Company

Privacy Policy

Last updated: September 7, 2026

Bookka Pty Ltd of Adelaide, South Australia (“Bookka”, “we”, “us”) provides a booking and marketing platform for service businesses. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why, who we share it with, and how you can access or correct it or make a complaint.

1. Information we collect

Account & business data

  • Name, email, phone number, and password (hashed) when you create an account.
  • Business profile information you enter: business name, ABN, address, services, prices, hours, photos.
  • Booking, payment, and customer-management data you create through the platform.
  • Communications you send via Bookka (SMS, email, in-app messages).

Customers of businesses on Bookka

If you book a business through Bookka we collect the details needed for that booking: your name, contact details, the appointment, any notes you add, and payment records (card details go directly to Stripe). We hold this on behalf of the business you booked, and the business can see it. The business is responsible for how it uses your information under its own privacy obligations.

Connected social and advertising accounts

When you connect a third-party account (Facebook Page, Instagram Business, TikTok, Meta Ads, Google Ads), we receive an access token from that provider and store it encrypted at rest so we can act on your behalf. We do not store your social provider password. Specifically:

  • Meta (Facebook + Instagram): Page access tokens, Page ID, Instagram Business Account ID, basic profile (avatar, name), posts we publish on your behalf, and engagement metrics (likes, comments, link to the post). Read with the permissions you grant during the Facebook Login flow.
  • TikTok: Your TikTok open_id, union_id, username, avatar, display name, the videos and photos you ask us to publish on your behalf, and their engagement counts (likes, comments, shares, views). Scopes requested: user.info.basic, user.info.profile, video.publish, video.list.
  • Meta Ads / Google Ads: Ad account IDs, campaign metadata, and reporting metrics for the campaigns you create through Bookka.

Automatically collected

  • Device, browser, IP address, and basic usage analytics.
  • Cookies used for sign-in, CSRF protection, and remembering preferences. Optional analytics and advertising cookies are set only if you agree — see our Cookie Policy for the full list and to change your choices.

2. How we use your information

  • To run the service: provide bookings, publish scheduled social posts, send notifications you have enabled.
  • To show you analytics about your business activity and connected accounts.
  • To process payments through Stripe (we never store full card numbers ourselves).
  • To prevent fraud and abuse, and to enforce our Terms of Service.
  • To send service messages about your account. These are not marketing and you cannot opt out of them while you hold an account.

3. Direct marketing

We only send you marketing email or SMS with your consent, and every message includes a way to unsubscribe, as required by the Spam Act 2003 (Cth). You can also turn marketing off under Settings → Notifications. Businesses that send marketing to their own customers through Bookka are responsible for holding that consent.

4. Sharing with third parties

We share personal information only with the providers needed to run the service:

  • Supabase — hosting, database, file storage.
  • Stripe — payments and subscription billing.
  • Resend — transactional email.
  • Twilio — SMS notifications.
  • Meta (Facebook, Instagram, Meta Ads) — publishing posts and reading engagement, when you connect those accounts.
  • TikTok — publishing posts and reading engagement, when you connect that account.
  • Google Ads — managing ad campaigns, when you connect that account.
  • Accounting providers (Xero and others) — invoices and payments, when you connect that account.
  • OpenAI / Anthropic — generating AI captions, replies, and copy you request.
  • Mapbox — rendering maps in our search interface.

We do not sell personal information. We may also disclose information where the law requires it, for example to a court or regulator.

5. Overseas disclosure

Some of the providers above store or process data outside Australia, including in the United States. Before we disclose personal information overseas we take reasonable steps, as APP 8 requires, to make sure the recipient handles it in a way that is consistent with the APPs, including through contractual data-protection terms. For visitors in the EU or UK we rely on standard contractual clauses for transfers out of those regions.

6. Data retention

We keep account and business data for as long as your account is active. When you disconnect a social account, we revoke and delete its access token. Staged media (images, videos uploaded for publishing) is automatically removed within 24 hours of being published. Deleted accounts are purged within 30 days, subject to any legal retention requirements such as tax records.

7. Access, correction and your other rights

  • You can view and correct your account and business details in the Bookka dashboard at any time.
  • For a copy of the personal information we hold about you, or to correct something you cannot change yourself, email privacy@bookka.app. We respond within 30 days and do not charge for access.
  • Disconnect any connected social, advertising or accounting account at any time from the Integrations page (this revokes the access token).
  • Delete your account — see Data deletion instructions.
  • If you are in the EU or UK you also have GDPR rights (access, rectification, erasure, portability, objection).

8. Complaints

If you think we have mishandled your personal information, email privacy@bookka.app. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9. Security and data breaches

We store credentials and access tokens encrypted at rest, restrict access with row-level security, and require HTTPS for all traffic. No system is perfect. If a data breach is likely to result in serious harm we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

10. Children

Bookka accounts are for people 18 and over. We do not knowingly collect personal information from children, and a business that takes bookings for minors is responsible for obtaining a parent or guardian’s consent.

11. Changes to this policy

We will update the “Last updated” date above when we change this policy. Material changes will be highlighted in the dashboard or by email.

12. Contact

Bookka Pty Ltd, Adelaide, South Australia.
Questions or requests: privacy@bookka.app.