Privacy Policy

Who we are

BookedFlow ("we", "us", "our") is operated by Priya Mathai (ABN 60 569 344 758), based in Australia. We provide done-for-you marketing services for local tradies.

This policy explains how we handle your personal information, consistent with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

What we collect

Contact details you give us — your name, phone number, email and trade/business — when you use our callback form, call us, email us, or speak with us.

Basic technical data (such as IP address and browser type) collected automatically by our website host as part of normal server logs.

If you use the free listing lookup on our reviews page, we record that a search happened and whether a listing was found. When nothing is found, we also keep the name you typed — only to diagnose and improve the search (for example, business types Google hides). We never use looked-up names to contact anyone, and found searches are not kept.

If you become a client, the business information we need to deliver your services (e.g. access to your Google Business Profile, website and phone setup).

If you choose to connect your accounting software (currently Xero), read-only access to your invoices and your customer contact details — only what we need to send review requests on your behalf, and nothing else from your books.

How we use it

To respond to your enquiry, arrange a call, provide and improve our services, and keep business records. We only use your information for the purpose you gave it to us, or a directly related purpose you would reasonably expect.

We do not sell or rent your personal information to anyone.

Phone calls & text messages

If you give us your phone number, we may call or text you about your enquiry and our services. You can opt out at any time — just reply STOP to a text or tell us — and we will stop.

When we work for a business you contacted

If you call, text or leave a voicemail with a business that uses BookedFlow — say, your local plumber — we handle that conversation on the business's behalf. That's the service: we catch the call they missed, text you back in their name, and pass your messages straight to them.

For that to work we hold, on the business's behalf: your phone number, the text messages you exchange with the business (word for word), any voicemail you leave along with a machine-made transcript of it (transcripts are automatic and may contain mistakes — the recording is what you actually said), the details you type into the business's website forms or chat, and the times calls and messages happened.

The business owner sees this information — it lands in their texts, and they can view the same conversations by signing in to their BookedFlow account. Our small delivery team (see below) can see it only as needed to run the service. We never use your conversations to market to you, and we never sell them.

To stop a business texting you through us, reply STOP to any message — it works immediately, and we tell the business so nobody redials you. For anything else about your information in a business's conversations, you can ask the business directly or contact us using the details below — either way works.

When a business asks us to text you for a review

If a business that uses BookedFlow has finished a job for you, they can ask us to send you one text inviting you to leave them a Google review. They give us your mobile number — by typing it in, by texting it to us, or by connecting their accounting software so their own invoice tells us the job is done.

The text comes in that business's name, carries a link to their Google listing, and always includes an opt-out. Reply STOP and we never ask you again for that business. We don't ask the same person twice within 30 days, and we ask every customer the same way — we never choose who to ask based on how happy we think you are.

For this we hold your mobile number, the name the business has for you in their records, whether the link was opened, and any private note you choose to send the business instead of a public review. We never see your review itself — you write that on Google, not with us.

Cookies & analytics

Most of this website does not use tracking or advertising cookies. Our host (Netlify) logs standard request data to keep the site running and secure.

One exception: our homepage, our ad pages (/try, /reviews and /flag) and the sign-in page of our app (app.bookedflow.com.au) use the Meta (Facebook) pixel so we can measure whether our ads work. It tells Meta that the page was visited and whether a website preview or demo was requested, or a free trial was started — it never sees your business name or the content of any text. When a trial starts, we also send Meta a scrambled (hashed) form of the mobile number you signed up with, so it can tell that an ad led to a signup; the hash cannot be turned back into your number, and Meta is not given the number itself. You can opt out of ad cookies and ad matching in your Meta settings; everything works identically either way.

If you sign in to a BookedFlow client account, we set one strictly-necessary cookie on our app domain to keep you signed in — it does no tracking. If you arrived from one of our ads, we keep the ad’s reference codes with your account so we know which ad brought you.

Who we share it with

We use trusted service providers to run our business — for example website hosting (Netlify) and, for clients, the booking/CRM and messaging platform we deliver your service on. They handle data on our behalf under their own privacy and security terms.

The main ones: Twilio (carries our calls and texts), Google Cloud (secure database hosting), and Anthropic (the AI that tidies voicemail transcripts — it processes the transcript text only, and doesn't train on it). For clients we also connect to your Google Business Profile with your permission and, if you use it, to your Xero account — read-only. From Xero we read your invoices (whether one has been sent or paid) and your customer's name and mobile number, so we know when a job is finished and who to text. We never write anything to your books, and you can disconnect at any time from your BookedFlow account.

Our team includes trained personnel located overseas (currently in India) who answer enquiries and messages on our behalf. They work under confidentiality obligations, access only the information needed to handle the conversation, and never sell or reuse it.

Some providers may also store data on servers located overseas. We otherwise disclose information only if required by law.

Security & retention

We take reasonable steps to protect your information from misuse, loss and unauthorised access. Access to systems is limited to people who need it, and sign-in to a client account uses one-time codes that expire within ten minutes and are stored only in scrambled (hashed) form.

If you connect accounting software, we store a scrambled access key and the record of asks we sent — never your ledger, your prices or your invoices themselves. Disconnecting removes our access immediately, and we delete the key.

How long we keep things: conversation records (messages, call logs, voicemail transcripts) are kept while the relevant client's account is active, and for up to 12 months after it closes — so a tradie who returns doesn't lose their history — then deleted or de-identified. Call recordings, which only ever cover our own team's side of calls we make, are deleted automatically after 90 days. Business records we're legally required to keep (like invoices) are kept for the period the law sets.

Your rights

You can ask us to access, correct or delete the personal information we hold about you — just email or call us using the details below. We'll confirm we've got your request within a few days and action it within 30. If your information sits inside a business's conversation history, we may loop that business in (it's their customer relationship), but we'll help you either way, and deletion covers the messages, transcripts and details we hold about you — except records the law requires anyone to keep.

If you have a concern we cannot resolve, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes to this policy

We may update this policy from time to time. The current version is always shown here with its last-updated date.