Welcome back
Sign in to access your VISTA performance program.
Authentication is securely managed by VISTA GPS. Your password is never stored in this webpage.
Turn raw GPS data into decision-ready information for game-day, training and rehabilitation.
VISTA GPS privacy policy, terms of use and privacy and security governance documents. Privacy enquiries, access or correction requests and complaints: jacob@vistagps.com.au.
Open Privacy Policy page ↗Open Terms of Use page ↗
How VISTA GPS collects, uses, stores and protects personal information
VISTA GPS | Sole trader | ABN 18 935 045 654 | Perth, Western Australia
Effective: 28 October 2026
VISTA GPS (“VISTA”, “we”, “us”) is a sole trader business based in Perth, Western Australia (ABN 18 935 045 654). We provide an online platform that helps sporting clubs, schools and other organisations turn GPS and training files into performance, training-load and rehabilitation reports.
This policy explains how we handle personal information, including health information, in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). It is written to meet APP 1, which requires us to have a clearly expressed and up-to-date privacy policy.
VISTA chooses to comply with the APPs and the Notifiable Data Breaches scheme as if it were bound by them. Because VISTA handles health information, it may also be covered by the Privacy Act regardless of its size. We do not rely on the small business exemption.
If you have a question about this policy, contact our privacy contact, Jacob Dearle, at jacob@vistagps.com.au.
VISTA is used by organisations such as football clubs and schools (“customers”). The customer decides which players, staff and information are entered into VISTA and why. The customer is the party that collects player information, and VISTA stores and processes that information on the customer’s behalf and on its instructions.
This means:
We do not ask for players’ dates of birth, home addresses or contact details, and customers should not upload them. Our internal Privacy Management Plan requires a documented need and privacy review before any new type of personal information is added.
Season Pass payments are made on a secure payment page hosted by Stripe. Stripe collects your card details directly; VISTA does not see or store full card numbers. We receive payment confirmation and the organisation details entered at checkout.
When you use the site, our hosting and service providers automatically receive technical information such as your IP address, browser type and the time of your request. See section 10 for cookies and browser storage.
Injury, rehabilitation, wellness and screening information is “health information”, which is a type of sensitive information under the Privacy Act and needs extra care. We:
We collect information:
We generally do not collect player information directly from players. Where a customer gives us information about a player, the customer is responsible for having collected it lawfully and for giving the player the notice required under APP 5.
We do not use personal information for direct marketing to players. We may email customer staff about their account, their Season Pass or important changes to VISTA. We may also send club contacts occasional product updates about VISTA. Every update includes an easy way to opt out, and you can also opt out at any time by emailing jacob@vistagps.com.au.
VISTA includes an Insights feature that drafts performance commentary to help staff interpret their data. Live AI insights are available only to clubs with an active VISTA Season Pass. They are not available in the free demo.
What is sent: when a user asks VISTA to generate AI insights, our secure server function (which requires a valid VISTA sign-in) sends a summary of the selected game, training session or week, or player trend to OpenAI. The summary contains GPS and training-load metrics (for example distance, speed, high-speed running, sprint distance, accelerations and decelerations), team averages, and program context such as round numbers, dates, session names and opponent names. Before the summary leaves our server, player names are replaced with codes (for example “Player 01”), and we put the names back into the draft insights only after they return. We do not send injury, rehabilitation, medical or contact information. Because the metrics relate to individual players, we treat the summary as pseudonymised (de-identified for this purpose), not anonymous, information.
AI provider: OpenAI (the maker of ChatGPT), through the OpenAI API. We send requests with storage switched off (OpenAI’s “store: false” setting), so OpenAI does not keep the request or the generated insights as stored application data. Under OpenAI’s API data policy, data sent through the API is not used to train or improve OpenAI’s models unless the customer opts in, and VISTA has not opted in. OpenAI may keep API requests and responses in abuse-monitoring logs for a limited period (by default up to 30 days, or longer if required by law or to protect its services or others from harm), and then deletes them.
Overseas disclosure: OpenAI may process and temporarily store this information outside Australia, including in the United States (see section 8).
