Privacy Policy

This Privacy Policy explains how BiziBud AU ("BiziBud AU", "we", "us" or "our") collects, uses, discloses and protects information about you when you use our website at bizibud.com.au, our mobile application (the "App"), and any related services (together, the "Services").

By using our Services you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Services.

This policy is designed to comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth), the EU General Data Protection Regulation (GDPR) where applicable, the Apple App Store Review Guidelines and the Google Play Data Safety requirements.

BiziBud AU is an Australian company operating an all-in-one platform that helps customers discover and book local service businesses, and gives businesses a complete operating system to manage their business. For the purposes of the GDPR, BiziBud AU is the "data controller" of your personal information.

You can contact us any time about privacy matters at privacy@bizibud.com.au.

We collect the following categories of information:

3.1 Information you give us

• Account information: name, email address, phone number, password (hashed), profile photo and any other details you add to your profile.
• Business information (for business users): business name, business address, service categories, staff information, opening hours, service catalogue, photos and any other business profile content.
• Booking and purchase history: services booked, appointment times, staff selected, prices paid, cancellations, refunds and related transaction metadata.
• User-generated content: reviews, ratings, messages you send businesses (and vice versa), business posts, images, documents and any other content you upload.
• Loyalty data: your BizPoints balance, tier progression (Bronze, Silver, Gold, Platinum) and rewards redemption history.
• Support communications: information you provide when you contact us for help, including the contents of your enquiries.
• Waitlist & marketing sign-ups: your email address (and optional name) when you join our waitlist or subscribe to updates.

3.2 Information collected automatically

• Device and technical information: device model, operating system and version, unique device identifiers, IP address, mobile network information, app version, crash logs and diagnostic data.
• Usage data: interactions with the Services, features used, screens viewed, search queries within the app, referral source and approximate session length.
• Location information (only if you enable it): approximate or precise device location used to show you businesses near you and populate map views. See section 9.
• Cookies and similar technologies on our website. See section 11.

3.3 Information we receive from third parties

• When you sign in using Google Sign-In or Apple Sign-In, we receive your name, email address and a unique identifier from those providers (see section 7).
• When a business creates a booking on your behalf, or when a customer books with your business, we receive booking metadata from the other party.
• Payment status information (successful payment, refund, chargeback) from our payment processor Stripe (see section 8). We do not receive your full card details.

3.4 Information we do not collect

• We do not collect full payment card numbers, CVV or full card expiry — these are entered directly into Stripe’s secure payment forms and are never seen or stored by BiziBud AU.
• We do not collect biometric data.
• We do not sell your personal information to any third party.

We use the information we collect for the following purposes:

If you are in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases to process your personal data:

• Contractual necessity — to provide the Services you have requested, such as processing bookings and payments.
• Legitimate interests — to keep the Services secure, improve them, prevent fraud, and communicate with you about service-related matters.
• Consent — for marketing communications, precise location access and certain optional cookies. You can withdraw consent any time.
• Legal obligation — to comply with applicable laws, court orders or regulatory requirements.

We do not sell your personal information. We share it only with the categories of recipients set out below, and only to the extent needed for the purposes described in this policy.

You can create and sign in to your BiziBud AU account using:

• Email and password — passwords are stored in a hashed, salted form and never in plain text.
• Google Sign-In — we receive your name, email and a unique identifier from Google. We do not receive your Google password. Your use of Google Sign-In is also subject to Google\u2019s privacy policy.
• Apple Sign-In — we receive a unique identifier and, if you choose, your name and either your real or an Apple-relayed email address. We do not receive your Apple password. Your use of Apple Sign-In is subject to Apple\u2019s privacy policy.

Authentication is provided through Firebase Authentication (a Google service).

Payments on BiziBud AU are processed by Stripe, Inc. and its regional affiliates. Stripe is a PCI-DSS Level 1 certified payment processor.

• When you enter payment details, those details are transmitted directly to Stripe over an encrypted connection. BiziBud AU does not see or store your full card number, CVV or full expiry date.
• We receive limited payment metadata from Stripe such as: cardholder name, brand, last 4 digits, transaction amount, currency, timestamp, success or failure status, and refund status.
• For business users receiving payouts, Stripe will collect additional identity and banking information from you directly (Stripe Connect) to comply with KYC and anti-money-laundering laws. That information is held by Stripe, not by BiziBud AU.
• Your use of Stripe is subject to Stripe\u2019s privacy policy.

