Security & privacy, by design
Members Request Desk is operated by NEMO Australia Pty Ltd(ABN 60 631 429 055). We automate membership freezes for Mindbody studios while holding as little personal data as possible and protecting what we do hold. This page summarises our controls — each one is verifiable.
Data protection
✓ Encrypted credentials
Each studio's Mindbody credentials are AES-256-GCM encrypted before they touch the database. No API key, username or password is ever stored in plaintext.
✓ Tenant isolation (RLS)
Every table uses Postgres row-level security, so one studio can never read another's data. The most sensitive tables are locked to server-side access only and closed to the public API entirely.
✓ Encryption in transit
All traffic — browser, our servers, and the Mindbody API — is served over TLS/HTTPS.
✓ Secrets hygiene
Secrets are never committed to source control or written to logs; access is limited to server-side code on a need-to-know basis.
Data residency & lifecycle
✓ Hosted in Australia
Our primary database runs in the Supabase Sydney region — member and studio data stays in Australia.
✓ We don't collect what we don't need
No health information (medical freezes go directly to the studio) and no payment card data (any freeze fee is handled by the studio's own Mindbody merchant account).
✓ Automated retention
A scheduled retention job de-identifies closed requests past their retention window — deletion by automation, not by promise. Verification codes are stored only as hashes and expire within minutes.
✓ Export & deletion on request
Studios can request an export or deletion of their data (DSAR). We honour requests promptly, subject to legal retention obligations, and assist studios in answering their members' requests.
Safe, controlled automation
✓ Verified identity
Every request is confirmed with a one-time code sent to the member's contact on file in Mindbody — not what was typed into the form.
✓ Studio stays in control
The studio's own rules run on every request; anything unusual (balance owed, medical, identity mismatch) is routed to staff review instead of auto-processing. A master kill-switch can pause all automation instantly.
✓ No wrongful or duplicate actions
Suspends are re-checked before retrying (no double-suspend) and reconciled against Mindbody, with duplicate guards on every submission.
✓ Full audit trail
Every action is logged with correlation IDs, so any outcome can be traced end to end.
Compliance
We handle personal information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, and — where it applies — the GDPR. For member freeze data the studio is the data controller and we act as its processor.
Subprocessors
We use a small set of trusted providers. We do not sell personal information.
- Supabase — database & auth (Sydney, AU)
- Vercel — hosting & compute
- Twilio — SMS verification
- Resend — transactional email
- Stripe — studio billing
- Mindbody — the studio's own platform we integrate with
Security or privacy question? Contact privacy@membersrequestdesk.com.
Found a vulnerability? Please report it responsibly to the same address — see /.well-known/security.txt. We appreciate coordinated disclosure and will respond promptly.