Privacy Policy

Last updated 12 October 2026

This policy explains what information BookDone collects, why we collect it, and how we look after it. It covers shop owners, customers who leave a review, people who report a review, and people who buy a stand.

Who handles your information

BookDone is run by CPIX Pty Ltd, ABN 24 643 221 630, in New South Wales, Australia. CPIX Pty Ltd handles the personal information described here.

We follow the Australian Privacy Principles in the Privacy Act 1988.

To contact us about privacy, email hello@bookdone.com.au.

Shop owners

When you sign up and run a shop page, we collect:

• your email address
• the shop details you enter: name, suburb, phone, Instagram, WhatsApp, Messenger, booking link, hours, prices and cover photo
• your sign-in links and sessions. We store these only as salted hashes. A salted hash is a scrambled code, not the link itself.
• Google's ID for your shop. When you sign up, we use Google's Places service to find your shop. We store only Google's place ID.

Proving a shop is yours

To check a shop is yours, we send a one-off SMS code. It goes to the phone number on your Google listing. ClickSend sends the SMS for us. We don't store that phone number.

You can also confirm with a code through Instagram direct message. Instagram is run by Meta, under its own privacy policy.

Customers who leave a review

Reviews are public. Once a review shows, anyone can see its stars, text, name or initials, photos and video. If you prefer, use your initials only.

When you leave a review, we collect:

• your star rating and review text
• your first name or initials
• the language you used
• any photos or video you add
• if you add photos or video: the version of the consent wording you agreed to, and the time you agreed
• a salted hash (a scrambled code) of your IP address and of a random device ID. We use these only for the review limits, and we delete them after 30 days.

People who report a review

If you report a review, we collect the reason and any details you add. You can also choose to give us a contact. We use these to check the report and reply to you.

People who buy a stand

Stripe handles your payment. We never see or store your card number.

When you buy a stand, we collect:

• your email address, to send your order confirmation and tracking number
• the shop name and the line you want printed
• for a stand from our Google review QR code tool, the Google listing you picked (its public place ID), so the QR code opens the right review page
• the delivery name and address. We delete these 90 days after we post the stand.

Shops we contact about a free preview

Sometimes we make a free preview page for a shop. We send its link to a contact the shop has made public.

If you reply STOP, we add you to our do-not-contact list. We keep that list so we never contact you again.

For each contact, we keep a record for 3 years. It shows how and why we contacted the shop. The record includes:

• the channel and the public address we used
• where that address was published, with a screenshot
• the dates we made contact
• the date of any STOP reply

Why we use information

We don't sell personal information. We use it only to run BookDone, including:

• showing shop pages and reviews
• signing owners in and checking they own the shop
• sending emails you need, such as sign-in links, review alerts and order updates
• stopping spam, fake reviews and abuse
• handling reports
• making, posting and tracking stands
• keeping records the law requires

Cookies

Cookies are small files saved in your browser. We don't use advertising cookies on our app pages.

Some older guide and tool pages on our site use Google Analytics. It sets its own cookies to measure visits. Google's opt-out tool at https://tools.google.com/dlpage/gaoptout blocks it in your browser.

On our app pages, we set these cookies:

• bd_sess: keeps a shop owner signed in, for 30 days after the last visit
• bd_dev: a random device ID for the one-review-per-30-days limit. It stays in your browser for 1 year.
• bd_lang: remembers the language you chose, for 1 year
• bd_ops: lets our own team sign in to our admin console, for 12 hours

Who we share information with

We may share information when the law requires it.

We also use service providers to run BookDone. Each one gets the information it needs for its task:

• Cloudflare: hosting, our database, file and video storage, and Turnstile bot checks. Turnstile uses technical details from your browser to check that a real person is using a form.
• Stripe: stand payments
• Resend: sending emails
• ClickSend: sending the one-off ownership SMS
• Google: the Places service, to find your shop when you sign up
• Australia Post: delivering stands

Information stored outside Australia

Some of our providers may store or handle information outside Australia, for example in the United States.

How long we keep information

We keep information only as long as we need it. Live reviews and shop details stay while the page is live. These are our set times:

• IP address and device hashes: 30 days
• photos and video from a removed review: 7 days
• a deleted shop's data: deleted when we act on the request, within 7 days
• stand delivery details: 90 days after we post the stand
• unclaimed preview pages: 14 days
• outreach records: 3 years
• order records: as long as tax law requires
• the do-not-contact list: kept, so we never contact you again

Keeping information safe

We take reasonable steps to protect your information from misuse, loss and unauthorised access. For example, we store sign-in links and the IP and device data only as salted hashes.

No system is perfectly secure. Please keep your email account safe, because it is how you sign in.

Seeing, correcting or deleting your information

You can ask to see the personal information we hold about you. You can also ask us to correct it or delete it. Email hello@bookdone.com.au.

We may need to check who you are first. If the law says we must keep something, we will tell you.

Shop owners can change their shop details in their settings at any time. Customers can ask the shop for an edit link, or use Report on their review.

Complaints

If you are unhappy with how we handled your information, email us first at hello@bookdone.com.au. We will check and reply.

You can also complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au if you are still not satisfied.

Changes to this policy

We may update this policy. The date at the top shows when we last changed it. If a change is important, we will email shop owners.