Privacy Policy
Who we are
Bookzyr Pty Ltd (ABN 24 698 938 484) ("Bookzyr", "we", "us") is the operator of the Bookzyr booking platform. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
What we collect
For salon owners and staff: name, email, phone, role, payment method (a payment token and display details only — full card details stay with our processor). For end customers booking through a Bookzyr-powered shop: name, email, phone, appointment history, optional notes set by the operator, an optional profile photo and date of birth, and — if you save a card for a deposit or card-on-file — a payment token and display details (card brand, last four digits and expiry); full card details stay with our processor. If you save a card when booking, other shops on Bookzyr that you book with can charge it for a deposit or payment a booking requires, a membership you sign up for, a late-cancel or no-show fee under their policy, or a balance you owe there. The money always goes to the shop that charges it. A card saved only while paying a deposit stays with that shop. You can remove a saved card from your account, unless a shop needs it for a booking you have coming up. We also record technical data (IP address and browser/device details) against sign-in attempts and audit-logged actions, for security purposes. We do not collect sensitive information (health, biometrics, etc.) unless the operator's intake form specifically captures it for compliance reasons (e.g. skin tests).
How we use it
To run the booking platform: confirm appointments, send reminders, process payments, generate reports, support staff and customers. We do not sell personal information. We use de-identified aggregate data to improve the product.
Booking page visits
When you use a shop's online booking page we keep a record of that visit: the name, email and mobile you enter on the booking form, the steps you reached and when, the type of device (phone, tablet or computer), where the visit came from (for example a link the shop shared), and your IP address. We keep the details you enter even if you don't finish booking. We use this record to understand and fix where bookings fail, and to help you or the shop if a booking didn't go through. Only Bookzyr staff can see it, and every time they look it is logged. It is not used for marketing, and nothing is sent to you because of it. Your name, email, mobile and IP address are deleted after 90 days; the steps on their own, with nothing that identifies you, are kept for up to 400 days to compare how booking pages do over time.
Who we share it with
Service providers we rely on include payment processing (Till Payments, a Nuvei company, for online card payments; Linkly for in-store EFTPOS), our email and SMS delivery providers, cloud hosting (Amazon Web Services), file storage for uploaded photos and documents (Supabase), maps, address lookup, web fonts and optional Google sign-in (Google) and — only when the Bookzyr AI assistant is used (by the shop or by Bookzyr support) — an AI model provider (Anthropic). Each is bound by contract to handle your data only on our instructions. Some of these providers process data outside Australia (for example, email delivery and the AI assistant). The shop you booked with sees your name + contact + appointment history — that's the point of the service. Other Bookzyr shops you book with can see a card you saved (its brand and last four digits only) and charge it for the purposes above. We never share with marketers or data brokers.
Storage & security
Our application and database are hosted in Australia (AWS Sydney region); uploaded photos and documents are stored with Supabase. Access by Bookzyr staff is role-gated and audit-logged. Full card numbers and security codes do not touch our servers. Online card payments are entered through the hosted payment fields of our card-not-present processor, Till Payments (Nuvei), which sends card details directly to Till; we store only a payment token plus display details — card brand, last four digits and expiry (and, for a business's own billing card, the cardholder name). In-store card payments are processed on a Linkly Cloud EFTPOS terminal, which handles the card with Linkly and the acquiring bank; we store only the transaction result and the references needed for receipts and refunds. Card details are handled by these providers, not by Bookzyr. Bookzyr never stores full card numbers or security codes.
Your rights
You may request access to, correction of, or deletion of your personal information at any time. Account holders can use the "Export my data" button in /account; non-account requests email privacy@bookzyr.com. We aim to respond within 30 days.
Cookies
We use a small number of cookies for authentication and session management. We do not use third-party advertising cookies.
Data breach
If a breach is likely to cause serious harm we will notify affected individuals and the OAIC under the Notifiable Data Breaches scheme.
Children
The Service is not directed at people under 16. Operators who collect minors' data via their own intake forms are responsible for parental consent.
Changes
Material changes will be notified by email or in-app at least 14 days before they take effect.
Contact
Privacy enquiries: privacy@bookzyr.com.