Privacy Policy

This Privacy Policy explains how Joga Bonito Tour (“JBT”, “we”, “us”), operated by INCASA.DM, collects, uses, stores and discloses your personal information when you use the JBT Inner Circle app and related services (the “App”). We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

1. Who we are

Joga Bonito Tour is operated by INCASA.DM, based in New South Wales, Australia. For any privacy question or request, contact us at info@incasadm.com.

2. The information we collect

• Account details — your email address, and optionally your first name, when you join or create an account.
• Sign-in credentials — a password you set, stored securely (hashed) by our authentication provider. We never see your password in plain text.
• Visit activity — when you scan a partner venue’s QR code, we record the venue and the date/time of your visit. A scan logs a visit only — never a payment, bill total or anything you purchased.
• League activity — if you take part in the JBT foot-tennis league, the scores and results you and your opponent submit.
• Preferences — your notification settings and similar choices.
• Device/technical data — basic information your browser provides (e.g. general location by region, device type) and local storage used to keep you signed in.

We do not collect payment card details, and we have no access to your spending, bills or transactions at any venue.

3. How we use your information

• To create and manage your membership and account.
• To record your visits and show you your own visit history and recognition (streaks, standing).
• To give you members-first access to partner deals, events, giveaways and the league.
• To send you communications you’ve chosen to receive (see “Your choices” below).
• To operate, secure, improve and understand use of the App.

4. What partners can and cannot see

Partner venues can see that a JBT member visited their venue, and when. They do not see your email, your other visits, your account details, or any spending information — and we will never sell your personal information. Aggregated, non-identifying visit counts may be shown to a partner for their own venues.

5. Who we share information with

We share personal information only with service providers who help us run the App, under obligations to protect it:

• Supabase — database and authentication (member data is stored in a Sydney, Australia region).
• Vercel — application hosting.
• Resend — sending our emails.

Some of these providers may process data on servers outside Australia. We take reasonable steps to ensure your information is handled securely wherever it is processed. We may also disclose information where required by law.

6. Storage and security

Your information is protected by access controls and database row-level security, so members can only access their own data and partners only their own venue’s visit activity. No method of storage or transmission is completely secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.

7. Marketing and your choices

We only send marketing communications (such as deal alerts and news) with your consent, and you can change this at any time in the App under Settings → Notifications. Every marketing email also includes a one-tap unsubscribe link. Turning off marketing does not affect essential account messages (such as sign-in or security notices).

8. Accessing, correcting or deleting your information

You can request access to the personal information we hold about you, ask us to correct it, or ask us to delete your account and associated data, by emailing info@incasadm.com. For step-by-step instructions on deleting your account, see Delete Your Account. We’ll respond within a reasonable time.

9. Data retention

We keep your information for as long as your account is active and as needed to provide the App. If you delete your account, we’ll delete or de-identify your personal information, except where we’re required to keep it by law.

10. Children

The App is not intended for children under 16, and we do not knowingly collect their information.

11. Changes to this policy

We may update this policy from time to time. We’ll post the updated version here and change the “Last updated” date above. Significant changes will be communicated in the App.

12. Contact and complaints

For any privacy question, request or complaint, contact info@incasadm.com. If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.