Privacy Policy
Last updated: 17 October 2026
This Privacy Policy explains how AORA BOOKING ("AORA", "we", "us") collects, uses, stores, and protects personal information when you use our massage and spa booking platform, including our website, the AORA Booking iOS app, and the booking pages we host for individual clinics ("Shops").
AORA BOOKING is operated from Australia and handles personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
1. Who this policy applies to
AORA BOOKING is used by three types of people, and this policy covers all of them:
- Shop owners & staff — clinic admins and massage therapists who manage bookings, clients, and payroll through the app.
- End clients — people who book a massage or buy a gift voucher through a Shop's public booking page.
- App reviewers / prospective customers — people browsing our marketing pages or signing up for a trial.
2. Information we collect
| Category | Examples | Who it's from |
|---|---|---|
| Account details | Name, email, phone, business name, ABN | Shop owners at sign-up |
| Staff payroll details | ABN/TFN status, commission rate, superannuation fund details | Entered by shop admins for payslip generation |
| Booking details | Client name, phone, email, appointment time, service, notes | Entered by clients or staff at time of booking |
| Health intake data | HICAPS claim details, medical conditions, allergies, pain areas, signatures | Clients completing a HICAPS intake form, with consent |
| Payment information | Subscription plan, invoice amounts. Card numbers are never seen or stored by AORA — they go directly to Stripe. | Shop owners subscribing to a paid plan |
| Device & usage data | IP address, browser type | Automatically, when you use the app or website |
| Optional Web Push registration | Push service endpoint, subscription encryption keys, account and Shop identifiers, language, and delivery status | Shop owners, staff, and platform administrators who enable notifications on a supported browser or installed web app |
3. Camera access
The iOS app requests camera access only to scan a QR code printed on a gift voucher during checkout. The camera feed is processed on your device to read the code and is never recorded, uploaded, or stored.
4. How we use this information
- To operate the booking calendar, client records, and payroll tools shop owners rely on.
- To send booking confirmations, reminders, receipts, and gift voucher emails.
- With device permission, to send staff booking alerts and platform administrator alerts about new Shops and support messages. Push text is generic and does not contain client names, health information, or chat contents.
- To process subscription billing for Shop accounts.
- To keep the service secure and diagnose bugs.
We do not sell personal information, and we do not use it for advertising or ad targeting.
5. Who we share information with
We use a small number of trusted service providers to run AORA BOOKING. Each only receives the data it needs to do its job:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and file storage |
| Stripe | Subscription billing for Shop accounts |
| Resend | Transactional emails (confirmations, receipts, vouchers) |
| Your browser or device's Push service (such as Apple, Google, Mozilla, or Microsoft) | Delivery of optional encrypted Web Push messages to the devices you register |
You can turn off Push in the notification menu or your browser/device settings. Signing out removes the current device's registration for that account; closing the app does not. Web Push is available only on supported browsers or installed web apps, not the native iOS app.
We do not share client or health information between different Shops. Each clinic's data is isolated to that clinic.
6. Data retention
We retain account and booking data for as long as a Shop's account is active, and for a reasonable period afterward to meet legal and accounting obligations. You can request deletion of your data at any time — see Section 8.
Push registrations are kept while enabled and removed when disabled, on sign-out, or when the Push service reports that an endpoint has expired. Push event and delivery-receipt history is cleaned up after seven days.
7. Your rights
You can ask us to:
- Access a copy of the personal information we hold about you.
- Correct inaccurate information.
- Delete your account and associated data, subject to legal retention requirements.
8. Contact us
For any privacy question or request, email aorabooking@gmail.com.
9. Children's privacy
AORA BOOKING is a business tool intended for adults and is not directed at children.
10. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.