Privacy Policy

This policy explains how Buuka, a business name of Adilson Junior Vieira Rodrigues (ABN 85 900 887 849), handles personal information. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

It covers four groups of people:

If you’re a client or crew member, the business you deal with is responsible for how it uses your information. Read its privacy policy too, and contact it first about your information. We’ll help it respond.

We collect most information directly from you, or from the business you deal with. We may also get information from Stripe (payment status) and Google Maps (to turn an address into a map position, where a business uses this).

You don’t have to give us your information, but without it some things won’t work. For example, a business can’t confirm a booking without your phone or email.

We use personal information to:

• provide Buuka: booking pages, schedules, the crew app, messages, payments and reports;
• send service messages on behalf of businesses, such as confirmations, reminders and “on the way” texts;
• bill businesses for their plans;
• give support and answer questions;
• protect Buuka and its users from fraud, misuse and security threats;
• improve Buuka, using aggregated or anonymised information where we can;
• meet our legal obligations.

We only send marketing emails to business account holders. Every marketing email has an unsubscribe link. We never send marketing to clients or crew of the businesses that use Buuka.

We share personal information only as needed to run Buuka:

• The business you deal with. A client’s booking details go to the business they booked with. A crew member’s details go to the business that invited them.
• Our service providers. These process information for us under their own privacy and security commitments:

• Others where the law requires or allows it, such as to a court, regulator or law enforcement, or to protect someone’s safety.
• A new owner of Buuka, if the business is sold, under the same protections.

We don’t sell or rent personal information.

Some of our providers store or process information outside Australia, including in the United States. Database, authentication and file storage (Supabase) run in Sydney, Australia. The app itself (Vercel) runs its functions in Sydney, with a global content delivery network. Resend (email), Twilio (SMS), Stripe (payments), Upstash (rate limiting) and Google Maps (addresses, where configured) process information in the United States. We choose providers with strong security and take reasonable steps so they handle information consistently with the Australian Privacy Principles.

We protect personal information with encryption in transit, access controls, separate data for each business, limited staff access and activity monitoring. Passwords are stored encrypted, and we never see full card numbers. No system is perfectly secure, so please keep your login details private.

We use cookies and similar storage to keep you signed in, remember your choices and keep Buuka secure. We don’t use advertising cookies. If you block cookies, you may not be able to sign in.

• Business accounts: while the account is open, then 90 days read-only after it closes, then deleted.
• Client and crew information: for as long as the business keeps its account, or until the business deletes it.
• Billing and tax records: for 5 years, as Australian tax law requires.
• Backups: deleted information can remain in backups for up to 7 days (daily Supabase backups — to confirm against the live plan before launch).

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing privacy@buuka.com.au. We’ll respond within 30 days. We may need to confirm who you are. If you’re a client or crew member, we may refer your request to the business you deal with, because it controls that information.

If a data breach is likely to cause someone serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires. If the breach affects a business’s clients or crew, we will also tell that business promptly.

If you’re unhappy with how we’ve handled your information, email privacy@buuka.com.au. We’ll reply within 30 days. If you’re still not satisfied, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.

We may update this policy. We’ll post the new version here with its effective date. If a change matters to how we use your information, we’ll tell business account holders by email at least 30 days before it applies.

Privacy questions: privacy@buuka.com.au.