Insights are decision support only. They are drafts that may be incomplete or wrong, and they must be reviewed, edited and approved by the customer’s appropriately qualified staff before they are used or shared. AI insights are not medical advice. VISTA does not use AI to make decisions about players, such as selection, medical clearance, injury diagnosis or return to play.
If live AI is unavailable (for example, because a club does not have an active Season Pass), VISTA shows insights calculated from the club’s own data inside VISTA. These are labelled “VISTA computed”, and no data is sent to OpenAI to produce them.
We use the following service providers to run VISTA. They process information on our behalf, and only so that they can provide their services:
| Provider | What they do | Information involved | Where it may be processed |
|---|---|---|---|
| Supabase | Database, sign-in and storage for all account, organisation, program and player data | All information described in section 3, except card details | Australia (Sydney, ap-southeast-2) |
| Netlify | Website hosting and the server function that runs AI insights | Technical information; for AI insights, the program data summary sent to the function | Netlify’s infrastructure, which may be outside Australia (including the United States), and global content delivery locations |
| Stripe | Payment processing for the Season Pass | Payment details and organisation details entered at checkout | Australia, the United States and other countries where Stripe operates |
| OpenAI (API) | Generating draft AI insights when a user with an active Season Pass asks for them | Pseudonymised program data summary for the selected game, session, week or player (player names replaced with codes; no injury, medical or contact information) | United States and other countries where OpenAI operates (outside Australia) |
| Google Fonts, cdnjs (Cloudflare) and jsDelivr | Delivering fonts and software libraries to your browser | Technical information such as IP address and browser details | United States and global locations |
Customer data in our database is stored in Australia (Supabase, Sydney region). Because some of these providers are based in, or process information in, other countries, some personal information may be disclosed overseas, mainly to the United States. Before using a provider that may receive personal information, we review its security, its data location, its retention and its breach-notification terms, as our Privacy Management Plan requires. We take reasonable steps to ensure overseas recipients handle the information consistently with the APPs.
We do not sell personal information. We will only otherwise disclose personal information if the customer instructs us to, if the law requires or authorises it, or if it is needed to lessen or prevent a serious threat to someone’s life, health or safety.
No online service can be guaranteed to be completely secure, but we take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure, as APP 11 requires.
We keep customer data for as long as the customer has access to VISTA. When a customer’s access ends, we tell them about the retention and deletion window and encourage them to export anything they need. Our target is to delete the customer’s organisation data within 30 days after its access ends, unless the law requires us to keep it. We keep only a minimal record that the deletion took place.
Customers can ask us to delete specific information sooner. Information held in backups is deleted in line with our database provider’s backup cycle.
VISTA does not use advertising or analytics cookies, and we do not use tracking pixels.
The app uses your browser’s local storage for things it needs to work:
If you use a shared computer, sign out when you finish. Clearing your browser’s site data will remove this information from that browser.
Third parties may set their own cookies. For example, Supabase’s network provider may set a security cookie, and Stripe sets cookies on its own payment page. These are covered by those providers’ privacy policies.
You can ask for access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APPs 12 and 13).
You can ask general questions about VISTA without identifying yourself. To use the service, customer staff need a named login. Customers may choose to identify players by number or code rather than name.
We keep a Data Breach Response Plan for any suspected or confirmed loss of, or unauthorised access to, personal information. If a breach happens, we will act quickly to contain it, assess the risk of harm, and fix the cause.
If a breach is likely to result in serious harm (an “eligible data breach” under the Notifiable Data Breaches scheme), we will notify the affected customers, the affected individuals and the Office of the Australian Information Commissioner (OAIC), as the scheme requires. Where the breach involves a customer’s player information, we will work with that customer on notifying players.
If you have a concern about how we have handled personal information, please email jacob@vistagps.com.au with details. We will acknowledge your complaint promptly, investigate it, and aim to give you a written response within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): visit www.oaic.gov.au or phone 1300 363 992.
