Legal

Privacy policy

Updated 28 October 2026

Who we are

QR Booking provides booking software to small Australian shops. This policy says what personal information we handle and how, under the Privacy Act 1988 and the Australian Privacy Principles. Contact: martintse.sc@gmail.com.

What we hold

Shop accounts: the owner's and staff's names, email addresses and mobile numbers; passwords, stored only as a one-way hash; the business's ABN and what the Australian Business Register publishes about it; sign-in records (time, device, IP address); billing details.

A shop's clients: what the shop or the client enters, such as name, mobile, email, notes, booking history, payments and balances recorded at the shop, and the text messages sent and received. We hold client information on the shop's behalf; the shop decides what is collected and why.

What we use it for

To run the service: show bookings, send the texts and emails the shop sets up (confirmations, reminders, codes), keep accounts secure, bill shops, give support and meet the law. We do not sell personal information and we do not use it for advertising.

Who else handles it

Only the providers the service needs: Neon (database) and Fly.io (servers), both in Sydney, Australia; ClickSend or Twilio (text messages; Twilio is in the United States); Resend (email, which may process messages in the United States); Stripe (card payments, which may process them in the United States: card numbers never reach our servers); and the Australian Business Register (to check an ABN). Each may use the information only to provide its service.

The app and the booking page also load a font from Google Fonts and scripts from cdnjs (Cloudflare), and the sign-up page uses hCaptcha when it is switched on; these see your device's IP address and browser, and may be outside Australia (including the United States).

Where it is kept

In Australia: the database is in AWS's Sydney region through Neon. Emails and text messages pass through their providers' systems on the way.

Security

Passwords are hashed, codes are single-use and expire quickly, shop owners must use two-step sign-in, and every connection is encrypted. Staff see only what their shop allows.

Access, correction and deletion

A shop can view, correct, export and delete its clients' information in the app. Clients should ask the shop first; we help the shop answer.

Anyone can ask us for the information we hold about them, or ask us to correct or delete it: write to martintse.sc@gmail.com. When a shop closes, its data is deleted 30 days later, except records the law requires us to keep.

Cookies

We use only the cookies needed to sign you in, remember your language and keep forms secure. No advertising or tracking cookies.

Complaints

Write to martintse.sc@gmail.com and we will reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

Any change is posted on this page, and shop owners are emailed about important ones.