Privacy policy

Who this covers

There are two groups of people whose information passes through Bookend:

• Our clients: the businesses that use Bookend, and the people who log in for them.
• Our clients' customers: people who contact one of those businesses or book a time with them.

When we handle a customer's information, we do it on behalf of the business they contacted, only to provide Bookend to that business. That business is responsible for how it uses its customers' information, and its own privacy policy also applies.

What we collect

From our clients

• Your name, email, mobile and business details from the setup form and your My details page, such as your trade, service area, hours and how you like to reply.
• Your login email and password. We only keep a scrambled (hashed) version of your password, never the password itself.
• Settings you choose, like your booking hours, the calendar link you share with us, and which phones get alerts (we record the type of device, such as "iPhone").
• If you connect Xero: access to read your invoices, and a copy of each invoice's number, customer name, amounts, status and dates.
• From your own calendar: only the times you're busy, never what the events are.
• Messages you send us and notes from setup calls.

From our clients' customers

• What they send the business: their name, phone number, email or social media handle, suburb, and their messages about the job.
• What they enter when booking: name, phone, email, address and any notes, plus the time they book.
• Texts forwarded from the business's mobile. These are checked to see whether they're about a job. Texts that aren't job enquiries are thrown away, not stored.

Technical information

• A cookie that keeps you logged in to the portal, and one that protects forms. We don't use advertising or tracking cookies.
• Our hosting provider keeps short-lived server logs, which include IP addresses, to keep the service secure and working.
• Booking a setup call on our website is handled by Calendly, under its own privacy policy.

How we use it

• To run Bookend for the business: sort and summarise enquiries, draft replies, show enquiries and bookings in the portal, let customers book and re-book, send booking confirmations and call-out messages, send alerts to the business's phone, and show invoice totals.
• To set up and support your account, and to send you emails about it, like password resets.
• To keep Bookend secure, fix problems and improve how it works.
• To bill our clients and meet our legal obligations.

We don't sell personal information, and we don't use it for advertising.

AI and automated replies

Bookend uses an AI service (Claude, made by Anthropic) to read enquiries and forwarded texts, pick out the details of the job, flag urgent ones, and draft replies. Under its commercial terms, Anthropic doesn't use this content to train its models.

Some messages are sent automatically on the business's behalf, as the business sets up: a quick "thanks, we got your message" reply, booking confirmations, and re-booking links if the business is called out to an emergency. Bookend never quotes prices or promises times. Drafted replies are checked and sent by the business.

Who we share it with

We share personal information only with the services we use to run Bookend, and only what each one needs:

• Render: hosts the Bookend website and database.
• Anthropic: the AI that reads enquiries and drafts replies.
• Make: the automation service that collects enquiries from the business's email and social media inboxes and sends some messages.
• Google or Microsoft: if the business's enquiry inbox is Gmail or Outlook, replies are drafted there.
• Meta: if the business connects Instagram or Facebook, messages come through Meta.
• ClickSend: sends text messages, such as urgent job alerts.
• Resend: sends our account emails, such as password resets.
• Xero: only if the business connects it, to show their invoices.
• Apple, Google, Mozilla and Microsoft: deliver phone and browser alerts, which include a short summary of the job.

We may also share information if the law requires it, or to protect someone's safety.

Information stored or sent overseas

Some of these services store or process information outside Australia, including in the United States and the European Union. We choose established providers with strong security and take reasonable steps to make sure they protect the information in line with the Australian Privacy Principles.

Keeping it safe

• Everything is sent over encrypted connections (HTTPS).
• Passwords are hashed, and connections to other services like Xero are stored encrypted.
• Each business can only see its own enquiries, bookings and invoices.
• Changing or resetting a password logs out every other device.

No system is perfectly secure. If a data breach is likely to cause someone serious harm, we'll tell the people affected and the Office of the Australian Information Commissioner, as the law requires.

How long we keep it

We keep a business's information, including its customers' enquiries and bookings, for as long as its account is open, so it can look back at past jobs. When an account is deleted, its information is removed from Bookend straight away and from our backups within 30 days. We may keep billing records for longer where the law requires it.

Access, changes and deleting your information

If you use Bookend for your business, you can see and change your details on the My details page at any time. To delete your account and everything in it, go to Account → Delete your account in the portal. This also disconnects Xero and stops phone alerts and text forwarding. You can also email us to ask for a copy of your information or for us to delete it.

If you contacted or booked with a business that uses Bookend, ask that business first, since it controls your information. You can also email us. We'll work with the business to help, usually within 30 days.

Deleting a Bookend account doesn't delete messages in the business's own email, phone, Instagram or Facebook. Those are managed in those apps.

Complaints

If you're worried about how we've handled your information, contact us using the details below. We'll look into it and reply within 30 days. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We'll update this page if how we handle information changes, and change the date at the top. If a change is significant, we'll email our clients first.