We review this policy at least once a year, and whenever we make a significant change to VISTA, its providers or the information it holds. The current version will always be on our website, with its effective date. If we make a significant change, we will let customers know.
Contact: Jacob Dearle, Privacy contact, VISTA GPS — jacob@vistagps.com.au. VISTA does not currently publish a business telephone number or postal address.
The terms for using VISTA GPS, the free demo and the 2027 Season Pass
VISTA GPS | Sole trader | ABN 18 935 045 654 | Perth, Western Australia
Effective: 28 October 2026
These terms apply to anyone who uses VISTA GPS (“VISTA”, “we”, “us”), the online GPS performance and reporting platform at vistagps.com.au. VISTA is run by Jacob Dearle, trading as VISTA GPS (sole trader, ABN 18 935 045 654), in Perth, Western Australia.
By creating an account or using VISTA, you agree to these terms. If you use VISTA for an organisation (for example a club or school), you confirm that you are authorised to accept these terms on its behalf, and “you” includes that organisation (the “customer”).
These terms apply unless you and VISTA have signed a separate written agreement that says otherwise. If there is a conflict, the signed agreement applies.
| Item | Price |
|---|---|
| 2027 Season Pass — includes one program | $500 AUD |
| Each additional program | $50 AUD |
You keep ownership of all data you upload to VISTA (“customer data”), including player GPS, training-load, injury and rehabilitation information. You give us permission to store, process and display customer data only so that we can provide VISTA to you, including through the service providers listed in our Privacy Policy.
You are responsible for customer data. In particular, you must:
We handle personal information in line with our Privacy Policy.
You must not:
We may suspend access, after notice where practical, if we reasonably believe these terms have been breached or there is a security risk.
VISTA is a data and reporting tool. It does not provide medical, physiotherapy or other health advice, diagnosis or treatment, and it does not decide whether a player is fit to train, play or return from injury.
Reports, thresholds, flags and AI-assisted insights are decision support only. They may be incomplete or wrong, for example if the uploaded data is inaccurate. All decisions about player health, training, selection and return to play must be made by appropriately qualified people using their own professional judgement. AI-assisted insights must be reviewed and approved by your staff before they are used or shared.
VISTA, including its software, design, reports, templates, the VISTA Gold-Standard Insight Library and the VISTA GPS name and logo, is owned by us or our licensors. We give you a non-exclusive, non-transferable right to use VISTA for your organisation’s internal purposes during your access period.
You own your customer data and the reports you export. If you send us feedback or suggestions, we may use them to improve VISTA without any obligation to you.
We may use aggregated, de-identified information that cannot identify any person or organisation, but only to improve the VISTA service. We will never sell it.
Nothing in these terms excludes, restricts or modifies any right or remedy, or any guarantee, warranty or other term or condition, that cannot lawfully be excluded or limited, including under the Australian Consumer Law (“non-excludable rights”). This includes your right to a refund for a major failure.
Subject to your non-excludable rights and to the extent permitted by law:
We are not responsible for decisions made using VISTA’s reports or insights (see section 7), or for loss caused by inaccurate customer data or by your breach of these terms.
Internal governance plan for privacy-by-design, accountability and ongoing compliance
Legal entity: VISTA GPS | Sole trader | ABN 18 935 045 654
This plan sets out how VISTA GPS will manage privacy as an ongoing operational responsibility. It converts privacy requirements into repeatable controls across product design, customer onboarding, access, retention, vendors, incidents and future feature development.
Business: VISTA GPS, sole trader, ABN 18 935 045 654.
Privacy owner: Jacob Dearle, Founder.
Privacy contact: jacob@vistagps.com.au.
Security/technical owner: Jacob Dearle, supported by qualified external technical or legal advisers where risk warrants.
Customer responsibility: each organisation controls which authorised personnel receive access and remains responsible for its own professional, clinical, employment and record-keeping obligations.
Maintain a current inventory of the categories of information VISTA handles, where they are stored, why they are needed, who can access them, how long they are retained and which service providers process them. Review the inventory before material new data fields or integrations are launched.
