Privacy Policy

1. About This Policy

OneBookPlus (ABN 17 971 013 775) ("we", "us", "our") operates the OneBookPlus platform at onebookplus.com.au. This policy explains how we collect, use, disclose, and protect your personal information in compliance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect

Account Information

• Name, email address, and password when you create an account, or your identity token if you sign in with Google or Apple
• Business name, ABN, address, and phone number
• Payment and billing information for website purchases (processed securely via Stripe, we never store card numbers)
• For subscriptions purchased in our iOS app, billing is handled entirely by Apple, we receive only subscription status (plan, renewal and expiry dates), never your payment details
• Multi-factor authentication (MFA) enrolment data, including TOTP authenticator secrets

Mobile App Data

• Push notification device tokens (Apple Push Notification service), if you enable notifications
• Device type and app version, used for compatibility and support
• Biometric unlock (Face ID / Touch ID) is processed entirely on your device, biometric data never leaves your phone and is never sent to us
• Crash and freeze reports from the iPhone app, delivered to us by Apple on the next launch. They carry the technical details of the fault, the app version it happened on, and the screen you were last on, so we can fix it. They contain none of your business data.

Business Data

• Contacts and client records you create
• Invoices, quotes, bookings, orders, and expenses
• Financial and accounting data, including P&L, revenue, GST, and BAS summaries
• Daily sales records and reporting data
• Point of Sale (POS) transaction data, including items sold, payment methods, and terminal sessions
• Service listings and booking page configurations
• Marketing campaign data, email templates, and contact lists
• Google Reviews data and review request history
• Posts your business writes or approves in Content Autopilot, where each one was published, and how it did

ATO and Tax Data

The ATO Tax Lodgement feature is in development and not yet available. Once released, if you use it, we may collect and process additional sensitive data:

• Tax File Numbers (TFNs) and ABN details for tax lodgement purposes
• BAS (Business Activity Statement) lodgement data, including GST amounts, PAYG, and instalment figures
• Tax return data prepared for submission to the Australian Taxation Office
• ATO Digital Service Provider (DSP) authentication tokens and session data

Tax data is handled under enhanced security controls in accordance with ATO DSP operational framework requirements. This data is encrypted at rest and in transit and subject to stricter access controls and audit logging.

Automatically Collected

• IP address, browser type, device information
• Pages visited and features used (via Google Analytics and Vercel Analytics)
• Anonymous interaction analytics on our public website (our own system, not a third party): which pages you view, how far you scroll, where on a page you click, whether you started and abandoned a form, whether you copied text from a page (we record how many characters, never the text itself), a signal when your pointer leaves the page towards the browser bar, and page performance timings. No form field values are ever captured, and the visitor identifier is a daily-rotating hash that cannot be linked back to you or across days.
• How you use OneBookPlus once you are signed in, in the app and on the web, recorded against your account and your business: which screens you open, which actions succeed, where a form is started and left, repeated taps in one spot, and the errors you run into. We use this to find what is broken or confusing and fix it. We never record what you type. No field values, no customer names, no note or message contents. Error messages are scrubbed of emails, phone numbers, ABNs, card numbers and quoted values before they are stored, and these records are deleted after 90 days. This is never used for advertising and never sold.
• Cookies for authentication and preferences
• Session activity logs, including login times, idle timeouts, and security events

When You Open a Document Someone Sent You

Invoices, quotes, sales orders and job updates are shared as a private link. When you open one, we record that the document was opened and, if you act on it, whether you accepted or declined it. Alongside that we store the date and time, your IP address, your browser's user-agent string, whether the device is a phone, tablet or desktop, and the referring page if your browser sent one. That record is visible only to the business that sent you the document, so it can tell whether its invoice or quote was read. It is not used for advertising, it is never sold, and it is not combined with the website analytics described above.

These records are kept for as long as the business keeps the document they belong to. When the business closes its OneBookPlus account, they are deleted with the rest of its data, on the schedule in the data retention section below. If you would rather a business did not hold this record of your visit, ask that business: it is their record, and they can delete the document it hangs off.

When You Call a Business That Uses the AI Receptionist

Some businesses on OneBookPlus have their calls answered by our AI Receptionist. The greeting on every call says you are speaking with an automated assistant and that the call is transcribed. For that business we keep your phone number, a written transcript and summary of what was said, how the call ended, and any booking or message that came out of it. The written transcript is kept for as long as the business's transcript setting says: 365 days unless the business changes it, and a business can choose to keep transcripts longer, or without a time limit. The record of the call itself, who rang, when and how it ended, stays with the business's other records.

