Privacy Policy

This Privacy Policy explains how PBX1 Fadez & Cuts ("PBX1", "we", "us", "our"), operated by RS SUMAN PTY LTD (ABN 36 660 464 602), collects, uses, stores and shares your personal information when you use our mobile app, web app and related services (together, the "Services"). We are an Australian business based in Sydney, New South Wales, and we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are

PBX1 Fadez & Cuts operates two barbershops in Sydney and provides this app so customers can book appointments, buy hair-care products and merchandise for collection in store, and earn and redeem loyalty rewards. Barbers use the app to manage their schedule and chair; admin staff use it to run the shop.

2. Information we collect

We collect the following categories of personal information, only as needed for the purposes described in section 3.

2.1 Account information

• Full name
• Email address
• Mobile phone number
• Password (stored only as a salted hash; we never see your plain-text password)
• Date of birth (optional, used for birthday offers and age-appropriate services)
• Profile photo (optional)

2.2 Booking information

• Chosen location, service, barber, date and time
• Booking notes you provide
• The payment method used and the amount paid at booking
• Contact details associated with that specific booking (phone, email)

2.3 Hair profile (optional)

• Hair type and length
• Known allergies or skin sensitivities
• Personal notes you choose to share with your barber

2.4 Family bookings

If you book on behalf of a child, we collect the child's first name and date of birth so the barber can provide an age-appropriate service. This information is only collected from the parent or legal guardian and is never used for marketing.

2.5 Photos

Your barber may, with your explicit in-app consent, photograph your finished look for the shop's gallery. You can withdraw that consent at any time from your profile; withdrawing it hides every photo of you immediately, and deleting your account does the same. To have a photo removed from storage as well, contact the shop and we will do so within 30 days.

2.6 Loyalty programme

• Current points balance and level
• Transaction history (points earned, points redeemed and account credit)

2.7 Reviews

• Star rating
• Written review body

2.8 Payments

Card payments, including Apple Pay and Google Pay, are processed by Stripe. We store the transaction amount, the brand and last four digits of the card, and a Stripe customer reference. We do not store full card numbers, CVV codes or expiry dates on our servers.

2.9 Notifications

When you opt in to push notifications, we store an Apple or Google device token so we can send you booking confirmations and reminders and, unless you have switched them off, offers.

2.10 Crash reports

When the app hits an error it sends us a crash report so we can fix it: the error message and its technical stack, the screen you were on, the app version, and the platform and browser identification your device reports. The report is linked to your account, so we can tell a fault that hit one person from one that hit everyone. Before it leaves your device the app strips email addresses, phone numbers, access tokens and payment references out of the text. These reports come to our own database; we use no third-party crash-reporting, analytics or advertising service.

2.11 Security and technical records

We do not use analytics or advertising SDKs in the app. Our hosting providers keep ordinary server request logs (IP address, browser or device type, app version) for security and debugging, and we record the time and IP address of security-sensitive actions on your account, such as a password change or an action taken by shop staff, in an audit log.

3. Why we use it

4. When we share your information

We never sell your personal information. We share it only with the trusted processors listed below, and only to the extent needed to provide the Services. Each processor is contractually required to protect your data.

Our database and file storage are hosted by Supabase in Singapore. Stripe, Cloudflare, Apple and Google may process data in the United States and other countries in which they operate. Where personal information leaves Australia, we rely on the recipient's contractual commitments to protect it to a standard comparable to the Australian Privacy Principles.

We may also disclose information where required by Australian law, by a court order, or to protect the safety of our staff or customers.

5. How long we keep it

• Booking and payment records: retained for at least 7 years to meet our taxation and consumer-law obligations.
• Account profile: retained while your account is active; deleted within 30 days of a verified deletion request, subject to the 7-year rule above for finance records (which are de-identified where possible).
• Photos: hidden immediately when you withdraw consent or delete your account, and removed from storage within 30 days of your request.
• Loyalty history: retained while your account is active; cleared on account deletion.
• Crash reports: kept while we investigate and fix the fault they describe.
• Security and technical records: kept only for as long as they are needed for security and to meet our legal obligations, then deleted.

6. How we secure your information

• All traffic between the app and our servers is encrypted in transit (TLS 1.2+).
• Data at rest in Supabase is encrypted using industry-standard ciphers.
• Passwords are stored only as salted hashes.
• Access to production data is limited to a small number of authorised staff and is logged.
• We use row-level security so that one customer cannot read another customer's data.

7. Your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you.
• Correct any information that is inaccurate, out of date, incomplete or misleading.
• Delete your account and the personal information associated with it (subject to records we are legally required to keep). You can do this yourself in the app under Profile → Privacy & data.
• Withdraw consent at any time for any processing that depends on your consent, including marketing emails, push notifications and gallery photos.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have mishandled your information.

To exercise any of these rights, email admin@pbx1fadezandcuts.com.au. We respond within 30 days.

8. Children

Our Services are intended for customers aged 13 and over. Where a parent or guardian books a service for a younger child, the parent or guardian remains responsible for the account and for any information provided about the child. We do not knowingly collect personal information directly from children under 13.

9. Cookies and similar technologies

Our web app uses a small number of strictly necessary cookies and local-storage entries to keep you signed in and remember your preferences. We do not use third-party advertising or tracking cookies.

10. Marketing communications

Because you hold an account with us, we may send you occasional offers by email or push notification alongside your booking updates. You can switch offers off at any time from inside the app under Profile → Notifications, or by using the unsubscribe link in any marketing email; booking confirmations and reminders are not affected.

11. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you inside the app before the change takes effect.

12. Contact us

If you have any questions, requests or complaints about this policy or about how we handle your information, please contact our privacy officer:

PBX1 Fadez & Cuts (RS SUMAN PTY LTD)
Email: admin@pbx1fadezandcuts.com.au
Postal: Sydney, NSW, Australia