Privacy Policy

1. Two roles, and who is responsible

The Service is used by businesses (such as salons and spas) to manage their own customers. This affects how privacy responsibilities are shared:

• Our customers. For the account owners and staff of the businesses that subscribe to the Service, we collect and use their personal information as the responsible entity, as described in this Policy.
• Our customers’ clients. When a business uploads or manages the personal information of its own clients, that business is responsible for that information and decides how it is used. We process it on the business’s behalf and on its instructions. If you are a client of a business that uses MyBookings, please direct privacy requests to that business in the first instance; we will assist them as needed.

2. Information we collect

Depending on how the Service is used, we may collect:

• Account and business details — name, email, phone number, business name, ABN, address, timezone and currency, and login credentials.
• Client and booking records — the information businesses enter about their clients (such as name, contact details, booking history, notes, photos and loyalty balances) and appointment and service data.
• Payment information — records of transactions, payouts, invoices and subscription billing. Card details are collected and stored by our payment provider, Stripe; we do not store full card numbers.
• Communications — messages sent through the Service (such as confirmations, reminders and marketing you send to clients), and correspondence with our support team.
• Technical and usage data — device and browser information, IP address, log data, and how the Service is used, collected automatically to operate and secure the Service.

We generally do not seek to collect sensitive information. Where a business chooses to record sensitive information about its clients (for example, health-related notes relevant to a treatment), it is responsible for having the necessary consent.

3. How we collect it

We collect personal information directly from you when you create an account, subscribe or contact us; automatically when you use the Service; from businesses that use the Service about their clients; and from third parties that help us operate the Service (such as Stripe in connection with payments).

4. How we use it

We use personal information to:

• provide, operate, maintain and improve the Service;
• process payments, payouts and subscription billing, and issue invoices;
• send transactional messages such as booking confirmations, reminders and account notifications;
• provide customer support and respond to enquiries;
• keep the Service secure, prevent fraud and misuse, and diagnose problems;
• comply with our legal obligations and enforce our terms.

5. When we disclose it

We do not sell personal information. We disclose personal information only as needed to run the Service or as required by law, including to:

• service providers that help us deliver the Service, such as our payment provider (Stripe), email and SMS providers, and cloud hosting and infrastructure providers;
• the business you interact with, if you are a client booking or paying through the Service;
• professional advisers, or a party involved in a business restructure, merger or sale, subject to appropriate confidentiality;
• regulators, law enforcement or others where we are required or authorised by law, or to protect our rights or the safety of others.

6. Overseas disclosure

Some of our service providers (for example, payment, hosting and messaging providers) may store or process personal information outside Australia, including in the United States and other countries. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the APPs.

7. Marketing and messaging

We may send you administrative and transactional messages about your account. We will only send you marketing communications where permitted, and you can opt out at any time using the unsubscribe link or by contacting us. Messages that a business sends to its own clients through the Service are the responsibility of that business, which must have the necessary consent and provide an opt-out in line with the Spam Act 2003 (Cth); SMS recipients can reply STOP to opt out.

8. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used so we can improve it. You can control cookies through your browser settings, although some features may not work correctly without them.

9. How we keep information secure

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure — including encryption in transit, access controls and restricting access to those who need it. No method of transmission or storage is completely secure, but we work to protect your information and to respond appropriately to any data breach in line with our legal obligations.

10. How long we keep it

We retain personal information for as long as needed to provide the Service and for a reasonable period afterwards, and as required to meet our legal, tax and accounting obligations or to resolve disputes. When information is no longer needed, we take reasonable steps to delete or de-identify it.

11. Accessing and correcting your information

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date or incomplete. You can update most account details directly in the Service, or contact us using the details below. If you are a client of a business that uses MyBookings, please make access, correction or deletion requests to that business, as it controls that information. We may need to verify your identity before acting on a request, and there are some circumstances where the law permits us to decline.

12. Children’s privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information directly from children.

13. Changes to this policy

We may update this Policy from time to time. When we do, we will change the “Last updated” date above, and we will provide additional notice of material changes where appropriate. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

14. Contact us and complaints

If you have a question, request or complaint about your privacy, contact MYBK AI PTY LTD (ABN 50 699 490 189) at support@mybk.ai. We will acknowledge your complaint and aim to respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

This Policy should be read together with our Terms of Service.