Privacy policy

The directory is operated by {OPERATOR_NAME}, an Australian business based at {OPERATOR_ADDRESS}.

For privacy enquiries, use our contact form.

We collect different categories of information depending on how you use the directory:

• Visitors (browsing only): aggregated usage data (page views, referrers, device type, approximate location) collected via Google Analytics, which sets first-party cookies. We have turned off Google Signals and ad personalisation, so your visits are not linked to your Google account or used for advertising. Small amounts of data are stored in your browser’s local storage to remember your age confirmation, dismissed notices, recently-viewed shops, and listings you have hidden. This data never leaves your device.
• People who claim a listing: the email address you sign in with, any business contact details you supply (name, business phone, email, address, opening hours, photographs, descriptions, prices, services, weekly roster information).
• People who submit a takedown request: the contact details you provide on the form, the reason for your request, and details of the listing or content concerned.
• People mentioned in publicly-sourced listings: business names, working/stage names, business contact details, and photographs originally published on Google Business Profile, classified-ad sites, and similar public directories. We never add private personal information; if you believe a listing contains private information about you, please use our takedown page.

We collect personal information in three ways:

• Directly from you — when you sign in, claim a listing, edit your shop details, upload photos, submit a roster, or contact us.
• From publicly-available sources — we index listings from Google Business Profile and similar public directories. We compile, normalise, and re-publish this information for the purpose of helping consumers find massage services in Queensland.
• Automatically — through Cloudflare Web Analytics (aggregate and anonymised; no individual tracking).

We collect and use personal information for the following purposes:

• To operate the directory and display listings to consumers.
• To verify shop ownership when listings are claimed (via magic-link email).
• To process listing edits, photo uploads, and weekly rosters submitted by shops.
• To respond to takedown requests within our published service-level commitment (48 hours).
• To communicate with claimed shops about their listing (e.g. weekly roster prompts).
• To investigate misuse of the directory and to protect our service from spam and abuse.
• To comply with our legal obligations.

We do not sell personal information. We do not share personal information with marketing partners. We share personal information only in these limited circumstances:

• With service providers who help us run the directory: Supabase (database hosting in Sydney, Australia), Cloudflare (content delivery + Workers + Browser Rendering), Resend (transactional email), Anthropic + Workers AI (text classification of shop descriptions and review content). Each provider is contractually bound to keep your information confidential and to use it only as we direct.
• When you publish information yourself — anything you choose to publish on your shop’s public listing (descriptions, photos, hours, roster) is intended to be visible to anyone who visits the directory.
• When required by law — if we receive a valid law-enforcement request, court order, or other legal compulsion, we may disclose information to comply. We will resist over-broad requests and notify you where lawfully permitted.

Data is stored within Australia (Supabase region: ap-southeast-1, Sydney). Some service providers (Cloudflare, Anthropic) operate globally. Where personal information is processed outside Australia, we ensure it is protected to a standard substantially similar to the APPs.

• Listing data is retained for as long as the listing is active, plus 12 months after deletion (for backup and dispute purposes).
• Roster data is retained for 12 months as historical record; only the most recent week is publicly displayed.
• Takedown requests and the audit log of how we handled them are retained for 7 years (consistent with limitation periods for civil claims).
• Shop owner accounts are deleted within 30 days of an account deletion request.
• Aggregated analytics have no expiry; they cannot be linked back to an identifiable individual.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These steps include:

• HTTPS-only connections enforced site-wide.
• Row-level security on every table in our database — shop owners can only read and write their own records; visitors can only read approved public data.
• Photo uploads stored in a private bucket and served via unguessable URLs.
• Two-factor protection on the production database and admin tooling.
• Server-side rate limiting on sensitive endpoints (sign-in, edit submission, takedown).

If we become aware of a notifiable data breach (under Part IIIC of the Privacy Act), we will notify affected individuals and the OAIC as required by law.

Under the Australian Privacy Principles you have the right to:

• Request access to the personal information we hold about you.
• Request correction of any inaccurate information.
• Request deletion of your personal information.
• Withdraw consent for any processing based on consent.
• Lodge a complaint about how we have handled your information.

To exercise any of these rights, get in touch via our contact form. We will respond within 30 days.

If you are unhappy with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

We use Google Analytics to count visits and see which pages are useful. It sets first-party cookies (named _ga) and sends usage data to Google. Google Signals and ad personalisation are turned off, and we do not use advertising cookies. You can block these cookies in your browser or with Google’s opt-out add-on. Browser local storage is used only to remember your preferences (age confirmation, dismissed banners, recently viewed listings) and never leaves your device.

This directory contains information about adult services and is intended for an audience aged 18 and over. We do not knowingly collect personal information from people under 18. If you believe we have collected information from a minor, please contact us immediately via our contact form and we will delete it.

We may update this policy from time to time. Material changes will be announced via a notice on the homepage at least 14 days before they take effect. The current version is always available at sensualmassagedirectory.com.au/privacy.

For any privacy-related question, contact:

{OPERATOR_NAME}
Attention: Privacy Officer
{OPERATOR_ADDRESS}
Contact: our contact form