Privacy policy

1. Who we are

Bookline is an online booking and client-records service for businesses that take bookings. It is run by Miao Chaw ("Bookline", "we", "us"), at usebookline.com.

This policy explains what personal information we collect, why, who sees it, where it goes, how long we keep it, and how you can see it, correct it or complain. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth), even where the law may not require us to.

Contact us about anything in this policy:

• Email: support@usebookline.com

2. Two roles: the business and Bookline

Bookline is used by businesses (our "customers"). Their clients book through a booking page that the business owns. So there are two kinds of personal information, and we play a different part for each.

A. Information about a business's clients. The business decides what it collects from its clients and why. It is the first person to contact about that information. Bookline stores and handles it for the business, to run the booking service. We do not use it for our own marketing and we do not sell it.

B. Information about our own customers. This is the owners and staff who have Bookline logins. We collect it for ourselves, to provide and bill for the service, and we are responsible for it.

If you are a client of a business and want to see or correct your details, ask the business first. If you ask us instead, we will help (see section 9).

3. What we collect

From a business owner or staff member (B):

• name, email address and password (stored only as a one-way hash, never in plain text)
• the business's name, address, phone, opening hours and settings
• staff names, titles and working hours
• subscription details: your plan, trial and billing status, and the identifiers Stripe gives us. We do not see or store your full card number. Stripe does.
• sign-in records: the time, IP address and browser details of each session
• messages you send us, for example to support

About a business's clients (A), entered by the business or by the client when booking:

• name, mobile number and email address
• bookings: the service, staff member, time, price and any notes the business adds
• notes the business chooses to write on a client record. These could include things like a sensitivity (patch) test date. Businesses should not put anything in notes that they do not need.
• fees owed, and whether the client has opted out of text messages
• records of the texts we send for the business, and whether they were delivered
• when a client books online, a code we text to their mobile to check it is theirs

Imports. During setup we may help a business import its existing clients, services, team and booking history from another system into Bookline. We do this with the business, on its login, through Bookline's import tool. We never ask a business to email us its client files.

Cookies. See section 11.

4. Why we use it

For owners and staff (B):

• to create and secure your account and let you sign in
• to run the service, answer support requests and keep a record of changes
• to bill you, take payment, and handle failed payments and cancellations
• to email you about your account (invites, password resets and notices about your account)
• Stripe emails you about billing (trial reminders, failed payments)
• to protect the service from abuse and to fix errors
• to meet our legal obligations

For a business's clients (A), only on the business's behalf:

• to book, change and cancel bookings
• to send booking confirmations, reminders and change notices by text
• to check a client's mobile when they book online
• to keep the business's client list and booking history

We do not use personal information for advertising, and we do not sell it. We do not run analytics or tracking scripts. We do not keep a marketing list. If you email us to ask about Bookline, we use your email address to reply to you.

5. Who can see it

• The business. Its owner, and staff who have permission to see client details.
• Bookline. We can access a business's data to give support and keep the service running. Today only one person can do this: the person who runs Bookline (section 1). If that changes, we will update this policy first. We do this only for those purposes.
• Service providers that help us run Bookline. They are listed in section 7, with the country they handle data in.
• Others, where the law requires (for example a court order), or where it is needed to protect people or the service from serious harm.

We do not share one business's client information with another business.

6. Text messages

Texts to a business's clients (confirmations, reminders, changes, verification codes) are sent through Bookline for the business. Their purpose is to carry out the booking the client asked for.

• Opt out. Our texts tell the client they can reply STOP. We treat STOP, STOPALL, UNSUBSCRIBE, END, QUIT and OPTOUT as an opt-out and stop sending texts to that mobile. We act on it promptly, and always within five working days. Replying CANCEL is not an opt-out: it is treated as a reply about the booking.
• If we cannot tell which business a STOP is for, we stop texts from every business that has that mobile on file.
• Turning texts back on. Only the client can do this, by replying START (or UNSTOP) from their own mobile. Neither a business nor we will turn texts back on for them.
• We do not send marketing texts or emails for Bookline itself to people who have not asked for them.

