Privacy Policy

1. What we collect

We collect only what the product asks for, plus records the service creates.

• Account. First name, email, phone, and a password held by our auth provider as a hash. Last name is optional. When you agree at sign up, we store the terms version, the privacy policy version, the time you agreed, and your account. When you create a workspace, we store the same acceptance against that workspace.
• Workspace. Business or organisation name, kind, street address, suburb, postcode, contact email, phone, optional ABN or ACN, and whether you have told us you are GST registered. Member names, emails, and roles. Invite emails.
• Events. Title, dates and times, suburb, state, postcode, and, once a booking has started, street address and site access notes. Guest counts, children counts, and age ranges. Coordinator notes and files you upload. Budget figures stay with the organiser workspace. We do not have a field for a child’s name. Do not put children’s names, photos, or parent contacts in notes or files unless you have authority and a real need.
• Vendor profile. Trading name, description, base suburb, categories, experience descriptions, prices, GST price setting, travel settings, availability, photos, and compliance files you choose to upload (including working with children checks and insurance). A published profile and its experience pages can be viewed without an account. Those pages show the listing. They do not show another organiser’s event, quote, or booking. Labels such as a Working with Children Check are the vendor’s own statement.
• Bookings and quotes. The request, the quote text, amounts, status changes, and messages sent inside SAME.
• Subscriptions. Stripe customer and subscription identifiers, plan, price, renewal date, and invoice status. Card numbers are entered on Stripe’s page. We do not receive or store full card numbers.
• Booking payments. We do not collect card details for an event booking. If you mark a booking paid, we store that status, the amount on the booking record, and who marked it. We do not store bank account numbers for that payment.
• Support. In-app support cases and the messages on them, and emails you send us. Audit records of live status changes, billing events, and terms acceptance.
• Technical. Session cookies that keep you signed in, a workspace cookie (same_workspace_id, about 30 days) that remembers which workspace you last used, and browser storage for your theme and for an event draft that has not been saved yet. If you allow browser notifications, we store the push subscription for that browser. An organisation workspace that turns on calendar sync gets a secret feed link. Anyone with that link can read the calendar it exposes. Cloudflare Turnstile checks sign in, sign up, and password reset. That check can include your IP address and browser signals, and we use the result only to allow or block that request. Vercel Speed Insights measures page speed. It is not advertising. We do not run advertising cookies or a separate product analytics suite. Error monitoring with Sentry sends a report only when this deployment has a Sentry address configured. A report can include the page and a technical message. It does not include a card number, your name, or your email.

2. How we use it

• Create your account, show the right workspace, and deliver requests, quotes, and bookings.
• Show suburb before a booking, and reveal address and direct contact only after a booking has started.
• Charge the workspace subscription, send renewal and failed payment notices, and keep a tax record.
• Store compliance files the vendor uploaded, and suspend misuse. Badges are self-declared until a review workflow exists.
• Send service email, diagnose errors, and back up the database.
• If you set an event to open quotes, notify vendors whose category and service area fit that event. The match uses event date, category, and location. It does not score or rank a person.

Service email includes booking updates, quote notices, password resets, subscription renewal reminders, cancellation notices, and failed payment notices. That email is part of the product. We do not send marketing email unless you have separately agreed, and any marketing email will include an unsubscribe.

We do not use personal information to make a decision that grants or refuses credit, insurance, employment, or access to an essential service by automated means.

3. Who else sees it

The other party to a job. An organiser sees the vendor profile and, after a booking has started, the vendor’s direct phone and email. A vendor on a request sees the event brief. Street address, site access notes, and full direct contact stay masked until a booking has started. A revealed phone or email is shown for a short time (about 10 minutes) and can be revealed again by someone allowed to see it.

People in your workspace see workspace records according to their role.

SAME staff with an admin role can see records for support, a safety issue, or a billing problem. Actions that change a live record are written to an audit log.

Processors handle information only to provide their service to us.

SMS is not on. If we turn on SMS later, we will name the provider here before we send any.

Some of these providers may process information outside Australia, including in the United States. We use their contracted services to run SAME. We do not authorise them to use organiser or vendor information for their own marketing.

We may disclose information if the law requires it, or if we reasonably believe it is needed to prevent serious harm.

4. Security

Access to event and vendor records is restricted by account and workspace. Files are stored in private buckets unless a photo is deliberately public on a vendor listing. Payment card data for subscriptions stays with Stripe.

No internet service is perfectly secure. If we have reason to believe a breach is likely to cause serious harm, we will tell the people affected and, where the Notifiable Data Breaches scheme applies to us, the Office of the Australian Information Commissioner.

5. Keeping information

We keep account, booking, quote, subscription, and terms acceptance records for as long as the workspace is open, and then for as long as we need them for tax, disputes, and the other party’s record. Subscription and payment audit records are kept for at least 5 years.

Compliance files stay until the vendor removes them or the workspace closes, and longer if a booking that relied on them is still in dispute.

You may ask us to delete your account by emailing hello@same.events. There is no delete button in the product yet. We will delete or de-identify what we can. We will keep what we still need for a booking the other party relies on, for tax, or because the law requires it. We will tell you if we refuse a deletion request, and why.

6. Access and correction

You can correct most account and workspace details in the product. For anything else, email hello@same.events. We will respond within 30 days. If we refuse, we will say why unless the law allows us not to.

7. Complaints

Email hello@same.events. We will acknowledge within 5 business days and aim to resolve the complaint within 30 days.

If you are not satisfied, and the Privacy Act applies to us, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

8. Changes

We will update this page when our practices change, and we will email workspace owners if a change is material. The effective date at the top is the date this version starts. The version you accept at sign up is stored with your account.

9. Contact

SAME Events
hello@same.events

The contract for using SAME is in the Terms of Use.