Privacy Policy

Date updated : 14 July 2026

Purpose, Scope, and Users

1. BOOKIPI PTY LTD, Australian Private Company, ABN 91 617 668 185, hereinafter referred to as the ”Company”, makes efforts to comply with applicable laws and regulations related to Personal Data protection in countries where the Company operates. This Policy sets forth the basic principles by which the Company processes your personal data, and indicates the responsibilities while processing personal data.
2. The Company is a data processor that provides services to companies who collect personal data. The Company provides a standard data process agreement to any data controller. In some cases, the Company may be a data controller and in this case the Company acknowledges its direct responsibility before data subjects. Regardless of its status, the Company will treat any personal data as required by any applicable regulation, including but not limited to, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) available at http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG&toc=OJ:L:2016:119:TOC.
3. The Company does not knowingly attempt to solicit or receive information from children under 16 years of age.
4. The Company understands that you are aware of and care about your own personal privacy interests, and the Company takes that seriously. This Privacy Policy describes the policies and practices regarding the collection and use of your personal data, and sets forth your privacy rights. The Company recognizes that information privacy is an ongoing responsibility, and so the Company will from time to time update this Privacy Policy as the Company undertakes new personal data practices or adopt new privacy policies.
5. The Company adheres to the Australian Privacy Principles which can be found here https://www.oaic.gov.au/privacy/australian-privacy-principles. and complaints in regard to any privacy issues please contact the Company on hello@payroller.com.au.

Terms for the Legal Bases of the Processing

1. Consent – your clear agreement to the processing of your personal data for a specific purpose.
2. Contract – the reason why the processing is necessary based on a contract you have with the Company, or because the Company has asked you to take specific steps before entering into that contract.
3. Legitimate Interests – the reason why the processing of your data is necessary which is based on the legitimate interests or the legitimate interests of a third party, provided those interests are not outweighed by your rights and interests. These legitimate interests are:
   1. gaining insights from your behaviour on the website;
   2. delivering, developing and improving the website;
   3. enabling the Company to enhance, customise or modify the website and services;
   4. determining whether marketing campaigns are effective;
   5. enhancing data security.

Consent Rule

1. If you have given consent to the processing of your data you can freely withdraw such consent at any time by emailing the Company to hello@payroller.com.au 
2. If you do withdraw your consent, and if the Company does not have another legal basis for the processing of your data, then the Company will stop the processing of the personal data.
3. If the Company has another legal basis for the processing of your data, then the Company may continue to do so subject to your legal interests and rights.

Company’s Responsibilities

1. If you are a registered user or a visitor to the website who is a data subject, the Company acts as the ‘data controller’ of personal data. This means the Company determines how and why your data are processed.

Your Responsibilities

1. Read this Privacy Policy carefully;
2. Make sure you understand all your rights;
3. If you provide the Company with personal data about other individuals, the Company will only employ that data for the special reason for which it was provided to the Company. By sending the data, you confirm that you have the right to dispose to process the data on your behalf in accordance with this Privacy Policy;
4. Treat your personal data confidential and secure.

Collected Data

1. The Company collects data when you interact with its website, especially when:
   1. you browse any page of the website;
   2. the Company calls you;
   3. you choose or order a service or plan;
   4. you make a payment;
   5. you use the website;
   6. you receive emails from the Company;
   7. you chat with the Company for customer support;
   8. you opt-in to marketing emails;
   9. in cases which do not depend on you but the Company has a legal basis to collect such data (see articles 6 and 9 of the GDPR)
2. The Company collects the following types of data:
   1. contact details such as you’re your first name, last name, email address;
   2. financial information such as your bank account number, sort code, credit/debit card details;
   3. pre-orders and orders information;
   4. data that identifies you such as your IP address, login information, browser type and version, time zone setting, browser plug-in types, geolocation information about where you might be, operating system and version;
   5. data on how you use the website such as your URL clickstreams (the path you take through the website), goods/services viewed, page response times, download errors, how long you stay on webpages, what you do on those pages, how often, and other actions.
3. The recipients of the collected data are the Director of the Company, its employees, and other third party service providers mentioned below.

Purposes and Legal Basis for the Processing

1. If you are a registered user or a visitor to the website who is a data subject, the Company acts as the ‘data controller’ of personal data. This means the Company determines how and why your data are processed.

