Privacy policy

1. What we collect

When you use the MMC website, iOS app, or services, we collect:

• Identity & contact information — name, email address, phone number, postal/marina address.
• Account credentials — encrypted password hash (we never store your raw password) via Supabase Auth.
• Vessel & licensing information — vessel name, marina, boat registration, driver's licence number (required to hire motorised water toys).
• Location data — precise GPS pin you drop for yacht-side delivery, plus crew real-time location (only while a delivery is active and the crew member has enabled location sharing).
• Payment information — handled and tokenised by Stripe. MMC does not see or store your full card number; we only receive a Stripe customer token and the last 4 digits for receipt display.
• Order & usage history — items hired, restaurants ordered from, services booked, dates and locations of bookings.
• Communications — messages between you and MMC crew via in-app chat, plus emails to sales@mymarineclub.com.au or jarred@mymarineclub.com.au.
• Crash & analytics data — anonymised crash reports and basic usage events to help us fix bugs and improve the product. Not linked to your identity.

2. How we use your information

We use your data to:

• Fulfil bookings, deliveries, payments, and customer service
• Dispatch the right crew to the right vessel at the right time
• Verify driver's licences for motorised hire compliance
• Send transactional emails (booking confirmations, ETAs, receipts) and, if you opt in, occasional service updates
• Process refunds and resolve disputes
• Improve the MMC website and iOS app
• Comply with our legal obligations under Australian law

We do not sell your personal information. We do not use your data for cross-app advertising tracking. The MMC iOS app does not use the App Tracking Transparency framework because we don't track you across other apps or services.

3. Who we share data with

MMC shares the minimum data required with the following service providers, each bound by their own privacy obligations:

• Supabase Inc. (database & authentication, hosted on AWS in Sydney) — stores your account, orders, and bookings.
• Stripe, Inc. (payments) — processes card and Apple Pay transactions. Stripe privacy.
• Mapbox, Inc. (maps & geocoding) — receives the pin coordinates you drop for delivery so we can render the map. Mapbox privacy.
• Vercel Inc. (web hosting) — servesmymarineclub.com.au, processes basic request logs. Vercel privacy.
• Resend Inc. (transactional email) — delivers booking confirmations, charter inquiries, MMC Eats notifications.
• Twilio Inc. (SMS, optional) — sends magic-link SMS to partner restaurants for MMC Eats pickup confirmations. Customer phone numbers are not shared with Twilio unless you ask us to text you.
• Apple Inc. (App Store / TestFlight / App Connect) — for crash analytics from the iOS app, governed by Apple's privacy rules.
• MMC crew members — the assigned crew member sees the drop-off location, vessel name, and your phone for the booking they fulfil.
• Restaurant partners (MMC Eats only) — receive your first name, the customer phone, and the drop-off location to fulfil the pickup. No payment info is shared.
• Australian regulators or law enforcement — only when legally required (e.g. valid subpoena, court order, statutory request).

4. Where your data is stored

Your data is primarily stored on Supabase's Sydney AWS region. Some processing occurs in the United States (Stripe, Mapbox, Resend, Vercel edge nodes). All transfers use TLS 1.2+ encryption. By using MMC you consent to this cross-border processing as permitted by APP 8.

5. How long we keep it

• Order & booking history: retained for 7 years to meet Australian tax-record obligations.
• Account information: retained while your account is active. You can request deletion any time.
• Payment data: stored only as Stripe tokens (no card numbers retained by MMC).
• Crew location data: deleted within 30 days of order completion.
• Marketing communication consent: retained until you unsubscribe.

6. Your rights

Under the Australian Privacy Principles, you can:

• Access the personal information we hold about you
• Correct it if it's inaccurate or out of date
• Request deletion of your account and personal data (subject to legal retention requirements above)
• Withdraw consent for marketing communications at any time
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au

To exercise any of these rights, email jarred@mymarineclub.com.au with the subject line “Privacy request”. We will respond within 30 days.

7. Cookies & tracking

The MMC website uses minimal first-party cookies for authentication session management. We do not use third-party advertising or tracking cookies. We do not embed Facebook Pixel, Google Ads conversion tags, or similar cross-site trackers.

The iOS app does not use the IDFA (Identifier for Advertisers) or any cross-app tracking framework.

8. Children

MMC is not directed at people under 18. We do not knowingly collect data from children. If you believe a minor has provided us with personal information, contact jarred@mymarineclub.com.au and we will delete it.

9. Security

We use industry-standard safeguards: TLS for data in transit, encrypted storage at rest, role-based access controls (Supabase RLS), and Stripe- native payment tokenisation. No system is perfectly secure, but if we ever discover a breach affecting your data, we will notify you and the OAIC within 72 hours per the Notifiable Data Breaches scheme.

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will reflect the most recent change. Material changes will also be communicated by email to active account holders.

11. Contact

Privacy Officer · jarred@mymarineclub.com.au
My Marine Club Pty Ltd · Sydney, NSW, Australia
Web: www.mymarineclub.com.au

My Marine Club Pty Ltd · Sydney, NSW · Last updated 30 April 2026