Call Recordings

Call recording is off unless the business switches it on, and it is only available on lines that use the premium voice. When it is on, the greeting also says the call is recorded. The recording is kept by ElevenLabs, our voice provider, in the United States for 7 days after the call, and then deleted. We do not keep our own copy of the audio. Within OneBookPlus, the business's owners and admins can play, download or delete a recording, and each of those is written to the business's audit log. A small number of OneBookPlus staff can also play or download a recording to support the business. They cannot delete it, and every play and download is recorded in our own logs.

If you called a business and want a copy of a recording, or want a recording or a transcript deleted, ask that business. It is their record, and within those 7 days an owner or admin can download the recording for you or delete it.

3. How We Use Your Information

• To provide and maintain the OneBookPlus platform and all installed apps
• To process subscription payments, app purchases, and manage billing via Stripe
• To process client payments on your behalf via Stripe Connect
• To send transactional emails (invoices, quotes, payment reminders, booking confirmations)
• To provide customer support
• To improve our services and develop new features
• To comply with legal obligations (e.g. tax reporting, ATO requirements)
• To submit tax lodgements to the ATO on your behalf (when using the ATO Tax Lodgement app)
• To sync data with third-party integrations you enable (Mailchimp, Google Calendar, Google Business Profile, Facebook, Instagram and Threads)
• To enforce security policies, including MFA, session management, and brute force protection

4. How We Share Your Information

We do not sell your personal information. We may share data with:

• Service providers: Supabase (database and authentication), Stripe (payments and billing), Apple (App Store billing and push notifications for the iOS app), Resend (email delivery), Vercel (hosting), Google (analytics, and the Calendar and Business Profile integrations), Anthropic (Claude, for the AI Companion paid app, the chat widget and the AI Receptionist), Twilio (phone numbers, calls and text messages) and ElevenLabs (the AI Receptionist's premium voice). Each one is named, with what it can see, in the OneBookPlus subprocessor list
• Third-party integrations: Mailchimp (marketing sync), Google Ads, and Facebook Ads, only when you explicitly enable these integrations. Xero (accounting sync) is in development and not yet available
• The accounts you connect to Content Autopilot: when a post your business approved goes out, its words, photos and link are sent to the Google Business Profile, Facebook Page, Instagram account or Threads profile it was approved for, which shows it under Google's or Meta's own terms
• Australian Taxation Office (ATO): When the ATO Tax Lodgement feature is released, tax lodgement data will be submitted directly to the ATO via their secure API when you use it
• Your clients: When you send invoices, quotes, or booking confirmations, your business details are shared with the recipient
• Your team members: Data is shared within your business account with team members based on their role and permissions
• Legal requirements: If required by Australian law or to protect our rights

5. Data Storage and Security

Your business records, files and sign-in data are stored in Australia, in AWS ap-southeast-2 (Sydney). Some specialist suppliers process a defined slice of data overseas, and every one of them is listed row by row in the OneBookPlus subprocessor table. Every supplier is named, with what it can see and where it processes it, in the OneBookPlus subprocessor table. We implement industry-standard security measures including:

• Encryption in transit (HTTPS/TLS) and at rest
• Each business's records are fenced off inside the database itself, not just in the application code, so one business can only reach its own data
• Secure authentication with support for email and password, Google, and Sign in with Apple
• Multi-factor authentication (MFA) using TOTP authenticator apps
• Configurable session timeouts and idle lockouts
• Brute force protection with account lockout after failed login attempts
• Regular security reviews

Overseas Disclosure

Your primary database is hosted in Sydney, Australia. Some of our service providers (including Stripe, Resend, Vercel, Anthropic, Twilio and ElevenLabs) process limited data in the United States under their own compliance programs. When a business uses the AI Receptionist, Twilio carries the call, and the conversation is handled either by ElevenLabs (the premium voice) or by our own service using Anthropic's Claude (the standard voice). Twilio, ElevenLabs and Anthropic process that call in the United States. ElevenLabs deletes the audio and transcript it holds for each call 7 days after the call ends, and Twilio keeps no recording of the call. Where personal information is disclosed overseas, we take reasonable steps as required by APP 8 to ensure the recipient handles it consistently with the Australian Privacy Principles.