Company’s Responsibilities

1. The Company processes the data for:
   1. Providing services:
      1. Details: the Company needs to  provide services accessible via the website.
      2. Legal basis: Consent; Contract; Legitimate Interests.
   2. Delivering services:
      1. Details: to deliver the services the Company needs to collect some data to identify where services have to be delivered.
      2. Legal basis: Contract; Legitimate Interests.
   3. Processing payments:
      1. Details: to deliver the services the Company needs to collect credit card information to process and receive payments of the user for the services.
      2. Legal basis: Contract; Legitimate Interests.
   4. Keeping the website running:
      1. Details: managing your requests, login and authentication, remembering your settings, processing payments, hosting and back-end infrastructure.
      2. Legal basis: Contract; legitimate Interests.
   5. Improving the website
      1. Details: testing features, interacting with feedback platforms, managing landing pages, heat mapping the website, traffic optimization and data analysis and research, including profiling and the use of machine learning and other techniques over your data and in some cases using third parties to do this.
      2. Legal basis: Contract; legitimate Interests.
   6. Customer support
      1. Details: notifying you of any changes to the service, solving issues, any bug fixing.
      2. Legal basis: Contract; Legitimate Interests.
   7. Marketing purposes (with your consent)
      1. Details: sending you emails and messages about new functions, goods and services, and content.
      2. Legal basis: Consent.

Data Subject’s Rights

1. You may choose not to provide the Company with personal data. If you choose to do so, you can continue to visit the website and browse its pages, but the Company will not be able to process transactions without personal data.
2. You may turn off cookies in your browser via settings. You can block cookies on your browser by refusing cookies. You may delete cookies. If you turn off cookies, you can continue to use the website and browse its pages, but the website and certain services will not work properly.
3. You may ask us to refrain from using your data for marketing. You can opt out from marketing by emailing us at hello@payroller.com.au 
4. You can exercise the following rights by sending us an email at hello@payroller.com.au 
   1. You have the right to access information about you, especially:
      1. the categories of data;
      2. the purposes of data processing;
      3. third parties to whom the data disclosed;
      4. how long the data will be retained and the criteria used to determine that period;
      5. other rights regarding the use of your data.
   2. You have the right to make the Company correct any inaccurate personal data about you.
   3. You can object to the Company using your personal data for profiling you or making automated decisions about you. The Company may use your data to determine whether we should let you know information that might be relevant to you (for example, tailoring emails to you based on your behaviour).
   4. You have the right to the data portability of your data to another service or website. The Company will give you a copy of your data in readable format so that you can provide it to another service. If you ask us and it is technically possible, we will directly transfer the data to the other service for you.
   5. You have the right to be ”forgotten”. You may ask erasing any personal data about you, if it is no longer necessary for the Company to store the data for purposes of your use of the website.
   6. You have the right to lodge a complaint regarding the use of your data by the Company. You can address any complaint to your national regulator (see the list at http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm).
5. In the context of the right to access information the Company shall provide you with the information within one month of your request unless there is a justified requirement to provide such information faster.

Security

1. We have security and organizational measures and procedures to secure the data collected and stored.
2. Connections to the website are encrypted using 256-bit SSL with integrity assured by the SHA2 RSA algorithm.
3. We use servers that comply with strict international data security standards, including ISO 27001.
4. You acknowledge that no data transmission is guaranteed to be 100% secure and there may be risks.
5. You are responsible for your login information and password. You shall keep them confidential.
6. In case your privacy has been breached, please contact the Company immediately on hello@payroller.com.au.

Location of the Processing of Personal Data and Third Party Service Providers

1. The personal data collected by the Company is processed at the Company’s offices in Sydney, Australia.
2. The Company’s servers are located in Australia. (Privacy Policy : https://aws.amazon.com/privacy)
3. The Company uses MongoDB Atlas to provide the services. (Privacy Policy : https://www.mongodb.com/legal/privacy/privacy-policy)
4. The Company uses Facebook analytics (Privacy Policy : https://www.facebook.com/about/privacy/update) and Google analytics (Privacy Policy : https://policies.google.com/privacy) to monitor user’s behavior on the website.
5. The Company uses Intercom which enables customer support via a live chat. (Privacy Policy: https://www.intercom.com/legal/privacy)
6. The Company uses SendGrid to enable email delivery service. (Privacy Policy : https://sendgrid.com/policies/privacy)
7. The Company uses Stripe to process online payments. (Privacy Policy: https://stripe.com/us/privacy)
8. The Company uses Apple (Privacy Policy: https://www.apple.com/legal/privacy/) and Google (Privacy Policy: https://policies.google.com/privacy) to process in-app purchase payments.
9. The Company uses Amplitude to analyse product and subscription behaviour on the platform. (Privacy Policy: https://amplitude.com/privacy)
10. The Company uses GrowthBook for feature flags, experiment exposures and user attributes. (Privacy Policy: https://www.growthbook.io/legal/privacy-notice)
11. The Company uses Survicate to collect surveys and feedback, including name, email, and survey responses. (Privacy Policy: )
12. The Company uses Firebase for the development of high-quality apps. (Privacy Policy: https://firebase.google.com/support/privacy)
13. The Company uses Sentry to monitor errors, crashes, stack traces, and debugging issues. (Privacy Policy: https://sentry.io/privacy/)
14. The Company uses OpenAI to provide AI-powered features.  (Privacy Policy: https://openai.com/policies)
15. The Company uses Mistral AI to perform OCR to contract PDF and image copies into raw strings for contract review. (Privacy Policy: https://legal.mistral.ai/terms/privacy-policy)
16. The Company uses Google drive for uploading contracts in GDrive. (Privacy Policy: https://policies.google.com/privacy)

