Privacy Policy

01Who we are

This Privacy Policy explains how Hoora Pty Ltd (ABN 87 689 552 449) ("Hoora", "we", "us", "our") handles your personal information. We're an Australian company operating a software-as-a-service platform that helps service businesses take bookings, send quotes and invoices, get paid, capture leads, and run marketing.

Our registered office is at Level 1, 63-73 Ann Street, Surry Hills NSW 2010. You can reach our privacy contact at hello@hoora.ai.

We're an "APP entity" for the purposes of the Privacy Act 1988 (Cth) and we comply with the Australian Privacy Principles (APPs). We also act in accordance with the Spam Act 2003 (Cth) for any commercial electronic messages we send.

02What this Policy covers

This Policy covers personal information we collect when you:

• Visit hoora.ai, app.hoora.ai, or a merchant's site at <their-name>.hoora.ai;
• Use the /try demo at app.hoora.ai/try (whether or not you go on to create an account);
• Create a Hoora account and use the Service as a merchant;
• Are a customer of a Hoora merchant whose data is processed through Hoora (for example, when you make a booking, request a quote, or pay an invoice on a Hoora page);
• Contact us by email, social media, or any other means.

For Hoora merchants: this Policy describes how we handle the personal information of you and your team. It also describes our role when you use Hoora to process personal information about your own customers, in which case, you remain primarily responsible for your customers' privacy, and your own privacy notice to them should reflect that.

03The personal information we collect

We collect different categories of personal information depending on how you use Hoora.

3.1 From people who use /try (the demo)

When you use /try, you describe your business and we build a preview of a booking page for it. We collect:

• Business details you enter, business name, category, the services you offer, suburb and state, and similar information used to generate the preview.
• Your email address and password if you choose to proceed to account creation. Until you do, we hold the preview inputs in a temporary onboarding record.
• Your IP address, browser, device, and approximate location (city level) for security, rate-limiting, and analytics.

You can use /try without creating an account. If you don't proceed within a reasonable period, we delete the demo inputs within 30 days, or sooner if you ask us to.

3.2 From Hoora merchants and their staff

If you create a Hoora account, we collect:

• Identity and contact information, your name, business name, mobile number, email, role (owner, manager, staff).
• Business information, trading name, business type, location, ABN if you provide one, slug, integration details for connected services.
• Authentication information, your password (stored as a salted hash; we never see your plain-text password), session tokens, and security logs.
• Operational data, your services and prices, resources and staff, working hours, rosters, bookings, quotes, invoices, payments, customer records, campaigns, and the content you create. Some of this is personal information about your staff and your customers.
• Customer support communications, emails, chat messages, and recordings of any support calls you have with us.

3.3 From your end-customers (bookings, quotes, invoices, enquiries)

When your customers use a Hoora-powered page (your booking, quote, enquiry, or invoice page, or a campaign link), we may process on your behalf:

• Identifiers and contact details, name, mobile number, email address, or a generated customer ID;
• Booking and request details, the service requested, date and time, address, notes, photos, and any answers they provide;
• Payment activity, amounts, invoice/quote status, and payment events (card details are handled by Stripe, not stored by us);
• Missed-call leads, where your business phone forwards a missed call, the caller's number, so we can text them back on your behalf;
• Attribution data, which campaign, tracked link, or channel a lead or booking came from.

We process this information on behalf of you, the merchant. You are responsible for ensuring you have given your customers a proper privacy notice and have a lawful basis under the Privacy Act to share their information with us. See Section 11 for the merchant-customer split.

3.4 From integrations you connect

If you connect a third-party service to your Hoora account, we receive data from that service, and we send data to it, only to provide the feature you asked for:

• Google Calendar, if you connect a Google account, we request the calendar.events and calendar.freebusy scopes. We use them only to (a) read your calendar's free/busy availability so we don't offer customers a time you're already busy, and (b) create, update, and delete the calendar events that correspond to your Hoora bookings. We don't read the content of your other events, and we don't use Google data for advertising or to train AI models.
• Microsoft 365 / Outlook Calendar, if you connect a Microsoft account, we request the Calendars.ReadWrite scope and use it for the same purpose: free/busy availability and writing your booking events. The same limits apply.
• Stripe, we use Stripe both to (a) bill your Hoora subscription, and (b) let you collect payments from your own customers (Stripe Connect). We receive your subscription status, payout/account status, invoices, and payment events. We don't store full card numbers, Stripe does. Stripe's privacy practices apply at stripe.com/privacy.
• Twilio, powers missed-call text-back and SMS. Where enabled, we process the phone numbers involved in a forwarded missed call so we can send a text back on your behalf. Twilio's privacy practices apply at twilio.com/legal/privacy.

