Privacy Policy

BookMySpot ("we") is a booking platform operated by XBIT Corp Pty Ltd, an Australian company. We're responsible for the personal information collected through bookmy.spot and our apps.

We collect:

• Account data — name, email, password hash, business details you provide.
• Booking data — names, contact details and intake-form answers your customers submit through pages you publish.
• Payment data — masked card details, billing address, transaction amount. Full card numbers never touch our servers; they're tokenised and processed by Stripe, our payment provider.
• Usage data — pages visited, features used, IP address, device type. Used in aggregate to improve the product.

We use your data to operate the Services, process payments, send transactional emails (booking confirmations, receipts and reminders), prevent fraud, and improve the product. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

What we don't do

• We do not sell personal data, ever.
• We do not train third-party AI models on your data.
• We do not run third-party advertising trackers in the dashboard or in checkout flows.

We share data only with sub-processors needed to deliver the Services:

• Stripe — payment processing.
• Cloudflare — hosting, file storage and transactional email delivery.
• Neon — managed database hosting.
• Sentry — error monitoring, so we can find and fix crashes.

We'll update this policy before we add or change sub-processors.

You can access, correct, export or delete your data at any time. Depending on where you live, you may have additional rights under local privacy law, including objection, restriction and data portability. Australian residents have rights under the Privacy Act 1988 (Cth).

Most actions are self-serve from Settings → Data. For anything else, write to support@bookmy.spot — we respond within 30 days.

Account data is kept for the lifetime of your account, plus 30 days in production storage and 90 days in backups after closure. Financial records are retained for seven years to comply with Australian tax and AML law. You can request earlier deletion of non-financial data at any time.

Payments are processed by Stripe; full card numbers never touch our servers. All traffic is encrypted in transit with TLS, data at rest is encrypted, and access to production systems is restricted to authorised staff behind multi-factor authentication.

We use a minimum number of strictly-necessary cookies to keep you signed in, persist your dashboard preferences, and prevent CSRF attacks. We do not run advertising or analytics cookies that share data with third parties.

We'll notify you in-app and by email at least 30 days before any material change to this policy. Older versions are available on request.

Privacy questions: support@bookmy.spot. BookMySpot is operated by XBIT Corp Pty Ltd, Australia.