Privacy Policy
Last updated: 18 October 2026
This Privacy Policy explains how Ekstra collects, uses, and protects your personal information, in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
1. Scope
This Privacy Policy explains what personal information Ekstra collects, why, and how it's handled. It applies to both client and provider accounts.
2. Information we collect
Account information: your name, email, phone number, date of birth, and (optionally) a profile photo. Your date of birth is asked when you create an account, only to check that you are 18 or over; it is never shown to other users. If you sign in with Apple or Google, we receive the identifier and email address Apple or Google send us. With Apple, we also keep a token Apple gives us, used only to remove the link with Apple when you delete your account. Provider information: for the optional Verified badge, a bio and portfolio photos, if you choose to add them, and — only if you apply — a liability insurance certificate and its details, qualification documents, and any other supporting document you choose to upload. Providers also add a photo of an identity document when they sign up (see Section 5). Providers also give us their ABN and their phone number, which they confirm with a code sent by SMS. Booking information: service address or provider location, requested service, timing, price, and the photos you add to a booking request. What you share in the app: messages with the other person of a booking (a message that seems to contain contact details is held back automatically and kept for our moderation team), reviews and ratings, tips, saved addresses and availability alerts (with their exact point on the map), cutting preferences, and whether you agreed to receive booking reminders. Support: the requests you send to our team, and your appeals. Payment information: handled directly by Stripe, our payment processor — we receive confirmation that a payment succeeded, but we never see or store your full card number. Location data: the address you enter for a booking, and (for providers) a home base location used to match you with nearby clients; we don't track your location continuously in the background. Device information: a push notification token (if you allow notifications) so we can alert you about booking updates, and error reports the app sends when something fails, with personal details removed.
3. How we use your information
We use your information to: create and manage your account; match clients with available providers; process payments and payouts through Stripe; send booking-related notifications (status updates, confirmations, cancellations); send emails about your account and bookings (password reset, booking confirmation, our team's decisions on a provider application or a suspension) through our email provider, Resend; respond to support requests; and detect and prevent fraud or abuse of the platform.
4. Payment processing
Payments, provider payouts, and tips are processed by Stripe, Inc. Stripe is PCI-DSS compliant and handles your payment details under its own privacy policy (stripe.com/privacy). Ekstra's servers never receive or store your full card number.
5. Provider verification documents
Identity at sign-up: the photo of an identity document a provider adds when signing up is stored in our private, access-controlled file store; it is only opened by our team to review the sign-up, every opening is logged, and it is deleted with the account. Identity for the Verified badge: that check (photo ID plus a selfie) is carried out entirely by Stripe Identity, a specialist Stripe service — Ekstra never receives, sees, or stores that document, only the pass/fail result. Insurance, qualifications, and other documents: these are optional, uploaded only if a provider applies for the Verified badge, and are stored in a private, access-controlled file store. They're never shown to clients, are only ever opened by our verification review team to decide on the application, and every time one is opened it's logged (who, and when). To help our team check them, the insurance certificate may be read automatically by an artificial intelligence service (Anthropic), and the business number (ABN) checked against the official Australian register (ABN Lookup). This pre-check only assists our team: it gives an opinion, there is no automated decision, and a person on our team always approves or declines the application. Only the document, your name and the insurance details you declared are sent for this check; the document is not kept anywhere other than our private file store, and under its commercial terms Anthropic does not use this data to train its models.
6. Location data
We use the address you provide for a booking to match you with nearby providers (or clients) and to guide the provider to the right location. When an address is typed without choosing one of the suggestions (see Section 8), and to place a provider's salon on the map, the address text is sent to the Nominatim service of OpenStreetMap (OpenStreetMap Foundation, United Kingdom), without your name or your account. To name the suburb shown when you share an appointment, only an approximate area of about 500 metres is sent, never the exact point. We don't collect or store your device's location in the background, and location data isn't used for advertising.