Retention Period

1. The Company stores personal data as long as the Company needs it and the retention practice depends on the type of data the Company collects, regulatory burden, and how the Company uses the personal data. The retention period of the Company is based on criteria that include legally mandated retention periods, pending or potential litigation, intellectual property or ownership rights, contract requirements, operational directives or needs, and historical archiving.

Cookies Policy

1. The Company collects certain types of information when you access or use the website, including cookies and similar tracking technologies, such as pixels.
2. Cookies are small data files that are placed on your computer or mobile device when you visit this website. Cookies are used by the website in order to make the website work, or to work more efficiently, as well as to provide reporting information.
3. You may always turn off some of the cookies through your browser. If you turn off the cookies, this may influence the functionality of the website.
4. The list of cookies the Company uses is listed in your browser and in the list of the third party service providers mentioned above.

Transfer of Your Personal Data

1. The Company has its office and servers in Australia. Personal data the Company collects from you will be processed in Australia. Australia has not sought nor received a finding of ”adequacy” from the European Union under Article 45 of the GDPR. The Company relies on derogations for specific situations as set forth in Article 49 of the GDPR. In particular, the Company collects and transfers to Australia personal data only: with your consent; to perform a contract with you; or to fulfill a compelling legitimate interest of the Company in a manner that does not outweigh your rights and freedoms.
2. The Company endeavors to apply suitable safeguards to protect the privacy and security of your personal data and to use it only consistent with your relationship with the Company and the practices described in this Privacy Policy. The Company also minimizes the risk to your rights and freedoms by not collecting or storing sensitive information about you.

Use of Artificial Intelligence (AI)

1. Overview
   We may use artificial intelligence and machine learning technologies, including AI Technologies provided by third parties (AI Technologies) in our business operations and the provision of our Services. We will only use AI Technologies when legally permitted and necessary for our business operations.
   
   
2. How we use AI Technologies
   We may use AI Technologies for the following purposes: 

• to deliver our services to you;
• to conduct analysis and processing of documents, contracts and business information you provide; 
• to generate and modify content and coding, including website content, business documents and other outputs;
• to improve and optimise our services and operations;
• to automate certain processes and communications, such as routine tasks;
• to personalise your experience with our services; 
• for quality assurance purposes; and 
• to assist with customer support and queries.

As part of our service offering, we may make certain features and functionalities available to you that rely on different AI Technologies and tools we may introduce and from time to time. For some (but not all) of these features, you will have the option to opt-in to their use before they process your personal information. Where opt-in is required, we will clearly indicate this to you.

1. Data Protection and Security
   Where we use service providers who provide AI Technologies to us, we will take reasonable steps to ensure that such service providers handle your personal information according to privacy law, including by ensuring that we have contracts in place requiring the service provider to protect personal information.
   
   
2. Data Protection and Security
   Where we use service providers who provide AI Technologies to us, we will take reasonable steps to ensure that such service providers handle your personal information according to privacy law, including by ensuring that we have contracts in place requiring the service provider to protect personal information.
   
   We will not input your personal information into any platform provided by an AI Technology service provider which then trains its model based on that information
   
   
3. Your Rights and our Commitments
   We will treat information generated or inferred by the AI Technologies about individuals as personal information and you maintain all rights over your personal information as outlined in this Privacy Policy, regardless of whether AI Technologies are used in processing. When using AI Technologies with your personal information:

• Transparency and control: we will inform you when AI Technologies are being used to make decisions that may significantly affect you. We will implement processes to verify the accuracy of AI-generated outputs and we will take reasonable steps to maintain human oversight and review of significant AI-generated decisions. Our staff are trained to understand the limitations of AI systems and verify outputs before they are relied upon; and 
• Security: we implement appropriate technical and organisational measures to ensure that our use of AI Technologies maintains the security and integrity of your personal information. This includes regular testing and monitoring of AI outputs for accuracy and reliability; and
• Risk mitigation: we regularly assess and document the risks associated with our use of AI Technologies in processing personal information and implement appropriate mitigation measures. This includes ongoing monitoring of AI Technologies and regular reviews of their performance and impact.

Amendments

We may, at any time and at our discretion, vary this Privacy Policy by publishing the amended Privacy Policy on our website. We recommend you check our website regularly to ensure you are aware of our current Privacy Policy.

For any questions or notices, please contact us at:

Email: hello@payroller.com.au | legal@bookipi.com