BiziBud AU uses your device location only when you enable it and only to power features such as: showing businesses near you, populating map views, and calculating distances to businesses. You can enable, disable or change the level of precision (precise vs. approximate) at any time in your device settings.

• We do not track your location in the background.
• We do not share your precise location with any business or third party for advertising.
• If you disable location access, the app will still work — you can search by suburb, postcode or business name instead.

BiziBud AU uses Firebase Analytics and Firebase Crashlytics (both provided by Google) to understand how the app is used and to diagnose stability issues.

• Firebase Analytics collects aggregated, mostly anonymised information about screens viewed, events triggered inside the app, session length, device type, app version and country. We use it to understand which features are useful and to improve the app.
• Firebase Crashlytics automatically collects crash reports (including a stack trace, device model, OS version and app version) when the app unexpectedly closes. This helps us identify and fix bugs quickly.
• Analytics data is retained by Firebase in accordance with our configured retention settings and Google\u2019s policies. See Firebase\u2019s privacy information.
• Where required by law, you may opt out of analytics collection via your device settings or by contacting us.

Our website at bizibud.com.au uses a minimal set of cookies and local storage technologies to keep the site working and to measure aggregated traffic:

• Strictly necessary cookies — used to keep the site running securely and to remember preferences such as your session state.
• Analytics / performance — anonymised traffic and performance data (e.g. page load time, aggregated page views). We do not use cookies to build cross-site advertising profiles.

You can control cookies through your browser settings. Blocking strictly necessary cookies may break parts of the website. Our mobile app does not use browser cookies but does use device identifiers as described in section 3.

Your data is stored on secure cloud infrastructure operated by Google Firebase and other reputable providers. We apply industry-standard technical and organisational safeguards, including:

• Encryption in transit using TLS 1.2 or higher.
• Encryption at rest for databases and file storage.
• Access controls, principle-of-least-privilege for staff, and audit logging.
• Passwords stored using industry-standard hashing algorithms.
• Regular monitoring for security threats and vulnerabilities.

No method of transmission over the internet is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in serious harm, we will notify affected users and the relevant authorities as required by law (including the Notifiable Data Breaches scheme in Australia and, where applicable, the GDPR).

We retain your personal information only for as long as necessary to provide the Services and for legitimate business or legal purposes.

• Account information: retained while your account is active. Deleted (or anonymised) within a reasonable time after account deletion, except where we are required to keep it for tax, legal or accounting purposes.
• Booking & payment records: retained for the period required by Australian tax and financial record-keeping law (typically 5–7 years).
• Support communications: retained for as long as needed to resolve your issue and improve our service, typically no more than 24 months.
• Analytics data: retained by Firebase in accordance with the retention period configured in our project (currently up to 14 months).
• Marketing sign-ups: retained until you unsubscribe. You can unsubscribe from any marketing email using the link at the bottom of the email.

Subject to applicable law (including the Australian Privacy Principles and, where relevant, the GDPR/UK GDPR), you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correct — ask us to update or correct inaccurate information (most fields can be edited yourself in your profile).
• Delete — request deletion of your account and associated personal information, subject to legal retention requirements. In the app, go to Profile → Settings → Delete account, or email us.
• Object or restrict — object to certain processing (such as direct marketing) or ask us to restrict processing.
• Portability — request a copy of your personal information in a common, machine-readable format.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting past lawful processing.
• Complain — lodge a complaint with a supervisory authority (see section 18 below).

To exercise any of these rights, email us at privacy@bizibud.com.au. We may need to verify your identity before responding. We will respond within the timeframes required by applicable law.

BiziBud AU is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, please contact us and we will delete it promptly.

BiziBud AU is based in Australia. To provide the Services, your personal information may be stored or processed in countries outside your country of residence, including the United States (where Firebase, Stripe and other providers operate). When we transfer personal data outside the EEA or UK, we rely on legally recognised safeguards such as Standard Contractual Clauses, or transfer to countries recognised as providing adequate protection.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will provide additional notice, for example by email or in-app notification.

Your continued use of the Services after the updated policy comes into effect constitutes your acceptance of the changes.

If you have any questions, requests or complaints about this Privacy Policy or your personal information:

Postal address: BiziBud AU, Australia.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) or, if you are in the EEA/UK, your local data protection authority.