it has one. Sections marked "Needs PIN" only open with the facility PIN.
• A facility's contact. If you report a problem at a facility, your report (with any photos or videos) and contact details go to the person the facility lists as its contact and to the people who look after the facility in UGuide, by email and, if its licence includes reporting, in UGuide too.
• Our staff. UGuide staff can view accounts and guides to give support, investigate problems or when the law requires it. Staff actions are logged.
• Service providers who run parts of UGuide for us (below), only for that purpose.
• Others when required. Our professional advisers (such as our accountant), a buyer of the business, or government agencies and courts when the law requires it.

6. Overseas disclosure

UGuide's database and files are stored in Sydney. Some of the providers above are based overseas or process information outside Australia, mainly in the United States and Japan, and Cloudflare and Stripe operate in many countries. We choose established providers with strong security and privacy commitments, and take reasonable steps so they handle personal information consistently with the Australian Privacy Principles.

7. Keeping it safe

Information travels encrypted (HTTPS) and is encrypted at rest by our providers. The database checks who is asking before every read and write, so people only reach the entities and facilities they belong to. Staff access is limited and logged.

No system is perfectly secure. If a data breach is likely to cause serious harm, we'll notify the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

8. How long we keep it

• Account information: until you delete your account. Guide information: while its entity exists. When you delete something, or your account, it's removed straight away, and from our backups when they expire.
• Billing records and tax invoices: five years, because Australian tax law requires it.
• Support enquiries: as long as needed to help you and keep a record of what we agreed, then deleted. Deleting your account doesn't delete them, but you can ask us to delete them sooner.
• Contact-form and Report a problem abuse checks: one day.
• Photos and videos sent with a problem report that the facility doesn't keep: one day.
• Problem reports kept for a facility: until a year after the facility marks them resolved or dismissed, and at most two years. The facility's owners can delete them sooner, and they go when the facility is deleted.
• Guide visit counts and the words searched for in guides: 13 months.
• Records of errors: 30 days. A summary of each problem (without who it happened to) is kept until 180 days after it was fixed.
• Page speed timings: 31 days.
• Details we keep about people we're in touch with about UGuide: until they ask us to delete them, or we no longer need them.
• Each marketing email we sent and what happened to it (delivered, opened, clicked): until we delete that campaign's record or your details.
• If you unsubscribe from our marketing emails, we keep your email address marked as unsubscribed, so you aren't emailed again.

9. Your rights and choices

• See or correct your information. You can update your name and password on your Account page. Ask us for a copy of the personal information we hold about you, or to correct it, and we'll respond within 30 days. There's no charge.
• Delete your account. You can delete your account yourself, at any time, on your Account page. Your name, email address and password are deleted straight away, and you're removed from every entity and facility. An entity you're the only owner of is handed over to another of its members you choose, or deleted with everything in it, and we show you what will be deleted before you confirm. Content you added to an entity that carries on stays with it. We keep the billing records the law requires, and your support enquiries unless you ask us to delete them.
• Stop marketing emails. Use the unsubscribe link in any of them, turn off product news on your Account page, or contact us. It takes effect straight away.
• Ask us to delete other information. Owners can delete facilities and entities themselves. For anything else, such as your support enquiries or the details we keep about you as someone we're in touch with, contact us.
• Stay anonymous. You can read guides without telling us who you are. We need your name and email to give you an account or reply to you.

If we refuse a request, we'll tell you why and how to complain.

10. Cookies and browser storage

We don't use advertising or analytics cookies, which is why there's no cookie banner. UGuide keeps a few things in your browser so it works properly:

• your sign-in, so you stay logged in;
• a facility PIN you entered, until you close the tab;
• which guides you've opened, until you close the tab, so reloading one doesn't count as another visit;
• a random number for the tab, until you close it, so we can tell how many people an error affected;
• the language you chose for reading guides;
• a promotion code from a link, for up to 30 days;
• how you found us (the page you first opened, the site that sent you, and any campaign tags or ad reference numbers), for up to 90 days;
• the kind of place you chose on our home page, so it shows you the right examples; and
• your QR code print settings and the reporting period you last chose.

Stripe's checkout pages, and YouTube or Vimeo videos when you play one, are run by those companies and may use their own cookies under their own privacy policies. Our hosting provider may use cookies strictly needed for security.

11. Children

UGuide accounts are for adults (18 or older) acting for clubs, councils and other organisations. Anyone can read a public guide, and we don't ask visitors who they are.

12. Automated decisions

We don't use personal information to make decisions by computer alone that significantly affect your rights or interests. Automatic checks, such as licence limits or the facility PIN, apply to facilities and guides, not to judgements about you.

13. Questions and complaints

If you're worried about how we've handled your personal information, please contact us first. We'll reply within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

14. Changes to this policy

We'll update this policy when how we handle information changes, and change the date at the top. If a change is significant, we'll email account holders before it takes effect.