7. Overseas recipients

We use, or are about to use, the providers below. Some are outside Australia, so your information can be sent or stored overseas. Before we send information overseas we take reasonable steps to make sure the provider handles it in line with the APPs, for example by using providers with published privacy and security commitments and written terms.

Scroll sideways to see the whole table.

Mobile carriers deliver texts and may handle the number and message in their own networks.

We will update this table before we add a new provider that handles personal information.

8. How long we keep it

• While a business has an active account: we keep its information so the service works, including booking history.
• After a business stops (its plan lapses or is cancelled): we keep the business's data for 12 months from that day, so it can return and pick up where it left off. If it restarts within 12 months, everything is restored. After 12 months we delete it.
• Earlier deletion: a business can ask us to delete its data sooner. See section 9.
• Sign-ins: a sign-in lasts up to 30 days and is extended while you keep using Bookline. We remove it when you sign out or it expires.
• Logs, codes and backups: Verification codes, and the mobile number each was sent to, are deleted after 7 days. Sign-in sessions and password-reset links are deleted 7 days after they expire. Records of the texts we send (such as confirmations and reminders) and our audit log: we keep these for as long as we keep the business's data (see above). Backups are kept for 30 days. Information in backups is deleted when the backup expires.
• Records we must keep by law (for example payment and tax records) are kept for as long as the law requires.

When information is no longer needed, we delete it or de-identify it so it cannot identify anyone.

9. Access, correction and deletion

You can ask to see the personal information we hold about you, and ask us to correct it.

• How: email support@usebookline.com.
• If you are a client of a business: please ask the business first, because it decides what it holds about you. If you ask us, we will tell you which business holds your information, or pass your request on, and help the business answer you.
• Time: we reply within 30 days.
• Cost: correcting your information is free. We do not charge to receive an access request. If a request needs unusual work we will tell you before we do it, and any charge will not be excessive.
• We may refuse in the cases the Privacy Act allows (for example where giving access would reveal another person's information). If we refuse, we will tell you why in writing and how to complain.
• Deletion: if you ask us to delete your information we will, unless we must keep it by law or for another good reason, which we will explain.

A business can export its client list from Bookline itself at any time.

10. Complaints

If you think we have mishandled your personal information, tell us at support@usebookline.com. We will acknowledge your complaint, look into it and reply in writing, normally within 30 days.

If you are not happy with our reply, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Cookies and tracking

• Bookline sets one cookie when an owner or staff member signs in. It keeps you signed in. It is strictly necessary for the service to work. It lasts up to 30 days, is renewed while you use Bookline, and is removed when you sign out.
• We use no analytics, advertising or tracking cookies or scripts on any page.
• The front page, booking pages and manage-booking pages set no cookies and load no third-party fonts or scripts. A business may show a header image hosted elsewhere on its booking page; your browser fetches it from that host.
• When you go to Stripe to pay or manage billing, Stripe's pages may set their own cookies. Stripe's policy covers those.

12. Security, breaches and automated decisions

• Security. We protect information with measures including password hashing, encrypted connections (HTTPS), access limited to the people who need it, each business's data kept apart from every other business's, and backups. No system is perfectly secure.
• Data breaches. If a breach is likely to cause serious harm to anyone, we will tell the people affected and the OAIC as the Notifiable Data Breaches scheme requires, and we will tell the business whose clients are affected.
• Automated decisions. Bookline works out which times are free to book using the business's own rules. That is not a decision about a person. We do not currently use a computer program to make decisions that significantly affect individuals. If that changes, we will update this policy first, as the law requires from 10 December 2026.
• Children. Bookline accounts are for adults. A business may take bookings for children; it is responsible for how it handles their details.

13. Changes to this policy

We will update this policy when what we do changes. We will publish the new version on our website with a new effective date, and tell business customers by email at least 30 days before any change that weakens a privacy commitment.

This policy takes effect on 1 November 2026. It is governed by the law of New South Wales and the Commonwealth of Australia.