Privacy Policy
MISE Systems Pty Ltd ("MISE", "we", "us") operates the MISE booking platform — the consumer app Mise and the merchant app Mise Business (iOS and Android), the online booking site book.misesystems.com, and the website misesystems.com (collectively, the "Services"). The Services let users search for businesses signed up to the platform, request and book appointments, and process payments and transaction fees securely through the platform.
This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over your data. We are committed to protecting the privacy and security of our users' personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where you access the Services from outside Australia, additional local laws may apply (for example, the EU GDPR).
By accessing or using the Services, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy.
1. Information we collect
We only collect information that is necessary to operate the Services and to comply with law. We never sell your data.
| Category | Examples | Why we need it |
|---|---|---|
| Account & contact | Email, phone number, first and last name, profile photo, date of birth (optional), chosen role (customer / business owner / staff) | To create your account, sign you in, send booking confirmations and reminders, and provide customer support |
| Business onboarding (merchants only) | Business name, ABN, address, contact information, premise photos, services and pricing, appointment availability, fee arrangements, staff portfolio uploads, bank account information for payouts | To verify each business before it goes live on the platform and to route customer payments to your account |
| Bookings | Bookings you create or receive, the services involved, dates and times, status changes, cancellations and refunds, customer notes | To run the booking flow end-to-end, including managing cancellations and refunds |
| Messages | Chat messages exchanged between a customer and a business on the platform | To let customers and businesses communicate about a booking, and to act on block and report requests |
| Consent forms (waivers) | Where a business asks you to complete a consent form: your name, date of birth, contact details, parent or guardian details for minors, your answers to the form's questions (which may include health information relevant to the service), your signature, and the time, IP address and browser used to sign | To give the business a signed record of your consent before the service is performed. Health information is collected only with your consent and is shared only with the business you are signing for. |
| Rewards & referrals | Loyalty points and tier, coupons you hold or redeem, referral codes you share or use | To run the loyalty, coupon, and invite-a-friend programs |
| Reviews | Star rating and free-text comment you submit after a completed booking | To help other customers make informed decisions |
| Location | Approximate or precise device location while the customer app is in use (only if you grant permission); addresses you save or search for | To show premises near you or near an address you choose; you can revoke the location permission any time in your device settings |
| Device & usage | Anonymous device identifier, push notification token, app version, OS version, crash reports, broad usage events (e.g. "screen viewed") | To send notifications, diagnose crashes, and understand which features are useful |
| Payment | Last four digits of the card you used to pay, payment method type, payment timestamp, amount, fees charged, refunds, transaction history, and billing preferences | To calculate and process payments and the applicable 6% transaction and processing fees, show you a receipt, and run refunds. Card numbers and CVCs are handled directly by Stripe — we never receive or store them. |
2. How we use your information
- Run the Services. Authenticate you, run searches, complete bookings, manage cancellations and refunds, calculate and process payments and the applicable 6% transaction and processing fees through Stripe, and surface reviews.
- Communicate with you. Contact you by push notification, email, or SMS about your appointments, send important updates, payment receipts, and notifications regarding transactions, and respond to your inquiries or requests.
- Verify merchants. Manually review every business signup before it appears to customers.
- Keep the platform safe. Detect fraud, abuse, and reverse-engineering attempts; honour content reports; enforce our Terms.
- Improve the product. Read aggregated, de-identified usage data to analyse trends, monitor usage patterns, fix bugs, and improve the functionality, security, and user experience of the Services. We do not build personal profiles for advertising and we do not sell user lists.
- Comply with law. Tax, accounting, dispute resolution, and lawful requests from authorities.
3. Who we share your information with
We share only the minimum information needed for each partner to do their job for us, and only with partners who are themselves bound by privacy obligations.
- Stripe (Stripe Payments Australia Pty Ltd) — card payments, buy-now-pay-later payments (Afterpay and Zip, where you choose them at checkout), and Stripe Connect Express payouts to merchants. Stripe is the data controller for card-network data. See stripe.com/au/privacy.
