Privacy Policy

Upheld

Last updated: 26 October 2026

This explains what Upheld does with personal information. It is written to be read, not to be survived. If anything here is unclear, email us and we will explain it in plain words.

Upheld is operated by Shane Barbetti (ABN 32 477 618 866), in Australia. In this policy, "we" and "us" means Upheld, and "you" means whoever is reading it.

The short version

  • Your business owns its own data. Nobody else using Upheld can see it, and

    • neither can we except when you ask us for help or we have to keep the service running.

  • We do not sell anything to anybody. There is no advertising in Upheld and

    • there never will be.

  • Your data is stored in Singapore, on Supabase, which is a normal thing for

    • an Australian app and is explained below.

  • You can delete your account, and everything personal in it, from inside the

    • app.

  • Incident reports can contain details of injuries. That is health information

    • and it is handled more carefully than everything else here.

    Who holds what

    There are two different relationships, and they matter.

    Your business is responsible for the information it puts into Upheld. If your gym records that a member hurt their ankle, that record is your business's, about your member, and your business decides what goes in it and how long it stays. We hold it for you and do what you tell us with it.

    We are responsible for the information you give us to use Upheld itself: your name, your email, your subscription. That part is ours to look after.

    What we collect

    From the people who use the app

  • Name, email address, and phone number if entered. Needed to sign in, to

    • show who did what, and to contact you about the service.

  • A photo, if you add one. Optional.
  • When you last opened the app. So a manager can see who has read a notice

    • and who has not.

  • Which locations you work at, and your role. This is what decides what you

    • can see.

    What your business records in the app

    Whatever your team enters as part of running the place: cleaning that was done, problems reported, maintenance, stock, rosters, availability, notes, photos, and incidents.

    Some of that is about people who have never used Upheld and never agreed to anything:

  • Members' names and emails in feedback and enquiries
  • Who was involved in an incident, which may be a member, a visitor or a

    • contractor

  • Photos taken around the place, which may include people

    • Your business is responsible for having the right to record that, for telling those people it is being recorded, and for being accurate about it. Nothing in Upheld removes that obligation.

    Health information

    Incident reports can contain details of an injury. Under Australian privacy law that is sensitive information, and it is treated more strictly than everything else here.

  • We hold it only so your business has the record it needs.
  • We do not use it for anything else. Not analysis, not improving the product,

    • not training any model.

  • It is covered by the same access rules as everything else: only people at

    • that location, and only with the right role.

  • If the person it is about asks your business to see it or correct it, your

    • business should be able to do that, and we will help.

    If your business is going to record injuries, make sure the people involved know. That is a reasonable thing to do regardless of what the law requires.

    Technical information

  • Crash reports, if the app stops working, so we can fix it. These describe

    • what the code was doing, not what you were doing.

  • A push notification token, if you turn notifications on, so we can send

    • them. It identifies a device, not a person, and it is deleted when you sign out.

    What we do not collect

  • Your location. The app knows which gym you work at because you told it, not

    • because your phone did.

  • Your contacts, your photo library, your calendar, or anything else on your

    • phone, unless you tap a button that asks for it. Adding your shifts to your calendar writes to it and never reads it.

  • Anything for advertising. There is none.

    • Where it lives

    Your data is held by Supabase, in their Singapore region, and by Amazon Web Services underneath that. Both are used by a very large number of Australian businesses.

    This means your information is disclosed overseas. Under Australian Privacy Principle 8 we have to tell you that, and we are: the country is Singapore.

    Photos and files are in the same place. Push notifications go through Expo, in the United States, and carry only the short line of text you would see on your lock screen.

    Payments are handled entirely by Apple or Google. We never see your card. We are told that a subscription exists, when it renews, and when it stops, and nothing else.

    Who can see it

  • People at your own business, according to what their role allows. A team

    • member sees their own location. A manager sees more. An owner sees all of it.

  • Nobody at any other business. This is enforced by the database itself, on

    • every table, not by the app being careful.

  • Us, in two situations only: when you ask us for help with a problem and we

    • need to look, and when we have to in order to keep the service running or because the law requires it. We do not browse.

    We do not sell personal information. We do not disclose it for anyone else's marketing. There is no third party receiving your data for their own purposes.

    How long we keep it

  • While you use Upheld, we keep what your business puts in, because that is

    • the point of it.

  • When somebody deletes their account, their name, email, phone and photo

    • are removed and their login stops working immediately. The records of what happened at the business stay, no longer carrying anybody's name, because they belong to the business rather than to the person.

  • When a business deletes its account, everything goes: every location,

    • every record, every person.

  • Backups are kept for a short period after that and then expire.

    • What you can do

  • See what we hold about you. Most of it is on screen in the app. Ask us for

    • the rest.

  • Correct it. Your own details are in Settings. Ask a manager for the rest.
  • Delete your account, from Settings, inside the app.
  • Turn off notifications, in Settings.
  • Complain. Email us first, because we would rather fix it. If you are not

    • satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

    If something goes wrong

    If personal information is lost or accessed by somebody who should not have seen it, and it is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as quickly as we reasonably can.

    Children

    Upheld is for people who work at a business, and is not for children. We do not knowingly collect information from anybody under 16. If a staff member is under 16, their employer is responsible for whatever consent is required.

    Changes

    If we change this, we will update the date at the top. If a change is significant, we will tell you in the app rather than hoping you check.

    Contact

    Shane Barbetti Email: privacy@upheld.au

    We aim to answer within a few days, and to actually answer rather than acknowledge.