7. Support chat and AI assistant
When you use the in-app support chat and your question isn't answered by our pre-written FAQ, your message (and recent chat history, to keep context) is sent to a third-party AI service provider (Anthropic, based in the United States) to generate a response. This applies only to messages you send to support — not your bookings, payments, or profile data.
8. Who we share information with
We share the minimum information necessary for a booking to happen: a client's name and service address are shared with the provider they book, and a provider's name, rating, and portfolio are visible to clients browsing for a service. Our servers and database are hosted in Sydney, Australia (Fly.io and Supabase). We share payment information with Stripe (United States) as described above, and push notification tokens, with the text of each notification (which can include the first words of a message), with Expo's notification delivery service (United States) to send you alerts. Emails are sent through Resend (United States) and SMS verification codes through Twilio (United States). When you type an address in the app, the text you type is sent to Google (Google Maps Platform, United States) to suggest addresses and place the one you pick on the map; it is not sent with your name or your account. Addresses typed without choosing a suggestion are placed with OpenStreetMap (see Section 6). We do not sell your personal information to third parties.
9. Overseas disclosure
Some of the service providers we use to run Ekstra — Stripe (payments), Anthropic (support chat fallback and pre-check of verification documents), Google (address suggestions), Resend (emails), Twilio (SMS codes) and Expo (push notifications) — are based in the United States, and the Nominatim service of OpenStreetMap (address placement) is run by the OpenStreetMap Foundation in the United Kingdom; they may process your information there. Before sharing information with an overseas recipient, we take reasonable steps to confirm they handle it under privacy and security standards comparable to Australia's Privacy Act 1988, including relying on their own published security and privacy commitments (see stripe.com/privacy, anthropic.com/privacy and policies.google.com/privacy).
10. Data retention
We keep your information for as long as your account is active, and afterward as needed to satisfy legal, accounting, or fraud-prevention obligations (for example, payment records). If you delete your account (see Section 12), your personal information is anonymized in our systems; some booking records may be retained in anonymized form where deleting them outright would corrupt another user's own booking or review history.
11. Your rights
You can review and update most of your profile information directly in the app (Profile > Edit profile). You can request a copy of your data, or ask us to correct it, by contacting privacy@ekstra.app. You can permanently delete your account at any time from Profile settings, without contacting support — see Section 12.
12. Account deletion
Deleting your account (Profile > Delete account) anonymizes your name, email and phone number, deletes your profile photo, and disables your ability to log in; it is possible once no booking is in progress. Provider-only data — bio, banner and portfolio photos — is deleted the same way, and the identity document photo from sign-up, and any insurance, qualification, or other verification document on file, are permanently deleted from storage. Your date of birth, the link with Sign in with Apple or Google (also removed at Apple), and data with no bearing on another user's records (saved favorites, saved addresses, availability alerts, cutting preferences, photos added to booking requests, SMS verification codes, notification tokens) are deleted outright. Bookings, payments and refunds are kept without your name, for disputes and accounting. This action is permanent and can't be undone.
13. Push notifications
If you allow notifications, we use your device's push token to alert you about booking status changes (confirmed, provider en route, completed, cancelled, tips received, and similar). You can disable notifications at any time in your device settings.
14. Reporting content or another user
If you see a review, photo, or message that seems abusive, inappropriate, or unsafe, use the Report option available on that content, or contact safety@ekstra.app directly. We review reports and may remove content or suspend accounts that violate our Terms of Service.
15. Children's privacy
Ekstra is not intended for anyone under 18. We don't knowingly collect information from children.
16. Security
We use industry-standard measures (encrypted connections, hashed passwords, restricted internal access) to protect your information. No system is 100% secure, and we can't guarantee absolute security.
17. How to complain
If you believe we've mishandled your personal information, contact us first at privacy@ekstra.app so we can try to resolve it directly. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
18. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.
19. Contact
Questions about this Privacy Policy, or requests regarding your personal information, can be sent to privacy@ekstra.app.