Spinbox
Privacy Policy
This policy explains what personal information Spinbox collects, why, where it is kept and how you can see or correct it. Spinbox is a business name of Mark Ranjith Jayasekera, ABN 98 480 091 051 (we, us).
1. Two kinds of information
Information about our subscribers. When a business signs up for Spinbox, joins a waitlist or pays us, we collect information about that business and the person dealing with us. We decide how that information is used, and this policy covers it.
Information inside a subscriber’s Box. Each subscriber keeps their own clients, events, quotes, contracts and files in their own Box. That information belongs to the subscriber. We store and process it only to run their Box, as set out in our Subscriber Terms. If you are a client of a business that uses Spinbox, please contact that business first about your information; we will help them respond.
2. What we collect
- Sign-up details: business name, ABN, website or social pages, your name, email, mobile number, the trade you work in, how many events you run, and the web address you choose for your Box.
- Terms acceptance: the date and time you accepted our terms, the version accepted, and your IP address and browser type at the time.
- Billing details: your card is handled by our payment provider, Stripe. We never see or store your full card number. We keep the card type, last four digits and expiry date, and a record of each payment and tax invoice.
- Waitlists: your email address, if you ask to hear when a product such as Spin Box Crate is ready.
- Messages: anything you send us by email or through support.
- Technical information: IP addresses, browser type and the date and time of requests, kept in server logs to keep the service secure and working.
3. Why we collect it
- to check that sign-ups are genuine event businesses, set up your Box and send you your login;
- to bill you, issue tax invoices and handle failed payments;
- to send you service messages, such as trial reminders, price-change notices and security alerts;
- to provide support, keep the service secure, prevent misuse and meet our legal obligations, including tax record-keeping.
We do not sell personal information, and we do not use it for third-party advertising.
4. Who we share it with
We share information only with the service providers we need to run Spinbox, and only for that purpose:
- Hostinger: web hosting, servers and email;
- Stripe: card payments;
- Backblaze: encrypted off-site backups;
- Google Fonts: our web pages load fonts from Google, which receives your IP address when a page loads.
Some of these providers store or process information outside Australia, including in the United States and Europe. We choose established providers and protect backups with encryption before they leave our server. We may also disclose information where the law requires it.
Google Calendar
If a Spin Box subscriber chooses to connect their Google Calendar, Spin Box asks Google for read-only access to their calendars and for their Google account email address. We use this only to show that subscriber's own calendar events beside their bookings inside their own Spin Box. We do not create, change or delete calendar events. We do not sell this information, use it for advertising, use it to train AI models, or share it with anyone else.
A subscriber can disconnect at any time in Settings > Google Calendar, or remove Spin Box from their Google Account permissions. When they do, we delete the stored connection.
Spin Box's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Cookies and browser storage
Our public pages do not use advertising or tracking cookies. When you sign in to your Box, your browser stores a login token so you stay signed in. The card page loads Stripe’s secure payment form, and Stripe may set cookies to prevent fraud.
6. How we protect it
Each Box has its own separate database. Connections use HTTPS, logins can use two-step verification, repeated wrong passwords are locked out, and nightly backups are encrypted before they are stored off-site. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner as the law requires.
7. How long we keep it
We keep subscriber information while you subscribe. After a subscription ends, Box data can be exported for 30 days and is then deleted from the live service, and from backups as they roll over. Billing records and tax invoices are kept for at least five years, as tax law requires. Sign-ups we decline and waitlist emails are deleted on request.
8. Seeing or correcting your information
You can ask to see the personal information we hold about you, or ask us to correct it, by emailing support@spinboxep.com. We will respond within 30 days. You can also unsubscribe from anything that is not a service message.
9. Complaints
If you are unhappy with how we have handled your information, email us first and we will try to resolve it. If you are still not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
10. Changes to this policy
We may update this policy. The latest version is always at spinboxep.com/privacy.html, and we will email subscribers about any significant change.