Privacy Policy
How Digital Barista collects, uses, stores and protects personal information, including players' names and photos.
Last updated: 22 September 2026
Digital Barista photographs junior and community sports clubs across South East Queensland. This policy explains what personal information we collect, why we collect it, where we keep it, and what you can ask us to do with it.
It covers our website, our online club and contractor systems, the links we send to coaches and team managers, and our online photo galleries. Some of these services are being introduced during 2027. Where a service isn't running yet, the section about it applies from the day it starts.
We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
The short version
- We store the personal information we hold in Australia.
- Some providers we use to send email, take payments and host our website are based overseas. They're listed below, along with what they receive.
- Children's names and photos are stored only in Australia. Our systems never send a child's name or photo to a provider outside Australia.
- We never sell personal information. Players' photos go only to their club and their family, unless a parent or guardian gives us written permission.
- You can ask to see or correct the information we hold about you at any time.
What we collect, and who it's about
Club contacts
If you deal with us on behalf of a club, we hold your name, your role at the club, your email address and phone number, notes about our dealings with the club, and whether you've agreed to receive marketing emails from us. The default is no. We also hold club addresses, such as the clubhouse, postal and delivery addresses.
Coaches and team managers
We hold your name, your role, and your email address or mobile number. Your club gives us these details along with its team lists, so we can ask you to check your team before photo day.
The first email we send you tells you who gave us your details and why, and gives you a one-tap way to tell us "this isn't me". You don't need an account. We send you a secure link that expires.
Players
Most of the players we photograph are children. We hold each player's name, team and role in the team, and the photos we take of them. These details come from the club's team lists, from corrections made by coaches and managers, and from parents when they register.
Parents and guardians
We hold the details you give us when you register, including your contact details and your child's details, along with your orders and payment records. Card payments are handled by our payment provider, and we don't store your full card details.
Contractors and staff
We hold account and rostering details for the contract photographers who work with us. Our staff use Google Workspace accounts.
People who email us
If you email our staff, your email is held in our Google Workspace mailboxes. Emails to and from known club contacts, and emails our staff choose to file, are also saved to the club's record in our system. We don't store any other email in our system.
Website visitors
If you use the contact form on our website, we collect the details you enter and your message. Like any website, our host receives your IP address and browser details when you visit.
Staff notes
Our staff keep notes on club records. A note can include anything relevant to working with the club, which may occasionally include a player's name.
How we collect it
We collect personal information from you directly, from your club (team lists and contact details), from coaches and managers when they correct team lists, from Google when you choose to sign in with Google, and automatically from our website host when you visit.
Why we use it
We use personal information to:
- book, plan and run photo day with your club
- photograph players and produce the team and individual photos your club has booked
- make photos available to view and order, and process and deliver orders
- contact club contacts, coaches and managers about bookings and photo days
- manage the work of our contract photographers
- answer enquiries sent through our website
- send marketing emails to club contacts who have opted in (you can opt out at any time using the link in the email or by contacting us)
- keep our systems secure and meet our legal obligations.
We never sell personal information.
Children's information
Children's names and photos come from club team lists, coaches and managers, and parents. We use them to run photo day, produce team and individual photos, and make those photos available to the club and to families to view and order.
Children's names and photos are stored only in Australia, in our database and photo storage in Sydney. Our systems never send a child's name or photo to a provider outside Australia. That includes payment details, the emails and text messages our systems send, and the AI tool our staff use to help draft emails.
There is one exception we want to be upfront about. If someone includes a child's name in an email to us or in a message through our website contact form, or a staff member writes an email that mentions a child, that email is held by our email providers, which may store it outside Australia.
Emails we send you about your own child may include their name. Once an email reaches your inbox, it's held by your own email provider.
Apart from providing photos to the club and to the player's family, we don't use players' photos, including in our own advertising, without written permission from a parent or guardian.
Clubs are responsible for having permission to share players' names with us. Parents and guardians can ask us to see, correct or delete their child's information at any time.
Signing in with Google
Club and contractor accounts are by invitation only. If you choose to sign in with Google, Google shares your name, email address and profile picture with us as part of its standard sign-in.
We use your email address to match you to your invitation and identify your account, and your name to show who is signed in. Signing in doesn't give us access to your Gmail, contacts, files or any other Google data. We don't sell or share the information Google gives us, and it's stored with our other sign-in records in Australia.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Where we store it
Our database and sign-in records are stored with Supabase in Sydney. Our photos are stored in Sydney. Our website and app are hosted by Vercel.
Providers outside Australia
These providers are based overseas or may hold data outside Australia:
| Provider | What they do for us | What they receive | Where |
|---|---|---|---|
| Staff email (Google Workspace) and Google sign-in | Sign-in details, and emails sent to and from our staff | Data centres in several countries, including the United States | |
| Resend | Sends our system emails and website contact form messages | Email addresses and message content. Our systems never send a child's name or photo | United States |
| Stripe | Processes payments | Payment details for your order. Never a child's name or photo | May transfer data to other countries, including the United States and India |
| Vercel | Hosts our website and app | Visitors' IP addresses and browser details | Logs may be held outside Australia |
Our staff also use an AI tool (Claude, provided through Amazon Web Services) to help draft emails to clubs. It runs in Australia, it only drafts, and staff review every email before it's sent. It never receives children's information.
Cookies and analytics
Our app uses only the cookies needed to keep you signed in. It doesn't use analytics, tracking or advertising cookies.
Our website doesn't use advertising or tracking cookies.
How long we keep it
- Online galleries are open for 6 months.
- Photos that have been purchased are kept for 3 years.
- Photos that haven't been purchased are removed from our online storage when the gallery closes.
- Team check links expire a set time after the shoot.
- We keep order and payment records for as long as tax law requires.
- We keep club contact details while we work with your club. You can ask us to remove them.
We keep a history of changes to key records, and that history can't be altered. If you ask us to delete your information, we'll remove it from our active records, but a record that a change was made may remain in that history.
You can't yet delete your information yourself through our systems. Contact us and we'll handle it.
Keeping it secure
- Access rules on every part of our database, so people only see what their role needs.
- Hosting in Australia for our database and photos.
- Encrypted connections.
- Two-step verification for staff sign-in.
- Passwords and keys are never stored in our code.
If we become aware of a breach involving your information that is likely to cause you serious harm, we'll tell you and let you know what we're doing about it.
Seeing and correcting your information
Parents confirm the spelling of their child's name when they register, and coaches and managers can correct team lists before the shoot. Anyone can ask us to see or correct the information we hold about them or their child.
Contact us using the details below. We may need to confirm your identity first. We'll respond within 30 days, and there's no charge.
Complaints
If you have a concern about how we've handled your information, contact us first and we'll respond within 30 days. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Changes to this policy
We'll update this policy when our services or the way we handle information changes, including as new services start during 2027. The date at the top shows when it was last updated.
Contact us
Digital Barista Email: danettesmith@digitalbarista.com.au Phone: 0400 706 909