This policy explains how [LEGAL ENTITY NAME] ([ABN / ACN OR COMPANY NUMBER]) (“Sky BizBook”, “we”, “us”) collects, uses, shares and protects personal information. It covers the Sky BizBook apps for web, Android and iOS and the website at skybizbook.com.
We serve businesses in Australia, Canada and the United States. We aim to meet the privacy laws of each, including the Australian Privacy Principles, Canada’s PIPEDA, provincial laws such as Quebec’s Law 25, and US state privacy laws. Please read this policy with our Terms of Service.
1. The short version
- We collect what we need to run Sky BizBook. That means your account details, the business records you keep in the app and some basic technical information.
- We don’t sell personal information, and we don’t use it for advertising.
- Our main database is in Sydney, Australia. Some services we use handle data in other countries, mainly the United States.
- Stripe handles card payments, and Apple or Google handle app store purchases. We never see full card numbers.
- You can access, correct, export or delete your information. Email [PRIVACY CONTACT EMAIL].
2. Whose information this policy covers
- Sky BizBook users: business owners and team members with an account. We decide how this information is used and we’re responsible for it.
- Our users’ customers: people whose details a business keeps in Sky BizBook, or who use its booking pages, forms, invoice pay links or shared job links. We handle this information on behalf of that business, which is responsible for it. If you’re a customer of a business that uses Sky BizBook, please contact the business first. We’ll help it respond to you.
- Website visitors to skybizbook.com.
3. Information we collect
Information you give us
- Account details: your name, email address, password, phone number and profile photo. Our sign-in provider stores your password in a protected (hashed) form, so we can’t see it.
- Business details: your business name, address and logo, and tax or business numbers (such as an ABN, GST/HST number or EIN). Also your country, currency, and any bank or payment details you choose to show on invoices.
- Business records: your customers’ and suppliers’ contact details (names, emails, phone numbers, addresses and notes). Also quotes, jobs, invoices, bills and receipts, expenses, products and stock, point of sale sales, bookings, contracts and signatures, and the photos and files you attach.
- Team details: the names and email addresses of team members you invite, the jobs assigned to them and the hours they record.
- Messages to us: when you email us or use the contact form on our website.
Information from your customers
Someone might book through a Sky BizBook booking page, fill in a business’s form, sign a contract or pay an invoice. When they do, we collect what they enter, usually their name, email, phone number, booking details, form answers and signature. We then pass it to that business.
Information collected automatically
- Device and log information: IP address, device type, operating system, app version and request times. We keep these in server logs for security and troubleshooting.
- Push notification tokens: if you allow notifications on Android or iOS, we store a device token. We use it to send reminders, such as upcoming jobs.
- Usage records: records of the emails sent and AI requests made from your account. We use them to apply plan limits, prevent abuse and fix problems.
- Website analytics: our website uses Google Analytics to understand how visitors use it (see section 10). It doesn’t run on private pages, such as invoice payment links and booking management pages.
Information from other services
- Stripe: when you connect a Stripe account, we receive your Stripe account ID and status. We also receive details of the payments made to you, such as amount, status and date, but never your customers’ full card details.
- App stores and RevenueCat: when you subscribe, we receive your plan, subscription status and renewal dates, but not your payment card details.
Device permissions
The app asks before using your camera (to scan bills and take job photos), your photos and files (to attach images and documents) and notifications. You can turn these off at any time in your device settings. The app doesn’t use your location, contacts or microphone.
4. How we use information
We use personal information to:
- provide the Service: store your records, create and send quotes, invoices, contracts and booking confirmations, and take bookings and payments;
- send emails and notifications. These include invoices and reminders to your customers when you ask us to, booking updates, “payment received” alerts, job reminders, and security and account messages;
- run the AI features you choose to use (see section 5);
- manage subscriptions and plan limits;
- give support and answer enquiries;
- keep the Service secure, prevent fraud and abuse, and fix problems;
- improve the Service, using combined or de-identified information where we can;
- meet legal obligations, such as keeping tax records, and enforce our Terms of Service.
We only send you product news if you agree to it, and you can unsubscribe at any time. We never use your business records or your customers’ information to market to your customers.
