01Who we are
Spur is a curated last-minute beauty marketplace operating in Sydney, Australia. This policy is published by Spur (ABN 91 305 509 721) (“Spur”, “we”, “us”), of [registered address], Sydney, NSW, Australia. We are committed to handling personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
You can reach us about anything in this policy at hello@usespur.au or +61 431 324 732.
02Who this covers
This single policy covers everyone whose personal information we handle: customers who browse and book, salon and studio partners (and people who apply to become one), and visitors to our site. Where something applies to only one group, we say so.
03What we collect
While Spur is in pre-launch (waitlist phase), we collect only:
- Your email address, and optionally the suburb you tell us, when you join the customer waitlist. We use your suburb to decide which areas to open in first and who to invite to early access.
- Where you choose to opt in, we also record that you agreed to receive marketing messages, the wording you agreed to, and the date and time you agreed.
- Your studio name, suburb, contact details, and the answers you give on the founding-partner application form, if you submit one.
Once Spur launches in spring 2026, we will also collect, where relevant:
- Your name, mobile phone number, and email when you make an account.
- The bookings you make through Spur — date, time, studio, service, and a short booking reference.
- A record that your booking-fee payment succeeded, and limited payment details our processor returns to us (such as the card brand and last four digits and your billing contact). We never see or store your full card number — see section 07.
- Basic device and browser information needed to keep the service working and secure (e.g. session identifiers).
04How we collect it
We collect personal information directly from you — when you join the waitlist, create an account, make a booking, apply to partner, or contact us. We also collect some technical information automatically when you use the site (session and security data).
At or before the time we collect your information we will, where reasonable, make you aware of who we are, why we are collecting it, who we usually share it with (including overseas), and how to access, correct or complain — this policy is the main way we do that. If you don't give us the information we need, we may not be able to provide the service (for example, we can't confirm a booking without a contact detail).
05Why we collect and use it
We use personal information for the purposes you'd expect: to run the waitlist, create and secure your account, take the booking fee, send you booking confirmations, let a studio know who to expect, respond to you, keep the service safe, and improve how Spur works.
We only use your information for these purposes, or a related purpose you'd reasonably expect, unless you agree otherwise or the law requires it. We do not collect personal information to advertise to you on behalf of third parties, and we do not sell your data.
06Who we share it with
When you book, we share the following with the studio so they can prepare for your appointment: your first name, your mobile number, the appointment time, the service you booked, and a short booking reference. We do not share your last name, your email address, or your payment details with the studio.
Under our terms with studios, a studio may use that information only to provide and manage your appointment. Studios must not sell it or disclose it to anyone else, must not use it for their own marketing without your consent, must comply with the Privacy Act 1988 (Cth) and the Spam Act 2003 (Cth), and must tell us within 48 hours of any data breach affecting Spur customers.
We also use trusted service providers to run Spur — our payment processor (Stripe), our hosting provider, and our email and SMS tooling. They may only use your information to provide their service to us, and are bound by contract and confidentiality. Some of them store data overseas — see sections 07 and 08.
We will only disclose your information to law enforcement or government bodies where we are required or authorised by law to do so.
07Payments and Stripe
When you reserve a slot, you pay Spur a small booking fee through Stripe, our payment processor, using Stripe's secure payment fields embedded directly on Spur's own checkout page (we do not redirect you to a third-party checkout). You enter your card details into Stripe's PCI-DSS-compliant fields. Spur does not see or store your full card number.
If you choose to save a card for faster future bookings, it's stored securely by Stripe, our payment processor — never by Spur.
Stripe collects and processes your payment information to charge the booking fee and to detect fraud, and may store and process it on servers outside Australia (including in the United States). Stripe handles this information under its own privacy policy at stripe.com/au/privacy. Spur never receives, processes, or deducts from the price you pay the studio for the service itself — you pay that to the studio directly.
08When information goes overseas
Our hosting, email and SMS providers store and process personal information in Australia. The one exception is our payment processor, Stripe, which may store and process payment information on servers in the United States. [Named providers to be confirmed before launch.]
Where we disclose your personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, and we remain accountable for how those recipients handle it. The only country outside Australia in which a recipient is likely to be located is the United States (Stripe). If that changes, we'll update this section.
09Security
We use standard, industry-accepted practices to protect the information you give us: encrypted transport (HTTPS), restricted internal access, passwordless sign-in, and minimum-necessary data collection. No system is perfectly secure, but we take reasonable steps to protect your information and to destroy or de-identify it when we no longer need it.
10Data breaches
If we suspect a data breach involving your personal information that is likely to result in serious harm, we will assess it promptly — taking all reasonable steps within 30 days — and, if it is an eligible data breach under the Notifiable Data Breaches scheme (Part IIIC, Privacy Act 1988 (Cth)), we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, including the recommended steps you can take.
11Marketing and your choices
Booking confirmations, appointment reminders, and other messages we have to send to run a booking are part of the service, not marketing. We'll only send you marketing emails or SMS — like news about new suburbs — where you've agreed to receive them. Every marketing message identifies us and includes an easy way to opt out, which we'll action promptly. You can change your preferences or unsubscribe at any time, or email hello@usespur.au.
12Cookies and similar tech
Spur uses minimal cookies and local storage: a session token (so you stay signed in) and small flags that remember interface preferences. We do not use advertising cookies, and we don't allow third parties to track you across other sites. If we add analytics, we'll name it here and keep it to privacy-respecting, non-advertising measurement.
13Spur is for adults
You need to be at least 18 to hold a Spur account. Spur isn't intended for under-18s, and we don't knowingly collect their personal information; if you believe we have, contact hello@usespur.au and we'll delete it.
Separately, some listed services are restricted to adults, for example certain skin-penetration and wellness treatments, and are flagged on the slot. The studio verifies age at the appointment.
14Access, correction and complaints
You can ask us to access or correct the personal information we hold about you, or ask us to delete it, by emailing hello@usespur.au. We'll do that except where we're required to retain the information by law (for example tax records), or where we need it for the establishment, exercise or defence of a legal claim — and we'll tell you if that's why. We'll respond as soon as practicable and, in any case, within 30 days, and we won't charge you for making the request. If we can't give you access, we'll explain why and how to take it further.
If you're not satisfied with how we've handled your information or your complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. For complaints about the service itself rather than your privacy, NSW Fair Trading at fairtrading.nsw.gov.au is the right place.
15How long we keep it
We keep personal information only for as long as we need it for the purposes above or to meet our legal obligations, then we destroy or de-identify it. As a guide:
- Waitlist emails — until launch, or until you unsubscribe.
- Account details — while your account is open, then up to 12 months after you close it.
- Booking records — two years, so we can deal with disputes and support requests.
- Payment and tax records — seven years, as Australian tax law requires.
- Partner applications — 12 months if we don't proceed.
You can unsubscribe from the waitlist at any time using the link in our emails; account deletion (post-launch) will be available from your account settings.
16Changes to this policy
If we make material changes to this policy, we will notify everyone with an account by email at least seven days before the changes take effect. Minor changes (typos, formatting) we'll just publish.
17Contact
Questions, concerns, or requests under the Privacy Act, anything at all: hello@usespur.au.
Spur (ABN 91 305 509 721) · Sydney, NSW, Australia.