Current high-level information classes are account/access data, player identifiers, GPS/performance data, training information, injury/rehabilitation information, Program configuration, audit/security metadata and customer organisation information.
Access must follow least-privilege principles. A user should only access the organisation and Programs they are authorised to use. Program State and private Storage access must be protected server-side, not solely through hidden UI controls.
Operational controls currently include one paid organisation per login, Program-scoped access checks, owner/editor/viewer server-side permissions, owner-controlled archive/restore, read-only archived Programs, founder-only customer administration and private Program logo storage.
New paid organisations and purchased Programs are provisioned through the controlled VISTA Admin workflow. Customer self-creation of Programs is disabled for v1. Access dates and Program allowances should match the commercial agreement.
At offboarding, confirm the access end/cancellation date, tell the customer about the retention/deletion window, encourage required exports, remove or expire access as designed, and verify scheduled deletion. Retain only the minimum administrative deletion record required for accountability.
The current operational target is deletion of customer organisation data after the configured 30-day post-access retention period, subject to lawful retention requirements. The automated purge process should be tested periodically. Any new storage location - including file/object storage - must be included in deletion logic before that feature is considered production-ready.
Before adding a provider that may receive personal information, document the provider and service, information categories transferred, processing purpose, storage/processing countries, retention/deletion terms, security assurances, material subcontractors, breach notification commitments and whether the provider may use customer data to train models or for unrelated purposes.
No production AI feature may receive identifiable customer information until a specific privacy/security review is completed. The review must cover data minimisation or de-identification, provider terms, model training/use, retention, logging, overseas disclosure, access controls, secret management, clinician review requirements and necessary policy/notice updates.
Perform a documented privacy review before launching new health/medical fields; AI; integrations; identifying analytics/telemetry; cross-organisation benchmarking using identifiable data; new external vendors; major authentication/access changes; new mobile apps; data exports/sharing; or material retention changes.
Anyone with VISTA administrative or support access must understand that player injury/rehabilitation information may be sensitive. Support work should use the least information necessary. Screenshots, exports and support copies containing identifiable information should not be retained casually and should be deleted when no longer required.
Privacy enquiries, access/correction requests and complaints are monitored by Jacob Dearle at jacob@vistagps.com.au. Requests should be logged, acknowledged promptly, identity verified proportionately, coordinated with the relevant customer organisation where necessary, and the outcome documented.
Maintain the separate VISTA Data Breach Response Plan. The Founder must be able to disable accounts, restrict affected data, preserve evidence, contact critical providers and obtain legal/cyber assistance if required.
Review this plan at least annually and after any material incident, major product release, new vendor, significant privacy-law change or substantial change to VISTA's data holdings. Record the review date, reviewer and actions.
Owner: Jacob Dearle, Founder - VISTA GPS
ABN: 18 935 045 654
Version: 1.1 FINAL
Effective: 2 September 2026
Revision: Version 1.1, 29 October 2026 - contact email updated to jacob@vistagps.com.au.
Next scheduled review: 2 September 2027, or earlier if a review trigger occurs.
Internal incident-response procedure for suspected or confirmed personal-information breaches
Legal entity: VISTA GPS | Sole trader | ABN 18 935 045 654
This plan provides a practical response framework for any suspected or confirmed loss, unauthorised access, disclosure, modification or misuse of personal information handled through VISTA GPS. It applies whether or not an incident ultimately meets the legal threshold for notification.
Business: VISTA GPS, sole trader, ABN 18 935 045 654.
Incident lead: Jacob Dearle, Founder.
Incident/privacy email: jacob@vistagps.com.au.
Authority: the incident lead may take urgent proportionate steps to protect affected information, including disabling accounts, restricting access, suspending a feature, rotating credentials, preserving evidence and contacting service providers or professional advisers.
VISTA does not currently publish a business telephone number or postal address. Incident communications are coordinated through the monitored email above and the relevant provider account/support channels.
The response follows the core sequence: contain, assess, notify where required, and review/remediate. Stages may run in parallel where urgency requires.
