Privacy policy

Matthew Jeffrey Evans (Naturally Creative), ABN 89 389 117 621, trading as Chockers ("we", "us") runs an online booking service used by businesses that run classes, courses, camps and events ("businesses"), and by the people who book with them ("customers").

This policy explains what personal information we handle, why, and what you can do about it. We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), whether or not the small business exemption would apply to us.

1. Two roles: the business collects, we hold

When you book a class, the business you book with collects your information and decides what to do with it. We store it and process it on their behalf so the booking works. If you have a question about what a business does with your details — for example, a class reminder or their mailing list — ask them; their contact details are on every booking page and in every email.

For people who sign up to run a business on Chockers, we are the collector of your account information.

2. What we collect

From customers, when they book:

• your name, email address, and phone number if you give one;
• the names of the people you book for (for example your children), and any details the business asks for on its booking form;
• what you booked, when, what it cost, discounts and vouchers used, and what you've paid;
• if you pay by card: Stripe handles the card. We never see or store your card number. We receive a payment reference and the amount.

From people who buy a gift voucher: your name and email, and the recipient's name and email (and your message), so we can deliver it.

From businesses: the account holder's email address; the business's name, address, contact details, timetable and prices; and, if they connect Stripe, their Stripe account id and its status. Stripe collects identity and bank details directly; we never see them.

Automatically: a sign-in cookie for people who have an account; a basket and a half-finished gift form kept in your own browser until you finish; the IP address of requests, kept briefly to stop abuse (rate limits). We don't use advertising or analytics trackers.

Sensitive information. Some businesses (for example children's activities) may ask about medical conditions or allergies. That is sensitive information under the APPs. It is only collected with consent, stored encrypted, and kept out of exports, emails and connected tools unless the business specifically turns that on.

3. Why we use it

• To take, confirm, change and cancel bookings, and to tell you about them (confirmations, changes, cancellations, gift vouchers).
• To take payments and issue refunds through Stripe.
• To let the business see who's coming and mark them off.
• To keep the service secure, prevent fraud and abuse, and fix problems.
• To meet legal obligations (for example tax records).

We don't sell personal information, and we don't use customers' details to market anything of our own.

4. Who we share it with

• The business you booked with — it's their booking.
• Service providers who run parts of Chockers for us, under contracts that limit them to that purpose:
• Supabase (database and sign-in) — hosted in Sydney, Australia;
• Vercel (the website and app) — run in Sydney, Australia; their global network may pass requests through other countries;
• Stripe (card payments) — may process data in Australia, the United States and elsewhere;
• Resend (sending email) — processes data in the United States.
• Your own AI assistant, only if a business connects one to its account (for example Claude). That runs on the business's own account and is their choice.
• Authorities, when the law requires it.

Some of these providers are overseas (APP 8). We choose providers who protect information to a standard comparable to the APPs.

5. How long we keep it

Booking and payment records are kept for as long as the business keeps its account, and then as long as tax law requires (7 years). If a business or account is closed, nothing is wiped straight away so it can be restored if that was a mistake; after 90 days it is deleted or de-identified, except records we must keep by law. [Built, and switched off until this period is confirmed — see the launch checklist.]

6. Security

Information is stored in Australia and encrypted in transit. Voucher codes and sensitive answers are additionally encrypted at rest with keys that never leave our servers. Every table is protected so each business can only reach its own records. Staff access is limited to what's needed to run and support the service. If a data breach is likely to cause serious harm, we'll notify you and the OAIC as the Notifiable Data Breaches scheme requires.

7. Your choices

• See or correct your information: ask the business you booked with, or email us at [privacy@…]. We'll respond within 30 days.
• Businesses can download everything they hold with us at any time (Settings → Download everything) and close their business or account themselves.
• Complaints: email [privacy@…]. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

8. Children

Children don't book themselves: a parent or guardian books for them and gives their details.

9. Changes

If we change this policy in a way that matters, we'll say so on this page and email businesses before it takes effect.