Privacy Policy

Effective: 12 October 2026 · Previous version: 6 April 2026

This policy explains how Bookyn handles personal information. Bookyn is operated by D'Cruz Group Pty Ltd (ABN 68 689 883 681), trading as Bookyn, of [CONFIRM: business address], Australia ("Bookyn", "we", "us").

It applies to three groups of people:

• Customers: coaches and businesses who use Bookyn, and their team members.
• Leads: people who send Instagram or Facebook messages to a Bookyn customer.
• Visitors: people who visit bookyn.co or contact us.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, where they apply to you, other privacy laws such as the EU and UK GDPR.

1. Our role

• Customer, team and visitor information: we decide how it's used and are responsible for it.
• Lead information: when a lead messages a customer's Instagram account, we process their information on behalf of that customer, to run the customer's inbox, replies and bookings. The customer decides how their inbox is used and is responsible for telling their leads, for example in their own privacy policy, that they use an AI-assisted messaging service. We still protect lead information as this policy describes, and we will never use it for our own marketing or for any other customer.

2. What we collect

2.1 Customers and team members

• Account: name, email address, password (stored hashed), workspace name, team members and their roles.
• Billing: plan, invoices, payment status and reply-credit purchases. Card details are collected and stored by our payment provider. We see only limited details such as card brand and the last four digits.
• Connected accounts: Instagram professional account ID, username, profile picture and access tokens; calendar connection details (Calendly, Google Calendar or HighLevel) and availability; webhook URLs and secrets you create.
• Playbook content you add: your offer, ideal client description, scripts, objection answers, example messages, phrases, documents you upload, and links. If you upload material about other people (for example client testimonials), you must have their permission.
• Voice (only if you choose to use voice notes): recordings you upload, and, with your explicit consent, a voice model created from a recording of your voice. A voice model is biometric information. We use it only to produce voice notes you choose to send, and we delete it when you withdraw consent or close your account.
• Messages you write yourself, which we analyse to describe your writing style. You approve that description before it's used.
• Support and communications, including emails we send you about your account, billing and the founding offer.
• Usage and device information: IP address, browser, device, pages used, actions taken, and error logs.

2.2 Leads (people who message a Bookyn customer)

• Instagram profile information the platform provides: username, display name, profile picture and a platform-specific ID.
• Message content: text, story replies, shared posts, images, voice messages and attachments sent to or from the customer's account, with timestamps.
• Information shared in conversation, such as goals, routine, work, location and challenges. Leads sometimes volunteer health information (for example an injury, a medical condition or their weight). We don't ask for it. We process it only as part of the customer's conversation, and our safeguards can hand those conversations to a person.
• Booking details: name, email address, phone number (if given) and chosen time, and whether the call went ahead or resulted in a sale, as recorded by the customer.
• Information our software generates about a conversation (see section 4):
  • conversation stage and tags;
  • an Ideal Client Match score (0 to 100);
  • readiness and likelihood-to-book indicators;
  • a judgement about whether the customer's offer is likely to suit the person, which can include whether it's likely to be affordable;
  • short summaries of goals and objections.

2.3 Visitors

Device and usage information, cookies (section 9), and anything you send us, including booking a call through our scheduling link.

3. How we use personal information

• To provide Bookyn: receive and send messages, generate AI replies and drafts in the customer's chosen tone, qualify leads, book calls, send reminders and pre-call check-ins, and show inbox, pipeline and performance information.
• To create and secure accounts, process payments and reply credits, and send service emails (for example billing notices, usage alerts and guarantee updates).
• To give support, and to improve the reliability and quality of Bookyn.
• To meet legal, tax and accounting obligations, and to prevent fraud and misuse.
• To send customers and visitors marketing about Bookyn. You can unsubscribe at any time.

We do not:

• sell or rent personal information;
• use Instagram or Facebook data for advertising;
• combine one customer's lead information with another customer's;
• use lead information or message content to train AI models, and our AI provider is not permitted to train on it either;
• use Platform Data for any purpose not permitted by Meta's Platform Terms.

4. AI and automated decisions

Bookyn uses computer programs, including large language models provided by Anthropic, to process conversations.

Personal information used: lead profile information, message content, information shared in conversation, booking details and call outcomes, together with the customer's Playbook settings.

Decisions or steps made by computer programs, depending on the customer's settings:

• writing and, on Autopilot, sending replies and follow-ups in the customer's name;
• assigning a conversation stage, tags, an Ideal Client Match score and readiness indicators;
• deciding whether to invite a person to book a call, or to stop steering toward a call and mark them "Not a fit". This can be based on the customer's qualification rules and, if the customer turns it on, a judgement about affordability inferred from the conversation;
• choosing when to follow up, when to hand a conversation to a person, and whether to route a lead to the customer.

Human oversight:

• Customers choose Autopilot (Bookyn replies on its own) or Co-Pilot (a person writes and sends, with a draft from Bookyn only when asked) for each conversation, can hand any conversation to themselves at any time, and can take over any conversation at any time.
• Leads can ask to speak with a person, and certain words automatically hand the conversation to the customer.
• Leads can contact the customer, or us, to ask about or challenge an outcome.

These outputs are used only to manage the customer's own sales conversations. They are not used to decide anyone's eligibility for credit, insurance, housing or employment, and they are not shared with anyone other than the customer and the customer's team.

Disclosure: messages may be written by AI and sent in the customer's name. Customers choose how their assistant answers if asked whether it's automated, and must follow the laws and Meta policies that require disclosure.

5. Instagram and Facebook connection

Customers connect their account through Meta's official Instagram login and approve the permissions Bookyn requests:

• instagram_business_basic
• instagram_business_manage_messages
• instagram_business_manage_comments

We use these permissions only to read and reply to the account's messages, to show basic profile information, and, once Comment-to-DM is released, to reply to comments on the account's posts. We do not request Facebook Page or Messenger permissions, and Messenger is not connected. Access can be removed at any time in Bookyn under AI Playbook, Connections, or in Instagram under Settings, Apps and websites. When access is removed, we stop receiving new data and delete the access token straight away.

6. Who we share personal information with

We share personal information only as needed to run Bookyn, under contracts that require it to be protected:

We also share personal information:

• With the customer and their team. Lead information is visible in the customer's workspace.
• With destinations a customer sets up, such as webhooks, CRMs or Zapier. These are controlled by the customer.
• With our professional advisers, and with a buyer or investor if the business is sold or restructured, under confidentiality.
• With authorities where the law requires it. We review such requests and disclose only what is necessary.

We keep a current list of service providers at bookyn.co/subprocessors and tell customers at least 30 days before adding a new one that processes lead data.

7. Overseas disclosure

Our main database and the app itself run in Sydney, Australia. Personal information is also disclosed to providers in the United States and Ireland, and to the other locations listed in section 6, mainly to generate AI replies and to send and receive messages. We use providers bound by contracts and security commitments, and for EU/UK personal information we rely on approved transfer safeguards such as Standard Contractual Clauses.

8. Security

We protect personal information with:

• encryption in transit (TLS) and at rest;
• encrypted storage of access tokens and secrets;
• role-based access, so only authorised staff can access customer data, and only to provide support or keep the service running;
• logging and monitoring;
• regular backups.

No system is completely secure. If a data breach is likely to cause serious harm, we will notify affected customers promptly, notify the Office of the Australian Information Commissioner and affected individuals where the law requires it, and notify Meta where Meta's terms require it.

9. Cookies

We use cookies and similar technologies that are needed to sign in and keep Bookyn secure. We do not use analytics or advertising cookies. You can block or delete cookies in your browser; parts of the app may not work without the essential ones. We don't currently respond to Do-Not-Track signals.

10. How long we keep information

When information is no longer needed, we delete it or make it permanently anonymous.

11. Children

Bookyn is for people aged 18 and over. We don't knowingly market to children. Because Bookyn processes messages people choose to send to a customer, a message from someone under 18 may be received. Customers must not use Bookyn to target minors, and our safeguards can hand those conversations to a person. A parent or guardian can ask us to delete a child's information at hello@bookyn.co.

12. Your rights and choices

• Access and correction: you can ask for a copy of the personal information we hold about you, or ask us to correct it. We respond within 30 days, free of charge, after confirming your identity.
• Deletion: see our Data deletion page.
• Withdraw consent, for example for voice notes, at any time.
• Marketing: unsubscribe using the link in any marketing email.
• Leads: you can contact the coach you messaged, or contact us with your Instagram username and the account you messaged. We'll help, and we'll let the coach know.
• EU/UK residents also have rights to object, restrict processing and data portability, and to complain to their local data protection authority.

13. Complaints

Email hello@bookyn.co with the subject "Privacy complaint". We'll acknowledge it within 5 business days and respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

14. Changes to this policy

We'll update this policy as Bookyn changes. For significant changes we'll notify customers by email or in the app at least 30 days before they take effect. The effective date at the top shows the current version.

15. Contact