Privacy Policy
Last updated: 2 July 2026
This Privacy Policy explains how AORA BOOKING ("AORA", "we", "us") collects, uses, stores, and protects personal information when you use our massage and spa booking platform, including our website, the AORA Booking iOS app, and the booking pages we host for individual clinics ("Shops").
AORA BOOKING is operated from Australia and handles personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
1. Who this policy applies to
AORA BOOKING is used by three types of people, and this policy covers all of them:
- Shop owners & staff — clinic admins and massage therapists who manage bookings, clients, and payroll through the app.
- End clients — people who book a massage or buy a gift voucher through a Shop's public booking page.
- App reviewers / prospective customers — people browsing our marketing pages or signing up for a trial.
2. Information we collect
| Category | Examples | Who it's from |
|---|---|---|
| Account details | Name, email, phone, business name, ABN | Shop owners at sign-up |
| Staff payroll details | ABN/TFN status, commission rate, superannuation fund details | Entered by shop admins for payslip generation |
| Booking details | Client name, phone, email, appointment time, service, notes | Entered by clients or staff at time of booking |
| Health intake data | HICAPS claim details, medical conditions, allergies, pain areas, signatures | Clients completing a HICAPS intake form, with consent |
| Payment information | Subscription plan, invoice amounts. Card numbers are never seen or stored by AORA — they go directly to Stripe. | Shop owners subscribing to a paid plan |
| Device & usage data | IP address, browser type, push notification token | Automatically, when you use the app or website |
3. Camera access
The iOS app requests camera access only to scan a QR code printed on a gift voucher during checkout. The camera feed is processed on your device to read the code and is never recorded, uploaded, or stored.
4. How we use this information
- To operate the booking calendar, client records, and payroll tools shop owners rely on.
- To send booking confirmations, reminders, receipts, and gift voucher emails.
- To send push notifications about new bookings (shop staff) or booking updates (clients who opt in).
- To process subscription billing for Shop accounts.
- To keep the service secure and diagnose bugs.
We do not sell personal information, and we do not use it for advertising or ad targeting.
5. Who we share information with
We use a small number of trusted service providers to run AORA BOOKING. Each only receives the data it needs to do its job:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and file storage |
| Stripe | Subscription billing for Shop accounts |
| Resend | Transactional emails (confirmations, receipts, vouchers) |
| OneSignal | Push notifications |
We do not share client or health information between different Shops. Each clinic's data is isolated to that clinic.
6. Data retention
We retain account and booking data for as long as a Shop's account is active, and for a reasonable period afterward to meet legal and accounting obligations. You can request deletion of your data at any time — see Section 8.
7. Your rights
You can ask us to:
- Access a copy of the personal information we hold about you.
- Correct inaccurate information.
- Delete your account and associated data, subject to legal retention requirements.
8. Contact us
For any privacy question or request, email aorabooking@gmail.com.
9. Children's privacy
AORA BOOKING is a business tool intended for adults and is not directed at children.
10. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.