Enhanced Security for ATO Tax Lodgement

When the ATO Tax Lodgement app is installed, additional security controls are enforced in line with ATO DSP requirements:

• Mandatory MFA for all users with access to tax data
• Reduced session duration (24 hours) and idle timeout (15 minutes)
• Stricter brute force protection (5 attempts with 15-minute lockout)
• Comprehensive audit logging of all data access, form edits, and submissions
• ABN validation against the Australian Business Register (ABR)

6. App Marketplace and Third-Party Apps

OneBookPlus offers an App Marketplace with optional apps you can install. When you install an app:

• The app may access specific data within your account as needed to function
• Paid apps are billed separately and managed through your billing settings
• You can uninstall apps at any time, which revokes their data access
• Third-party integrations (e.g. Mailchimp) may transfer data to external services governed by their own privacy policies

If You Connect Your Google Business Profile

The Reviews app and Content Autopilot can each connect to your business's Google Business Profile, and they share one connection. An owner or admin signs in with Google and chooses which profile to connect. With that permission we:

• Read the names of the Google accounts and business groups the sign-in manages, and each profile's name, address, Google Maps link and Place ID, so you can choose the right profile and we know which listing is yours
• With the Reviews app, read the reviews on that profile: each reviewer's public name and photo, the star rating, the review text and date, your replies, and Google's overall rating and review count
• With the Reviews app, post, change or remove a reply to a review, only when someone at your business writes the reply and presses post
• Read the booking links on your profile, and add, change or remove your OneBookPlus booking page as one of them, only when someone at your business presses the button to do it
• With Content Autopilot, publish to your Business Profile the posts your business approves, each at the time it was approved for, and nothing your business has not approved
• With Content Autopilot, read your profile's name, address and phone number, to show you which listing your posts go to and to offer a Call button only when the profile has a phone; check whether Google has accepted each post we published and keep its link; and change or delete one of those posts, only when someone at your business asks

We store the Google sign-in encrypted so your reviews can be brought in each day and approved posts can go out at their time, and we keep your 500 most recently posted or edited reviews to show in your dashboard and, if you add a reviews section, on your website. Reviews we cannot refresh from Google for 30 days are deleted. For each post Content Autopilot publishes we keep a record of the post, its link on Google and whether it went out, so you can see it in your dashboard, while your business keeps its account; our log of each request we make to Google is kept for 90 days. Content Autopilot never quotes your Google reviews in a post. We do not post anything on Google that your business did not write, ask for or approve, we do not use this data for advertising, we do not send it to the AI that drafts websites, and we do not use it to train AI models.

Disconnecting in Review settings deletes the stored sign-in and the reviews it brought in, and Content Autopilot's Google posts stop with it. Removing the Reviews app, or the Reviews app ending with your plan, deletes the reviews it brought in, and the stored sign-in too unless Content Autopilot still posts to that profile. Without the Reviews app, Disconnect Google in Content Autopilot, or Content Autopilot ending, deletes the stored sign-in. You can also remove OneBookPlus at any time from the permissions page of your Google Account.

If You Connect Google Search Console

An owner or admin can connect Google Search Console to see how people find your website on Google. They sign in with Google, give OneBookPlus read only access to Search Console, and choose the property for your business's own website. With that permission we:

• Read the list of properties the sign-in can see, so you can choose your website's, and check before each read that the property is your business's own website
• Read, for that property only, your website's clicks, impressions and average position on Google for each day of the last 28 days and the 28 days before, and your top pages and top searches in each period
• With Content Autopilot, use those searches to choose what your blog posts are about. The topic chosen, which can include the words of a search, is given to the AI that drafts the post. A search is never treated as a fact about your business

We store the Google sign-in encrypted so the figures can be refreshed once a day, and we keep the latest figures to show in your dashboard. We never change anything in your Search Console, we do not sell this data, we do not use it for advertising, and we do not use it to train AI models.

Disconnecting on your website's Search Console page deletes the stored sign-in and the figures it brought in. You can also remove OneBookPlus at any time from the permissions page of your Google Account.

