Privacy policy
Whosup is a booking service operated by Dobin Yang (ABN 65 305 057 430), a sole trader based in Brisbane, Queensland. In this policy, "we" and "us" means Dobin Yang as the operator of Whosup. This policy explains what personal information we collect, how we use, store and share it, and how you can contact us about it. We handle personal information in line with the Australian Privacy Principles.
Who this policy covers
- People who visit whosup.com.au or contact us.
- Businesses that use Whosup (our customers), their owners and their team members.
- Clients of those businesses whose details are stored in Whosup, for example when they book an appointment or sign a consent form.
What we collect
- When you sign up: your email address, your name, your business name, address, time zone and language, and the link or page that brought you to Whosup (for example a search, an ad or another shop's booking page).
- When your business uses Whosup: details for you and your team, your services, prices, opening hours and settings, and the messages you send us through the feedback button.
- Billing: your Whosup subscription and SMS credit purchases are processed by Stripe. We receive the status of your subscription and payments, but not your full card number.
- Client information entered by a business or by its clients: name, mobile number, email address, booking history, notes and signed consent forms. Consent forms can include health information, such as allergies or skin conditions, where the business asks for it.
- Cards saved to hold a booking: when a business asks clients to save a card, the card is saved with Stripe in the business's own Stripe account. Whosup never sees or stores the card number. We keep a reference to it and the card brand and last four digits, so the business can recognise it.
- When you contact us: your name, email address, and anything else you choose to tell us.
Cookies and browser storage
We do not use advertising or tracking cookies. Our website and app store a few small items in your browser: your language choice, your sign-in session for the app, and the link or page that first brought you to Whosup, which we save with your account if you sign up so we know which channels work. To count visits to whosup.com.au and how many visitors go on to sign up, we also keep a random visitor ID in your browser and record which pages it viewed and which Whosup links it clicked, with the page that referred you, your language and whether you are on a phone. This ID is not linked to your name or email, and we do not store your IP address. You can clear these at any time in your browser settings.
How we use it
- To provide, support and improve the Whosup service.
- To send booking confirmations, reminders, changes and cancellations by email or text message on behalf of businesses.
- To send business owners service emails, such as setup tips, a reminder before the free month ends and a short request for feedback. Billing and account emails are part of the service. If you would rather not get tips, tell us and we will stop them.
- To bill customers, prevent misuse and meet our legal obligations.
- To reply to messages and feedback.
We do not sell personal information, and we do not use client information for our own marketing.
Client information held for businesses
When a business stores its clients' information in Whosup, the business decides what is collected and why. We hold and process that information on the business's behalf, only to provide the service. Clients who want to access or correct their details should contact the business first. We will help the business respond.
Who we share it with
We use a small number of service providers to run Whosup:
- Supabase stores our database and files on servers in Singapore.
- Cloudflare hosts our website and app and delivers them through its global network, so requests may be processed in other countries, including the United States.
- Stripe processes subscription payments, SMS credit purchases and cards saved to hold bookings.
- Resend sends our emails.
- ClickSend sends text messages, when a business uses SMS.
- Google provides our own email inbox and the fonts on our website and app.
Because of this, personal information may be stored or processed outside Australia, including in Singapore and the United States. We choose providers with strong security practices and only share what they need to provide their service. We may also disclose information where the law requires it.
How we protect it
Data is encrypted in transit. Each business can only see its own data, and team members can be limited to their own bookings and clients. Signed consent forms are locked once signed so they cannot be changed.
How long we keep it
We keep customer data for as long as the business uses Whosup. Business owners can download their clients, bookings and signed forms at any time from Settings. If a business stops using Whosup, we keep its data for up to 12 months in case it comes back, then delete it from the service, unless the business asks us to delete it sooner or the law requires us to keep it longer.
Access, correction and complaints
You can ask to access or correct the personal information we hold about you by emailing hello@whosup.com.au. If you have a concern about how we handled your information, email us and we will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
We may update this policy as Whosup grows. The date at the top shows when it was last changed, and we will tell customers about important changes by email.