Privacy Policy

Zyly (“we”, “us”) operates a directory and booking platform connecting independent service providers with clients. This policy explains what personal information we collect, how we use it, and the choices you have. By using Zyly you agree to the practices described here.

1. Information we collect

• Account information. When a provider signs up we collect their email address, name, and basic profile details. If you sign in with Google, Facebook, or X (Twitter), we receive your name, email address, and profile picture from that provider.
• Provider profile content. Information you choose to publish on your profile, including byline, services, pricing, location suburb, photos, and availability.
• Phone numbers. Providers verify a mobile number during onboarding. Clients enter a mobile number when making a booking so the provider can confirm the appointment by SMS.
• Bookings. Date, time, selected service, any extras, and the parties involved.
• Payment information. Provider subscription billing is handled by Stripe. We do not store full card details on our servers; Stripe holds the payment data and returns a reference identifier we keep against the account.
• Technical data. Standard server logs (IP address, user agent, timestamps) used for security, abuse prevention, and debugging.

2. How we use information

• To create and authenticate accounts and keep them secure.
• To publish provider profiles and let clients discover and book them.
• To send transactional messages: booking notifications, confirmations, reminders, email receipts, and account alerts.
• To process subscription payments for providers.
• To moderate content (for example, photo review) and enforce our terms.
• To comply with legal obligations and respond to lawful requests.

3. How we share information

We do not sell your personal information. We share it only with the service providers we rely on to operate Zyly, and only to the extent necessary:

• Supabase — database, authentication, and file storage.
• Twilio — SMS delivery and phone-number verification.
• Resend — transactional email delivery.
• Stripe — subscription billing for providers.
• Vercel — application hosting and edge infrastructure.
• Google, Meta, X — only if you choose to sign in with one of these providers.

We may also disclose information when required by law, to protect our rights or the safety of users, or in connection with a business transfer (for example, a merger or sale of assets).

4. Provider profiles are public

Provider profiles — name, byline, services, pricing, location suburb, and approved photos — are intentionally public so clients can find you. Don’t put anything on your profile you wouldn’t want indexed by search engines. Phone numbers and email addresses on file are not shown publicly.

5. SMS and email

We use SMS and email only for transactional messages tied to your account or booking activity. Message content uses fixed templates and never includes free- form notes from other users. You can opt out of SMS reminders by replying STOP; you can opt out of marketing email at any time. Transactional messages required to operate your account or a booking cannot be turned off without closing the account.

6. Cookies and sessions

We use cookies that are strictly necessary to keep you signed in and to remember basic preferences. We do not use third-party advertising cookies.

7. Data retention

We keep account and booking data for as long as your account is active and for a reasonable period afterwards to comply with our legal obligations, resolve disputes, and enforce our terms. You can request deletion of your account at any time (see “Your rights” below).

8. Security

We use industry-standard measures including TLS in transit, row-level access controls in the database, and least-privilege credentials for backend services. No system is perfectly secure; if we become aware of a breach affecting your personal information we will notify you and the relevant authority as required by law.

9. Your rights

You can ask us to access, correct, or delete the personal information we hold about you, and you can withdraw any consent you have given us. Australian users have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Email support@zyly.services with your request and we’ll respond within a reasonable timeframe.

10. Children

Zyly is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11. International transfers

Some of the services we use may process data outside Australia (for example, in the United States or European Union). Where this happens we rely on the contractual and security safeguards offered by those providers.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent version. Material changes will be communicated by email or an in-app notice.

13. Contact

Questions or complaints? Email support@zyly.services.