3.5 Automatically, when you use the Service

• Usage data, pages visited, features used, errors encountered, timestamps;
• Device and connection data, IP address, browser type, operating system, device identifiers, language;
• Cookies and similar technologies, see Section 9.

3.6 From the creative tools (Campaign Studio, Content Library, Reel Studio)

When you use the Campaign Studio, Content Library, or Reel Studio, we store the media and materials you upload or create, including video clips, footage, images, photographs, audio, voiceovers, captions, and brand assets. Some of this may contain personal information, for example, the image or voice of an identifiable person in footage you upload. You're responsible for ensuring you have the rights and consents to upload and use that content (see the Terms of Service). Tracks you use from the Hoora royalty-free music library are licensed by us; any other audio you add is your responsibility.

04How we collect personal information

We collect personal information:

• Directly from you, when you upload an invoice, sign up, fill in a form, talk to us, or use the Service;
• From integrations, when you authorise us to connect to Google, Microsoft, Stripe, or another service;
• From cookies and analytics tools, embedded in our website and app (see Section 9);
• From your staff or other authorised users, for example, when an owner adds a staff member to their roster.

Where it's reasonable and practical, we collect personal information directly from the individual it relates to. Where we collect from someone else (for example, a merchant adds their staff member), we rely on the merchant having an appropriate basis to do so.

05Why we collect and use personal information

We collect and use personal information for the following purposes:

06AI, automated decisions, and overseas disclosure

6.1 How we use AI

Several features of the Service use artificial intelligence and automated processing, including building your booking page from a plain-English description of your business, generating marketing calendars and campaign content, generating social captions and Reels, and producing daily business summaries and suggested follow-ups. We currently use Anthropic, PBC (provider of Claude) for AI processing, with processing occurring on Anthropic's infrastructure in the United States and possibly other countries where Anthropic operates.

When we send data to Anthropic:

• it's sent through Anthropic's commercial API under a contract that prohibits Anthropic from using your data to train its general models;
• inputs and outputs are processed transiently under Anthropic's commercial zero-retention or limited-retention terms; and
• we send only the data needed for the feature you're using (for example, an invoice you uploaded, or campaign-generation inputs).

We don't use your personal information to train foundation AI models. We may use de-identified, aggregated patterns from how the Service is used to improve and develop our own features, as described in Section 5.

6.2 Automated decisions and human review

Our AI features assist you: they generate information, content, and suggestions for your consideration. They don't make decisions about you or your customers on their own. You (or the relevant merchant) review the output and decide whether and how to use it, the Terms of Service require this human review before you act on AI output. We don't use automated processing to make decisions that produce legal effects, or similarly significant effects, on an individual without a person being responsible for that decision.

From 10 December 2026, new transparency requirements under the Privacy Act (APP 1.7) will apply where an organisation arranges for a computer program to use personal information to make a decision that could reasonably be expected to significantly affect an individual's rights or interests. If and to the extent those requirements apply to us, we'll set out the required details here, including the kinds of personal information used and the kinds of decisions involved, and we'll update this Policy accordingly.

6.3 Overseas disclosure

We've taken reasonable steps to ensure that our overseas service providers handle personal information in a manner consistent with the Australian Privacy Principles. By using the Service, you acknowledge that some of your personal information will be processed in the United States and possibly other countries, where local laws may differ from Australian law. As well as Anthropic, our main overseas service providers include:

• Supabase, Inc. (database and authentication), United States;
• Stripe Payments Australia Pty Ltd with parent processing in the United States;
• Vercel, Inc. (web hosting and analytics), United States;
• Google LLC and Microsoft Corporation, where you connect a Google or Microsoft calendar, United States;
• Twilio Inc. (SMS and missed-call text-back), United States;
• Resend (transactional email), United States;
• Meta Platforms Ireland Limited / Meta Platforms, Inc. (advertising pixel, where we run ads), Ireland and United States.

We list the most material providers here; this is not an exhaustive list of every sub-processor. Where we make material changes to who processes personal information, we'll update this Policy.