- Google / Firebase — authentication, push notifications (FCM), App Check, analytics, and crash diagnostics (Crashlytics); Google Play distribution; and Google Maps Platform for maps and address search. See firebase.google.com/support/privacy.
- Apple — App Store distribution, push (APNs), App Attest, and Sign in with Apple. See apple.com/legal/privacy.
- DigitalOcean — server hosting (Sydney, Australia), database storage, photo storage. See digitalocean.com/legal/privacy-policy.
- Twilio (including Twilio SendGrid) — transactional emails and SMS such as booking confirmations, verification codes, and payment receipts.
- Other businesses on the platform — when you book, the merchant sees your name, contact details, booking details, and any notes you attached so they can schedule and fulfil the appointment.
- Legal reasons — we may disclose your information if required by law or in response to a subpoena, court order, regulatory request, or other legal process, or to protect the rights, property, or safety of MISE Systems Pty Ltd, our users, or others.
We do not sell your personal information. We do not share it with advertising networks. The Services contain no third-party ad SDKs and no in-app purchases.
4. Where your data is stored
Servers, databases, and uploaded photos are hosted in DigitalOcean's Sydney region (syd1, Australia). Stripe, Google, and Twilio may process some data in the United States and the European Union. All transit is over TLS 1.2+; data at rest is encrypted by the respective provider.
5. How long we keep your data
We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy — including managing accounts, resolving disputes, and enforcing our Terms and Conditions — unless a longer retention period is required or permitted by law.
- Active account: for as long as you keep your account.
- Deleted account: your account is deactivated immediately and can be restored by signing in again within 7 days. After that, the account record and personally identifying fields are permanently removed, within 30 days of your request. Bookings are anonymised but retained for tax and dispute records, in line with the ATO's seven-year minimum retention requirement for financial records.
- Aggregate analytics: retained indefinitely in de-identified form.
6. Your rights
- Access & correction. View and edit your profile inside the app, or email us for a full copy of your data.
- Deletion. Delete your account in-app under Profile → Account settings → Delete Account. You can restore the account by signing in again within 7 days; after that, deletion is permanent and cannot be undone. See Delete Your Account for what is deleted and what we must retain.
- Withdraw permissions. Revoke location, push, camera, calendar, or photo-library permissions at any time in your device settings.
- Object to processing. Email us at [email protected] and we will respond within 30 days.
- Complain. Submit a complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you are not satisfied with our response.
7. Children
The Services are not directed at children under 16. If you are under 16, please do not submit personal information through the app. If we learn that we have collected information from a child without verified parental consent, we will delete that information promptly. Where a business asks a minor to complete a consent form for a service, the details and consent of a parent or guardian are required.
8. User-generated content moderation
Customers can leave reviews after a completed booking, and customers and businesses can exchange chat messages. Each review can be reported via the in-app menu or hidden from the user's own feed, and chat participants can block or report the other party. Reports are addressed to [email protected]. We commit to triaging reports of objectionable content within 24 hours and removing material that violates our Terms.
9. Security
We take reasonable administrative, technical, and physical measures to protect the security of your personal information and prevent unauthorised access, disclosure, alteration, or destruction. All client–server traffic is encrypted with TLS. Authentication is backed by Firebase Auth and gated by Firebase App Check. Card data is handled exclusively by Stripe. Internal admin actions are logged and auditable.
No system is perfectly secure. If you believe your account has been compromised, email [email protected] immediately.
10. Changes to this policy
We may update this policy from time to time to reflect changes in our business practices, technology, or legal requirements. The "Last updated" date at the top of the page reflects the latest revision. We will notify you of any material changes by posting the updated policy in our apps or through other appropriate communication channels.
11. Contact
If you have any questions, concerns, or complaints about this Privacy Policy, our data practices, or your privacy rights under Australian law, please contact us at:
MISE Systems Pty Ltd
Sydney, NSW, Australia
Privacy enquiries and complaints: [email protected]
Account and app support: [email protected]