Establish the facts as quickly as practicable. Document what information was involved, whose information was affected, the number of people/organisations, how the breach occurred, who may have accessed it, whether it was protected, how long exposure lasted, and whether the information has been recovered or access has been stopped.
Assess likely harm in context. Health information may increase sensitivity. Consider identity harm, discrimination, embarrassment, professional or sporting consequences, physical or psychological harm, financial harm, malicious intent, the ability of recipients to understand/use the information, and whether effective remedial action has prevented likely serious harm.
Where the Notifiable Data Breaches scheme applies, assess whether the incident meets the threshold for an eligible data breach. If VISTA has reasonable grounds to believe an eligible data breach has occurred, follow applicable OAIC and affected-individual notification requirements. Obtain legal/privacy advice promptly where the threshold is uncertain, the incident is material, health information is involved, or other contractual/regulatory duties may apply.
| Time | Action |
|---|---|
| Immediately | Open incident record; preserve evidence; contain further access/exposure. |
| 0-2 hours | Identify affected systems/data/users; revoke risky access; contact relevant provider if needed. |
| 2-6 hours | Establish scope; determine whether health information or cross-customer exposure is involved; begin harm assessment. |
| 6-12 hours | Engage legal/privacy/cyber assistance if material; prepare customer communications if necessary. |
| 12-24 hours | Confirm containment; document assessment; decide next investigative steps and notification pathway; assign remediation owners. |
Critical: confirmed or credible broad access to identifiable health information; service-role/admin compromise; cross-organisation exposure; public exposure; active malicious access.
High: limited but confirmed unauthorised access to sensitive information; compromised customer owner account; significant export sent to wrong recipient.
Moderate: suspected or contained exposure with limited information and no evidence of access, requiring investigation.
Low: event with no personal information exposure or a near miss, still recorded where useful for learning.
Severity guides urgency; it does not replace the legal assessment of whether notification is required.
For each incident, retain a proportionate record of: incident ID/date; reporter; systems involved; affected organisations/Programs; information categories; approximate affected individuals; timeline; containment actions; logs/evidence preserved; assessment of likely harm; legal/notification decision and rationale; communications; root cause; remediation; closure date; and post-incident review. Do not place unnecessary copies of affected health information into the incident record.
Communications must be accurate, timely and limited to verified facts. Do not speculate about cause, blame or impact. Tell affected parties what happened, what information was involved, what VISTA has done, what they can do to reduce risk, and how to contact VISTA, to the extent appropriate and legally required.
If a cloud or technology provider reports an incident, VISTA remains responsible for assessing its own information and obligations. Obtain the provider's incident timeline, affected services/data, containment status, indicators of compromise, remedial actions and any information needed to determine affected VISTA customers or individuals.
Run a tabletop exercise at least annually and after major architecture changes. Suggested scenario: an authenticated user from Organisation A can unexpectedly view rehabilitation information belonging to Organisation B. Test detection, containment, evidence preservation, customer identification, harm assessment, notification decision-making and remediation.
| Incident: | ____________________________ |
| Date/time discovered: | ____________________________ |
| Contained? | Yes / No / In progress |
| Personal information involved? | Yes / No / Unknown |
| Health/sensitive information involved? | Yes / No / Unknown |
| Likely serious harm? | Yes / No / Under assessment |
| Can remedial action prevent likely serious harm? | Yes / No / Unknown |
| OAIC/NDB advice obtained? | ____________________________ |
| Notification decision and rationale: | ____________________________ |
| Incident lead sign-off: | ____________________________ |
Owner: Jacob Dearle, Founder - VISTA GPS
ABN: 18 935 045 654
Version: 1.1 FINAL
Effective: 2 September 2026
Revision: Version 1.1, 29 October 2026 - contact email updated to jacob@vistagps.com.au.
Review: at least annually, after a material breach/near miss, or after major architecture/vendor changes.
Internal plans: VISTA GPS · Sole trader · ABN 18 935 045 654 · Version 1.1 FINAL · Effective 2 September 2026 · Revised 29 October 2026 (contact email updated)