07Who we share personal information with

We share personal information with:

• Service providers that help us deliver the Service (hosting, AI, payments, email, analytics, customer support tools). They're permitted to use personal information only to provide their services to us;
• Google, Microsoft, Stripe, and other integrations you connect, when you authorise the integration;
• Other users of your store, for example, your owner can see staff records; staff can see relevant roster data;
• Professional advisors, lawyers, accountants, auditors, under confidentiality;
• Government, law enforcement, or regulators, where we're required to by law, or to protect the rights, safety, or property of Hoora, our users, or others;
• In a business transaction, if we're acquired, merged, or restructured, personal information may be transferred to the successor entity, subject to this Policy.

08How we store and secure personal information

We store personal information on cloud infrastructure provided by reputable service providers. We use a range of technical and organisational measures, including:

• Encryption in transit (TLS) and at rest;
• Row-level security policies in our database to restrict access to your store's data;
• Salted password hashing, we don't store your plain-text password;
• Access controls, only authorised personnel have access to production data, and only where needed;
• Logging and monitoring of suspicious activity;
• Regular review of our security practices.

No system is perfectly secure. If we become aware of a data breach that is likely to result in serious harm, we'll notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

09Cookies, pixels, and analytics

We use cookies and similar technologies for:

• Authentication and security (essential cookies, these can't be disabled);
• Analytics, Vercel Web Analytics provides aggregated, cookie-free or low-personal-information page-view data;
• Advertising and conversion measurement, on the /try page we operate a Meta Pixel to measure conversion rate from our advertising. The Meta Pixel sets cookies and reports events (such as "TryStarted" and "TryCompleted") to Meta.

You can control cookies through your browser settings. Disabling essential cookies will affect your ability to use the Service.

If you're located in the EU, UK, or another jurisdiction with specific cookie-consent laws, we honour the consent signals provided by your browser.

10Marketing communications

If you're a Hoora user, we may send you:

• Service emails, billing, security, trial expiry, important Service changes. These aren't marketing and you can't opt out while you have an active account, although you can close the account.
• Marketing emails, product updates, tips, occasional newsletters. We send these only where we have a basis under the Spam Act 2003 (Cth) (consent, or an existing customer relationship within scope). Every marketing email includes an unsubscribe link. Unsubscribing is honoured promptly.

You can opt out of all marketing at any time by clicking unsubscribe or emailing hello@hoora.ai.

11Merchants and their customers

• You must have your own privacy notice that tells your customers what you collect, why, who you share it with (including Hoora), and how to contact you;
• You must have a lawful basis under the Privacy Act for sharing your customers' personal information with us (typically: explicit consent at point of collection);
• We act as your processor for that information, handle it on your instructions, and apply this Policy and the Terms to it.

A note on your own obligations: the Privacy Act's small business exemption is being wound back, and more businesses are progressively being brought within the Act. You shouldn't assume your business is exempt, we recommend you check your own obligations and keep your own privacy notice up to date.

If you're a customer of a Hoora merchant and you want to know how your data is being used, contact the merchant first. We can help redirect your enquiry if needed. You can reach us at hello@hoora.ai.

12How long we keep personal information

We keep personal information only as long as we need to for the purposes set out in this Policy, or as required by law.

You can request earlier deletion at any time (see Section 13).

13Your rights

Under the Privacy Act, you have rights to:

• Access the personal information we hold about you;
• Correct information that's inaccurate, out of date, or incomplete;
• Complain about how we've handled your personal information;
• Withdraw consent to a specific use (where we relied on consent);
• Opt out of marketing at any time.

You may also ask us to delete your personal information. We'll do so unless we're legally required to retain it (for example, financial records).

To exercise any of these rights, email hello@hoora.ai. We'll respond within 30 days, usually sooner. There's no charge for reasonable requests.

If you're a customer of a Hoora merchant and you want to exercise rights over the information the merchant shares with us, please contact the merchant first.

14Complaints

If you think we've mishandled your personal information:

1. Tell us first. Email hello@hoora.ai with the details. We'll acknowledge within 5 business days and aim to resolve within 30 days.
2. If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, 1300 363 992.

15Children

The Service is built for businesses and isn't directed at, or intended to be accessed by, children. We don't knowingly collect personal information from anyone under 18. If you believe a child has provided personal information to us, contact hello@hoora.ai and we'll delete it. We'll comply with the Children's Online Privacy Code (being introduced under the Privacy Act) to the extent it applies to us.

16Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top shows the most recent change. For material changes that affect how we handle your personal information, we'll give reasonable notice by email or in-app notice. Your continued use of the Service after the change takes effect means you accept the updated Policy.

17Contact us

For privacy-specific enquiries, use the same address with "Privacy" in the subject line.