OneBookPlus's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If You Connect Facebook, Instagram or Threads

Content Autopilot can publish the posts your business approves to its Facebook Page, its Instagram professional account and its Threads profile. It does this through our app on Meta, called OBP Connect. An owner or admin signs in with Facebook, Instagram or Threads and chooses which Page or account to connect. When they do, we receive and keep:

• For a Facebook Page: its ID, name and profile picture, and the Meta IDs of the sign-in that connected it and of the business portfolio it belongs to
• For an Instagram account: its ID, username and profile picture, and the Facebook Page it is linked to when it was connected through Facebook
• For a Threads profile: its ID, username and profile picture
• For each post we publish: its ID and its link on Facebook, Instagram or Threads, and how many reactions, comments and shares it has
• How many people saw each of those posts, only if your business gives us permission to read that when it connects
• The access token Meta gives us for each connection, which lets us publish for your business

We use this only to publish the posts your business approves, each at the time it chose, and to show your business which account its posts go to and how each post is doing. We do not publish anything your business did not write or approve, and we do not read private messages, follower lists or posts by other people. We never sell this data or use it for advertising, we share it only with the service providers named in section 4 that host and run OneBookPlus, and we do not use it to train AI models.

Each access token is stored encrypted. It is deleted when your business disconnects that account, when OBP Connect is removed from it in Facebook or Instagram, straight away when Content Autopilot is removed from your business, 30 days after your Content Autopilot plan ends, or when your business closes its OneBookPlus account. We keep our record of each post we publish while your business keeps its OneBookPlus account, and our log of each request we make to Meta for 90 days. That log never holds an access token.

To delete this data, use Disconnect, or Delete what we hold, in Content Autopilot, Channels. Disconnect deletes the access token for that account and stops us posting there. Delete what we hold also deletes the account's ID, name and picture, and the IDs and counts of the posts we published there. You can also remove OBP Connect in your Facebook, Instagram or Threads settings, follow the steps on our Facebook, Instagram and Threads data deletion page, or email hello@onebookplus.com.au. Posts already published stay on your Page or profile until you remove them there.

7. Your Rights

Under Australian Privacy law, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and data
• Export your data at any time via the Settings page
• Opt out of marketing communications
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

How to Delete Your Account

• In the iOS app: open Settings, then Delete account. This permanently deletes your account and, if you are the only member, your business and all of its data
• By email: contact support@onebookplus.com.au from your account email, we action verified deletion requests within 7 days
• Deleting your account does not cancel a subscription billed through the Apple App Store, cancel it in your device's subscription settings first (see our Refund Policy)

We respond to privacy requests (access, correction, deletion) within 30 days as required by the Privacy Act. We may ask you to verify your identity before actioning a request.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law (e.g. financial records for 5-7 years per ATO requirements).

ATO tax lodgement records and audit logs are retained for a minimum of 5 years in compliance with Australian tax law, even after account deletion.

AI Receptionist call recordings are kept for 7 days at most, and written call transcripts for as long as the business's transcript setting says, as described in section 2.

Content Autopilot keeps its record of each post it publishes while the business keeps its account, and our log of each request it makes to Google or Meta for 90 days. Facebook, Instagram and Threads access tokens are deleted as section 6 describes.

9. Data Breaches

We participate in the Notifiable Data Breaches (NDB) scheme under the Privacy Act. If a data breach is likely to result in serious harm, we will notify affected users and the OAIC without undue delay, including what happened, what data was involved, and what we are doing about it. Our incident handling process is published at /security/incident-response.

10. Cookies

We use the following categories of cookies:

• Essential cookies, required for authentication, session management, and core platform functionality. These cannot be disabled as the platform would not function without them.
• Analytics cookies, Google Analytics is used on public pages only (not within your dashboard) to understand how visitors use our website. These cookies are only set after you provide consent via our cookie banner. You can withdraw consent at any time by updating your cookie preferences.

We do not use advertising or tracking cookies. No cookie data is sold to or shared with third-party advertisers. Analytics scripts are not loaded at all until you accept them in the cookie banner.

To change your choice, open the cookie preferences panel. It reopens on whatever you chose last, and turning analytics off takes effect straight away on the page you are reading, without a reload. The same control sits in the footer of every page.

11. Third-Party Links

Our platform may contain links to third-party websites and services (including Stripe, Xero, Google, and Facebook). We are not responsible for the privacy practices of those websites and services.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or a notice on our platform.

13. Contact Us

If you have questions about this privacy policy or wish to exercise your privacy rights, contact us at:

• Email: hello@onebookplus.com.au
• Address: Melbourne, VIC, Australia