Privacy Policy

BookMySpot ("we") is a booking platform operated by XBIT Corp Pty Ltd (ABN 20 682 428 128), trading as BookMySpot, based in South Australia, Australia. This policy covers the personal information collected through bookmy.spot, whether you're a Host running a business on the platform or a Customer booking through a Host's page, including as a guest. When you book with a Host, that Host also receives the booking information you submit and is responsible for how it handles it.

The platform isn't directed at children. We don't knowingly collect personal information from a child without the consent of a parent or guardian; if you believe a child has provided us personal information, contact us and we'll delete it.

We collect:

• Account data - name, email, a password hash if you sign up with a password (or your Google account identifier if you sign in with Google), and business details you provide.
• Booking data - names, contact details and intake-form answers submitted through Hosts' booking pages, including guest checkouts, where we collect an email address to deliver the booking and tickets. Hosts choose what their intake forms ask; if a form requests sensitive information (for example, health or dietary details), we collect it on the Host's behalf and only with your consent.
• Payment data - transaction records only: amount, currency, payment status and a Stripe payment reference. We don't collect or store card details or billing addresses; those go directly to Stripe, our payment provider, which processes the payment on the Host's connected account.
• Usage data - pages visited, features used, IP address, device type. Collected through our own analytics tooling and used to improve the product.

We use your data to operate the platform, process payments, send transactional emails (booking confirmations, tickets, receipts and account notices), prevent fraud and abuse (including automated screening of listing content), and improve the product. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

Marketing

Emails from us are transactional unless you've opted in to marketing, and every marketing email includes an unsubscribe link. Hosts can also collect an optional subscriber list through their pages for their own updates; subscribing is separate from making a booking, you can unsubscribe at any time, and we don't use Hosts' subscriber lists for our own marketing.

What we don't do

• We do not sell personal data, ever.
• We do not use your data to train AI models.
• We do not run third-party advertising trackers in the dashboard or in checkout flows.

We share data only with the parties needed to run the platform:

• Hosts you book with - receive the booking details and intake-form answers you submit on their pages. Hosts handle that information under their own privacy practices and this policy doesn't bind them, so check with the Host if you have questions about how they use it.
• Stripe - payment processing and payouts to Hosts.
• Infrastructure providers - cloud hosting, file storage, database and transactional email delivery.
• Analytics & monitoring providers - product analytics (PostHog, hosted in the European Union) which runs only if you opt in to analytics cookies, and error monitoring (Sentry) so we can find and fix crashes.
• Content moderation providers - automated screening of listing content published by Hosts.

Some of these providers process data outside Australia, including in the United States and the European Union. We take reasonable steps to ensure they handle personal information consistently with Australian privacy law, and we keep this list up to date as providers change. We may also disclose information where the law, a court order or a regulator requires it.

You can ask us to access, correct, export or delete your personal data at any time, and you can update your account details from your settings. Australian residents have rights under the Privacy Act 1988 (Cth); depending on where you live, you may have additional rights under local privacy law, including objection, restriction and data portability.

For access, correction or deletion requests, or anything else, write to support@bookmy.spot and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

We keep account data for the life of your account and delete or de-identify it within a reasonable period after closure, including from backups. Financial records are retained for seven years to comply with Australian tax and corporations law. You can request earlier deletion of non-financial data at any time.

Payments are processed entirely by Stripe; card details never touch our servers. Traffic is encrypted in transit with TLS, data is encrypted at rest, and access to production systems is limited to authorised people on a least-privilege basis. No system is perfectly secure; if we become aware of a data breach that affects you, we'll notify you as required by law.

We use strictly-necessary cookies to keep you signed in, persist your preferences and prevent CSRF attacks and payment fraud. Analytics cookies are set only if you opt in through our cookie banner, and you can change your mind at any time via the Cookie preferences link in the footer. We do not use advertising cookies or share cookie data with ad networks. For the full list of cookies, what they do and how long they last, see our Cookie Policy at /cookies.

We may update this policy from time to time. We'll give reasonable notice of material changes in-app or by email, and older versions are available on request.

Privacy questions: support@bookmy.spot. BookMySpot is operated by XBIT Corp Pty Ltd (ABN 20 682 428 128), South Australia, Australia.