Privacy policy

Draft. {{Company name}} ("Inita"). Each tag needs confirmation under the Privacy Act 1988 and the Australian Privacy Principles. This describes what the product does today; check it against the code before publishing.

What we collect

• Account: name, email, password (stored hashed by our login provider), language and timezone.
• Phone number, when you verify it (we send a code by SMS). Vendors must verify one to go live.
• Profile suburb, if you give one, to suggest nearby vendors.
• Vendor details: business name, ABN, the legal name, GST status and registration date from the Australian Business Register, service areas, listings, prices and photos.
• Requests, bookings, messages and reviews, including event date, guests, suburb and notes.
• Support messages you send us by the contact form or by email: your name, email address, the message, and a booking reference if you give one. We keep them so we can answer you and handle any follow-up.
• Planner details: practice name, team members, clients (name, email, phone) and events you enter.
• Technical data: security and error logs, and the cookies needed to keep you signed in.
• How people use the site (only when we switch it on): a random identifier in a first-party cookie (inita_fid, 90 days) and, if you arrive from a campaign link, the utm_source and utm_campaign it carried (cookie inita_utm, 30 days). We count, without your name, email or IP address, how many visitors search and open a listing, and how many requests are sent, accepted and completed, so we can see which campaigns bring vendors and bookers. Each event is stored with the date (not the time), the campaign tags and a random identifier: the visitor's identifier for searches and listing views, and a separate random one for each request, so a request is not tied to the browsing before it. We do not store your IP address, device details, search words or which listing you looked at. While a request is open we keep a private link between the booking and its random identifier and campaign tags so the accepted and completed steps can be counted; it is deleted when the booking ends or your account is erased, and in any case after 24 months. The events are kept for 13 months. Our hosting and database providers keep ordinary server logs (which can include IP address and time) for a short period, as for any website. We do not share these counts or use them for advertising.
• (when payments start) Card details go to our payment provider; we keep references and amounts, not card numbers.

Why we use it

To run the marketplace: show listings, pass on requests and messages, send notifications and emails, verify vendors, prevent abuse (rate limits), keep records for tax, and improve the service. We don't sell personal information.

Who sees it

• The other side of a booking sees what they need: a vendor sees the booker's name and request. Email and phone are not shown to each other in messages.
• Our staff, to approve listings and help with disputes.
• Service providers acting for us: Supabase (database and login, Sydney), Vercel (hosting), Resend (email), Twilio (SMS verification), the Australian Business Register (ABN lookups) and, (when payments start), Stripe.
• An AI provider (Anthropic) processes the support messages you send us, and the minimal facts of a booking you give us the reference of (its status, date, category and price band; never other people's names or contact details), to draft a reply. A member of our team reads, edits and approves every reply before it is sent; nothing is sent automatically, and the AI is told to promise nothing. Anthropic is based overseas (the United States), so your message is disclosed to a recipient outside Australia for this purpose.
• Anyone the law requires us to tell.

Keeping and deleting

You can schedule your account for deletion in Settings. Your listings come down and you have time to undo it. After that, personal data is removed or anonymised, except what we must keep for tax, disputes and safety. An accepted booking blocks deletion until it finishes.

Your choices

Correct your details in Settings, turn off email for most notification types, or ask {{support email}} for a copy of your data. You can complain to us, then to the OAIC.

Security

Access is limited by database rules, SMS and API calls are rate limited, and connections are encrypted. No system is perfect; we'll tell you about a notifiable breach as the law requires.

Children

Inita isn't for people under 18.

Changes

We'll tell you about material changes.

Suburb and postcode data © Australian Bureau of Statistics, used under CC BY 4.0. We use it for the list of suburbs and postcodes behind “Did you mean…?”.