5. AI features
- Sky BizBook’s AI features are the Sky assistant, drafting invoice and quote emails, drafting contracts and scanning bills and receipts. They use Google’s Gemini API.
- When you use one, we send Google what it needs to answer. That’s your request plus the relevant information from your account, such as a short summary of your business figures, the records the assistant looks up or the bill you scan. This can include personal information about your customers.
- We use Google’s paid Gemini API service. Under its terms, Google doesn’t use this content to train or improve its models, and keeps it only for a limited time to detect abuse. [CONFIRM: ONLY TRUE ONCE THE PAID GEMINI API TIER IS ON]
- AI features are optional. We keep a record of AI requests to apply plan limits and prevent abuse.
7. Where your information is stored
- Supabase hosts our main database and file storage in Sydney, Australia.
- Some of the providers in section 6 handle information in other countries, mainly the United States. We choose providers with strong security and contractual privacy commitments. We take reasonable steps so they handle it in line with this policy and the Australian Privacy Principles.
- If you’re in Canada or the United States, your information is stored and processed in Australia and other countries. There, courts, law enforcement and national security authorities may be able to access it under local law.
8. How long we keep information
- We keep your account information and business records while your account is open, so you can keep using them.
- If you ask us to close your account, we delete your account and business records within [NUMBER OF DAYS]. We may keep some information longer when we have to, for example to meet tax or other legal requirements, resolve disputes or prevent fraud. Backup copies are deleted as our backups are replaced on a rolling schedule.
- We keep logs for a limited time and then delete them.
- Businesses decide how long to keep their customers’ information. When a business deletes a record, we delete it from our live systems.
9. How we protect information
- Information is encrypted in transit (HTTPS) and at rest by our hosting providers.
- Database access rules let each business reach only its own records.
- Signed contracts are private and can only be opened through short-lived, signed links.
- Our sign-in provider protects passwords, and we never store them in plain text.
- Stripe and the app stores handle payment card details. We never store them.
- Only people who need access to our systems for their work have it.
No system is perfectly secure. If a data breach is likely to cause serious harm, we’ll tell you and the relevant regulators as the law requires. This includes Australia’s Notifiable Data Breaches scheme and Canada’s breach reporting rules.
11. Your choices and rights
Wherever you live, you can ask us to:
- give you access to the personal information we hold about you, with a copy in a portable format;
- correct information that’s wrong or out of date;
- delete your account and personal information;
- stop sending you marketing emails (you can also use the unsubscribe link).
You can update most account details yourself in the app. To make a request, email [PRIVACY CONTACT EMAIL]. We’ll check your identity before acting and reply within 30 days, or sooner if the law requires. We won’t charge you or treat you differently for using your rights.
Australia
We handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you have a complaint, please contact us first. If you’re not happy with our response, you can complain to the Office of the Australian Information Commissioner.
Canada
Under PIPEDA and provincial privacy laws, you can access and correct your personal information and withdraw your consent. Withdrawing consent may stop us from providing some or all of the Service. Quebec residents have further rights under Quebec’s privacy law (Law 25), including data portability. Our person in charge of protecting personal information is [PRIVACY OFFICER NAME OR TITLE]. You can also complain to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.
United States
Depending on your state, you may have the right to know what personal information we collect and how we use and share it. You may also have the right to access, correct and delete it, and to opt out of its sale, of targeted advertising and of profiling. We don’t sell personal information or use it for targeted advertising. You can make a request yourself or through an authorized agent. If we turn down your request, you can appeal by replying to our decision. If you’re still not satisfied, you can contact your state attorney general.
12. Children
Sky BizBook is for businesses and isn’t meant for anyone under 18. We don’t knowingly collect personal information from children under 13, or a higher age where local law sets one. If you think a child has given us personal information, contact us and we’ll delete it.
13. Changes to this policy
We’ll post any changes here with a new effective date. For significant changes, we’ll tell you by email or in the app before they take effect.
14. Contact us
For privacy questions, requests or complaints, contact:
- Privacy officer: [PRIVACY OFFICER NAME OR TITLE]
- Email: [PRIVACY CONTACT EMAIL]
- Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS]