Privacy Policy

Nalah respects your privacy. This policy explains how we handle personal information when people visit Nalah, run a business through Nalah, or use a Nalah-hosted booking or payment page.

Information we collect

We may collect:

• contact and account details, such as names, email addresses and phone numbers;
• business, profile, class, location, booking, waitlist and pass information;
• answers to booking questions, which may include health or other sensitive information if a business asks for it;
• payment details such as amounts, descriptions, status and provider references;
• connected payment-account details, permissions and status;
• messages, support requests and imported information; and
• technical information such as IP address, device and browser details, cookies, usage events, referral information and logs.

Payment card details are collected by the selected payment provider. Nalah does not store full card numbers.

We collect information from you, from businesses using Nalah, from your use of the service, and from services you choose to connect, such as Facebook or a payment provider.

Facebook login

When you log in with Facebook, we may collect your name, email address, Facebook profile picture and other basic profile information you choose to share. We also receive your Facebook user ID and an access token to connect your Facebook account with Nalah.

We do not collect your Facebook password.

How we use information

We use personal information to create and manage accounts and subscriptions, provide access to Nalah, improve and personalise your experience, process bookings and payments, connect payment providers, communicate with you, provide support, prevent fraud and misuse, secure the service, comply with law, and resolve disputes.

We may send service messages and, where permitted, marketing messages. You can unsubscribe from marketing messages at any time.

Businesses using Nalah

A business using Nalah decides what customer information it needs for its classes and services. The business is responsible for its booking questions, privacy notices, permissions and lawful use of that information. This includes obtaining any consent required before asking for health or other sensitive information. Nalah processes that information to provide the service to the business.

For questions about a particular booking or a business's use of your information, contact that business first. Nalah can assist with requests relating to the platform.

When we share information

We may share information with:

• the business responsible for your booking or payment;
• a payment provider you or the business selects, including Square, PayPal, Stripe Connect or a future provider;
• providers supporting hosting, storage, email, authentication, analytics, security and customer support;
• professional advisers, regulators or authorities where reasonably necessary; and
• a buyer or successor if Nalah's business is reorganised or transferred.

We may also disclose information when required by law or legal process, or when reasonably necessary to protect our rights, safety or property, or those of others.

We do not sell or rent personal information.

Payment providers handle information under their own terms and privacy policies. Their decisions about verification, payment processing, holds, disputes and account access are outside Nalah's control.

Overseas processing

Some providers may store or process information outside Australia. The countries involved vary according to the service and payment provider used. Privacy protections in those countries may differ from Australian protections.

Cookies and analytics

Nalah uses essential cookies to operate accounts and sessions. We may also use analytics and similar technologies to understand use of the service and improve it. Browser settings can limit cookies, but parts of Nalah may then stop working correctly.

Security and retention

We use reasonable technical and organisational safeguards to protect personal information from unauthorised access, disclosure, alteration or destruction. No online service can guarantee absolute security.

We retain information for as long as needed to provide Nalah, meet legal and accounting requirements, prevent fraud, maintain backups and resolve disputes. We delete or de-identify information when it is no longer reasonably required, subject to those obligations.

Your choices and complaints

You may ask to access, correct or delete personal information held by Nalah at any time. We may need to verify your identity and may retain information where law or legitimate operational needs require it.

Email privacy questions, requests or complaints to support@nalah.co. We will review and respond within a reasonable time. If a privacy complaint remains unresolved, you may contact the privacy regulator that applies to you, including the Office of the Australian Information Commissioner.

You can also continue to send privacy questions and deletion requests to damien@nalah.co, the contact address provided in our previous policy.

Changes

We may update this policy as Nalah or its providers change. We will publish the updated policy here and update the date above. Where practical, we will give reasonable notice of material changes.