This Privacy Policy explains what information MassageGods ("we", "us") collects, how we use it, who we share it with, and the rights you have over your data.
1. Information we collect
- Account information. Email address, display name, password hash, email-verification status, and your role (Seeker or Therapist).
- Therapist profile information. Photos, biography, services, modalities, languages, suburbs, contact preferences, pricing, and availability you choose to publish.
- Verification documents. Professional credentials you upload are stored in a private bucket and are accessible only to our moderation team. Government ID verification is handled by Veriff; we do not store your ID documents ourselves.
- Payment information. Subscription status, your unique payment reference code, and the transfer amount and date once we confirm your bank payment. We do not accept or store card details.
- Usage and device data. IP address, browser, device, pages viewed, and actions taken (e.g., contact-reveal clicks, search queries). Used for security, rate limiting, fraud prevention, and product improvement.
- Communications. Emails you send us and transactional emails we send to you. We log delivery, bounce, and complaint events.
2. How we use information
- To operate the directory and verify Therapist identities and credentials.
- To process subscription payments and manage billing.
- To send transactional emails (account, verification, billing, moderation decisions).
- To moderate content and enforce our Acceptable Use Policy.
- To prevent abuse, fraud, scraping, and other security threats.
- To analyze traffic and improve the Service.
- To comply with legal obligations.
3. Legal bases (GDPR)
If you are in the EEA or UK, we process your data on the bases of (a) performance of a contract (operating your account); (b) legitimate interests (security, fraud prevention, moderation, product improvement); (c) consent (where required, e.g., non-essential cookies); and (d) legal obligation.
4. Sharing and sub-processors
We do not sell your personal information. We share data only with vetted sub-processors that help us run the Service:
- Lovable Cloud (Supabase). Hosting, database, authentication, and storage.
- Your bank / our bank. Subscription payments are made by bank transfer.
- Veriff. Identity verification for therapists.
- Mailgun (via Lovable Emails). Transactional email delivery.
- Cloudflare. Network, security, and bot protection.
We may also disclose information when required by law, to enforce our Terms, or to protect the rights, property, or safety of MassageGods, our users, or the public.
5. Retention
- Account data: for as long as your account exists.
- Verification documents: deleted within 90 days of a final verification decision unless retention is legally required.
- Email delivery logs: 90 days.
- Contact-reveal logs: 180 days.
- Suppression list (bounces / unsubscribes): retained indefinitely for compliance.
- Backups: rolling 30 days.
6. Your rights
Depending on where you live, you may have the right to access, correct, export, delete, or restrict processing of your personal data, and to object to certain uses. You may exercise these rights from your account settings under "Privacy", or by emailing privacy@massagegods.com. We will respond within 30 days, as required by the Australian Privacy Principles. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC). We never sell your personal information.
7. International transfers
Our infrastructure may store and process data outside your country, including the United States. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.
8. Security
We use industry-standard safeguards including TLS in transit, encryption at rest, row-level security on our database, and role-based access for staff. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.
9. Children
The Service is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us so we can remove it.
10. Changes
We may update this Privacy Policy from time to time. Material changes will be announced on the site and, where appropriate, by email.
11. Contact
Privacy questions or rights requests: privacy@massagegods.com.
Mailing address: MassageGods · PO Box 12345, Collins Street East, Melbourne VIC 8003, Australia.