Privacy Policy

Last updated: 12 May 2026 · Version 2.0

Quick summary

• We collect only the information we need to run Bookley for you.
• We never sell your personal information.
• We use a small number of well-known sub-processors (Render, Stripe, Sentry, Xero, Worldline) so that Bookley can host data, take payments and stay reliable.
• You can access, correct or delete your information at any time by emailing info@bookley.co.
• The website may use Google Analytics and Google Ads cookies if you opt in via our cookie banner. Without your consent these tags do not store identifying data, in line with Google Consent Mode v2.

1. Who is responsible for your information

The data controller (and APP entity) is Psychology Direct Pty Ltd trading as Bookley. You can contact us at:

• Email: info@bookley.co
• Post: 167 Drummond Street, Carlton, Victoria 3053, Australia

2. The information we collect

2.1 Information you give us

• Account & profile: name, email address, password (stored hashed), business name, ABN, professional registration details, phone number.
• Workspace content: bookings, clients, members, rates, invoices, notes and other operational data you enter into Bookley.
• Billing & payments: subscription plan, billing address, transaction history. Card numbers are sent directly to our payment processors (Stripe / Worldline) and are never stored on our servers.
• Support & correspondence: messages you send us by email or through Bookley.

2.2 Information we collect automatically

• Technical logs: IP address, browser type, device identifiers, timestamps and pages requested. Used to operate the service, prevent abuse and diagnose errors.
• Strictly necessary cookies: a session cookie (ccr_sessionid) so you can stay signed in, and a CSRF cookie (csrftoken) to protect form submissions. Both are first-party cookies set by Bookley.
• Analytics & marketing (only with your consent): if you opt in via our cookie banner, we may use Google Analytics and Google Ads to measure how the site is used and the effectiveness of our advertising. See §9 for details and how to change your choices.
• Error reports: when something breaks, we send a diagnostic event to Sentry (see §5) which includes the URL, a stack trace and a hashed user identifier so we can fix the problem.

2.3 Information we do not collect

• We do not sell personal information.
• We do not collect Sensitive Information (as defined in the Privacy Act) except where you choose to enter it into your workspace, in which case you are the data controller.
• Bookley is not designed to store clinical case notes. If you choose to enter health information about your clients into Bookley, you remain responsible as the controller of that information.

3. How we use your information

We use personal information to:

• create and operate your Bookley account and workspace;
• process payments, issue invoices and manage subscriptions;
• send service emails (sign-up confirmations, password resets, billing receipts, security and outage notices);
• provide customer support;
• monitor performance, prevent fraud and abuse, and secure the service;
• improve Bookley based on aggregate usage patterns; and
• comply with our legal obligations (tax, accounting, lawful requests by authorities).

For visitors located in the EEA / UK, our lawful bases are: contract (to provide the service you signed up for), legitimate interests (to keep Bookley secure and to improve it), legal obligation (tax, accounting, fraud prevention), and consent (for any non-essential cookies or marketing communications you opt in to).

4. Marketing communications

We will only send marketing emails if you have opted in (for example, by ticking a subscribe box). Every marketing email includes an unsubscribe link. Service and security emails are not marketing and cannot be opted out of while your account is active.

5. Sub-processors and overseas disclosures

We rely on a small set of trusted providers to run Bookley. They process personal information on our instructions and under written agreements that protect your data:

Provider	Purpose	Region
Render Services Inc.	Application + database hosting	USA
Stripe Payments Australia Pty Ltd	Subscription billing	AU / USA
Worldline	In-person card payments (where enabled)	EU / AU
Functional Software Inc. (Sentry)	Error monitoring	USA
Xero Limited	Accounting integration (optional, only if you connect it)	NZ / AU
Google LLC (Analytics & Ads)	Website analytics and advertising measurement (only with consent — see §9)	USA
Email delivery (transactional)	Sending service emails such as receipts and password resets	USA / EU

Where data is transferred outside Australia (in particular to the USA), we take reasonable steps under APP 8.1 to ensure recipients handle the information consistently with the APPs, including through the providers' contractual commitments and (for EU data) Standard Contractual Clauses.

6. How long we keep information

• Account & workspace data: kept while your account is active. After cancellation we keep data for up to 30 days to allow account reactivation, then delete or de-identify it (subject to the retention periods below).
• Billing records: retained for at least 7 years to comply with Australian tax law.
• Server logs: retained for up to 90 days for security and troubleshooting.
• Backups: overwritten on a 35-day rolling window.

You can request earlier deletion of any information that is not required for legal or accounting purposes.

7. How we keep information secure

• All traffic to Bookley is encrypted in transit using TLS.
• Passwords are stored using industry-standard one-way hashing (PBKDF2).
• Production data is hosted in managed databases with daily backups and access restricted to authorised staff.
• We use error monitoring and rate-limiting to detect and mitigate abuse.
• Card data is handled exclusively by PCI-DSS certified processors (Stripe, Worldline) and never touches Bookley's servers.

No system can be guaranteed to be 100% secure. If we become aware of a personal information breach that is likely to result in serious harm we will notify the Office of the Australian Information Commissioner and affected individuals as required by the Notifiable Data Breaches scheme, and the relevant supervisory authority for individuals in the EEA/UK.

8. Your rights

You may at any time:

• request access to the personal information we hold about you;
• ask us to correct information that is inaccurate or out of date;
• request deletion of your personal information (subject to legal retention obligations);
• object to or restrict certain processing;
• request a copy of your data in a portable format;
• withdraw any consent you have given us; and
• lodge a complaint with a supervisory authority.

To exercise any of these rights please email info@bookley.co. We will verify your identity and respond within 30 days. There is no fee.

9. Cookies and similar technologies

Bookley uses cookies and similar storage in three categories:

• Essential (always on) — the session and CSRF cookies described in §2.2. The site cannot function without these.
• Analytics (off by default) — if you opt in, we may use Google Analytics 4 to understand how the marketing site is used so we can improve it. Google Analytics may set cookies such as _ga and _ga_*. IP addresses are anonymised by Google before storage.
• Marketing (off by default) — if you opt in, we may use Google Ads (including conversion tracking and remarketing) to measure the effectiveness of our advertising. Google Ads may set cookies such as _gcl_* and read the NID cookie set by google.com.

We use Google Consent Mode v2 so that, until you grant consent, Google tags do not write identifying cookies or read advertising/analytics storage.

You can change your choices at any time by clicking the “Cookies” link in the footer. You can also block or delete cookies in your browser settings; doing so may prevent you from signing in or using parts of Bookley.

10. Children

Bookley is a business tool intended for use by people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. International users

Bookley is operated from Australia. By using Bookley you understand that your information will be processed in Australia and in the regions of our sub-processors listed in §5.

12. Customers' clients (controller / processor relationship)

When you use Bookley to manage bookings, clients or members, you are the data controller of that information and Bookley acts as a processor on your behalf. You are responsible for having a lawful basis to collect that information and for providing your own clients with appropriate notices.

We make a Data Processing Addendum available on request at info@bookley.co.

13. Complaints

If you have a privacy complaint, please email us first at info@bookley.co. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied you may contact:

• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• EEA / UK: the supervisory authority in your country of residence.
• California: the California Privacy Protection Agency.

14. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email and/or by an in-product notice at least 14 days before they take effect. The “Last updated” date at the top of this page shows the most recent revision.