Privacy Policy

This Privacy Policy explains how PBX1 Fadez & Cuts ("PBX1", "we", "us", "our"), operated by RS SUMAN PTY LTD (ABN 36 660 464 602), collects, uses, stores and shares your personal information when you use our mobile app, web app and related services (together, the "Services"). We are an Australian business based in Sydney, New South Wales, and we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are

PBX1 Fadez & Cuts operates two barbershops in Sydney and provides this app so customers can book appointments, buy hair-care products and merchandise for collection in store, and earn and redeem loyalty rewards. Barbers use the app to manage their schedule and chair; admin staff use it to run the shop.

2. Information we collect

We collect the following categories of personal information, only as needed for the purposes described in section 3.

2.1 Account information

• Full name
• Email address
• Mobile phone number
• Password (stored only as a salted hash; we never see your plain-text password)
• Date of birth (optional, used for birthday offers and age-appropriate services)

2.2 Booking information

• Chosen location, service, barber, date and time
• Booking notes you provide (removed when you delete your account; the booking's date, service and amount stay for tax purposes)
• Artwork you upload for a custom print, kept in a folder only you and the shop can change and removed when you delete your account
• The payment method used and the amount paid at booking
• Contact details associated with that specific booking (phone, email)

2.3 Hair profile (optional)

• Hair type and length
• Known allergies or skin sensitivities
• Personal notes you choose to share with your barber

2.4 Family bookings

If you bring a child, you can add their name and date of birth to your own account so the shop knows who is coming and can offer age-appropriate services. Children have no account of their own and cannot sign in or book; every booking stays on the parent's or guardian's account, and the barber sees the child's name on that booking only. Remove a child from your profile at any time; the record is anonymised immediately.

2.5 Photos

Your barber may, with your explicit in-app consent, photograph your finished look for the shop's gallery. You can withdraw that consent at any time from your profile; withdrawing it hides every photo of you immediately, and deleting your account does the same. The photos then leave storage as well, straight away, or at the latest within 30 days.

2.6 Loyalty programme

• Current points balance and level
• Transaction history (points earned, points redeemed and store credit)

2.7 Reviews

• Star rating
• Written review body

2.8 Payments

Card payments, including Apple Pay and Google Pay, are processed by Stripe. We store the transaction amount, the form of payment (card, Apple Pay or Google Pay) and Stripe's reference for the payment. We do not store full card numbers, CVV codes or expiry dates on our servers.

2.9 Notifications

When you opt in to push notifications, we store an Apple or Google device token so we can send you booking confirmations and reminders and, unless you have switched them off, offers.

2.10 Crash reports

When the app hits an error it sends us a crash report so we can fix it: the error message and its technical stack, the screen you were on, the app version, and the platform and browser identification your device reports. The report is linked to your account, so we can tell a fault that hit one person from one that hit everyone. Before it leaves your device the app strips email addresses, phone numbers, access tokens and payment references out of the text. These reports come to our own database; we use no third-party crash-reporting, analytics or advertising service.

2.11 Security and technical records

We do not use analytics or advertising SDKs in the app. Our hosting providers keep ordinary server request logs (IP address, browser or device type, app version) for security and debugging. In our own records we keep the time, the account and the change behind security-sensitive actions (sign-in attempts, password resets, and edits made in the shop console); these records do not include your IP address, and they do not copy your name, phone number, email address or date of birth. When you delete your account, you are removed from them as well. Notification text passes through Apple's and Google's push services to reach your phone.

3. Why we use it

4. When we share your information

We never sell your personal information. We share it only with the trusted processors listed below, and only to the extent needed to provide the Services. Each processor is contractually required to protect your data.

Our database and file storage are hosted by Supabase in Singapore. Stripe, Cloudflare, Apple and Google may process data in the United States and other countries in which they operate. Where personal information leaves Australia, we rely on the recipient's contractual commitments to protect it to a standard comparable to the Australian Privacy Principles.

We may also disclose information where required by Australian law, by a court order, or to protect the safety of our staff or customers.

5. How long we keep it

• Booking and payment records: retained for at least 7 years to meet our taxation and consumer-law obligations.
• Account profile: retained while your account is active; deleted immediately when you confirm the deletion in the app, subject to the 7-year rule above for finance records (which are de-identified). A deletion requested by email is completed within 30 days. Any upcoming bookings are cancelled when your account is deleted, and the shop is told.
• Photos: hidden immediately when you withdraw consent or delete your account, and removed from storage straight away, or at the latest within 30 days of your request.
• Loyalty history: retained while your account is active; cleared on account deletion.
• Crash reports: kept while we investigate and fix the fault they describe.
• Security and technical records: kept for two years, then deleted automatically. Your personal details are removed from them as soon as you delete your account.

6. How we secure your information

• All traffic between the app and our servers is encrypted in transit (TLS 1.2+).
• Data at rest in Supabase is encrypted using industry-standard ciphers.
• Passwords are stored only as salted hashes.
• Access to production data is limited to a small number of authorised staff and is logged.
• We use row-level security so that one customer cannot read another customer's data.

7. Your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you.
• Correct any information that is inaccurate, out of date, incomplete or misleading.
• Delete your account and the personal information associated with it (subject to records we are legally required to keep). You can do this yourself in the app under Profile → Privacy & data.
• Withdraw consent at any time for any processing that depends on your consent, including marketing emails, push notifications and gallery photos.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have mishandled your information.

To exercise any of these rights, email admin@pbx1fadezandcuts.com.au. We respond within 30 days.

8. Children

Our Services are intended for customers aged 13 and over. Where a parent or guardian books a service for a younger child, the parent or guardian remains responsible for the account and for any information provided about the child. We do not knowingly collect personal information directly from children under 13.

9. Cookies and similar technologies

Our web app uses a small number of strictly necessary cookies and local-storage entries to keep you signed in and remember your preferences. We do not use third-party advertising or tracking cookies.

10. Marketing communications

Because you hold an account with us, we may send you occasional offers by email or push notification alongside your booking updates. You can switch offers off at any time from inside the app under Profile → Notifications, or by using the unsubscribe link in any marketing email; booking confirmations and reminders are not affected.

11. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you inside the app before the change takes effect.

12. Contact us

If you have any questions, requests or complaints about this policy or about how we handle your information, please contact our privacy officer:

PBX1 Fadez & Cuts (RS SUMAN PTY LTD)
Email: admin@pbx1fadezandcuts.com.au
Postal: Sydney, NSW, Australia