How Resvly collects, uses, and protects your personal information
Last updated: 22 October 2026 - priv-v1.5
Resvly is a booking and queue management platform operated from Western Australia, Australia. Business registration is currently in progress. In this Policy, "we", "us" and "our" mean the individual operator responsible for the Platform. The website name does not identify a separate incorporated company. This Policy describes how we handle personal information through https://resvly.com.
This Policy covers the free service available while business registration and payment-service setup are in progress. Only the free Starter subscription is active and all Platform payments are disabled. You can use the currently available features free of charge while payment services are unavailable, subject to the service-change and closure provisions in our Terms. A Provider may separately charge for its own services and handle payment information outside the Platform under its own privacy notice. Before introducing new payment processing, we will update this Policy, explain the relevant recipients and purposes, and obtain any consent or other authorisation required by law.
We determine the purposes and handling of information used for our own account administration, security, support and Platform operations. Providers also make their own decisions about their customers, staff, services and records. Where we process information solely on a Provider instruction, our role may instead be that of a processor or service provider, depending on the arrangement and applicable law.
A Provider or integration operator may have its own privacy notice and responsibilities. This Policy does not replace those notices or authorise them to use your information for unrelated purposes. Where a separate data-processing agreement is required for a Provider arrangement, it must be put in place; this notice alone is not that agreement.
We operate from Australia and make services available internationally. The Australian Privacy Act 1988, Australian Privacy Principles and overseas privacy laws apply to the extent their legal requirements and scope are met. This Policy is not a claim that every privacy law applies to every user, nor a waiver of protections that do apply.
For privacy questions or requests, email [email protected].
Custom fields, booking notes and service choices can reveal health or other sensitive information. Do not submit unnecessary sensitive information. Providers are responsible for explaining why they request it and obtaining any required consent; we also remain responsible for obligations applying to our handling. Contact us before using the Platform for a workflow involving sensitive records or special regulatory requirements.
You can browse public pages without an account, although technical information may still be processed. If you do not provide information needed for an account, booking or queue entry, we may be unable to provide that feature. Optional profile fields and integrations are not required for all uses.
We use information to operate accounts and listings; arrange bookings and queues; provide support; deliver requested notifications; administer free Starter access and feature limits; protect the service; investigate misuse; maintain and improve reliability; and meet legal obligations.
Where EU or UK data-protection law applies, the grounds below depend on the particular activity and our role. A Provider must separately identify the grounds for its own processing. We do not treat agreement to a privacy notice as permission for every use of information.
| Activity | Ground where EU or UK GDPR applies |
|---|---|
| Account, booking, queue and free-plan administration | Performance of a contract with you or steps you request before entering one, where the processing is necessary for that purpose. |
| Security, fraud prevention, support and service reliability | Legitimate interests in protecting users and operating the service, balanced against your rights; legal obligations where applicable. |
| Tax, accounting and responding to lawful requirements | Compliance with an applicable legal obligation, only to the extent the processing is necessary for that obligation. |
| Optional marketing | Consent where required. Any applicable existing-customer exception or other lawful permission must be assessed separately and does not arise simply because an account exists. |
| Optional integrations and AI drafting | Your request and the applicable contract or authorisation; separate consent where required by law. Information about other people requires its own lawful basis. |
| Sensitive information | An applicable additional condition, such as explicit consent where required, as well as a general lawful basis. A standard contract basis alone is not sufficient. |
Booking confirmations, reminders, queue updates, security notices and account messages are used to administer the service. A message that also promotes products or services may be subject to marketing rules even if it includes service information.
Account notification categories currently default to enabled unless you opt out. That default is a preference setting, not proof that you consented to marketing. Marketing must have the consent or other permission required by applicable law. Registration, Google Sign-In, a kiosk visit or a Provider supplying your address does not by itself establish permission for every marketing use.
You can change optional categories in Notification Preferences, use the unsubscribe link in a marketing email without signing in, or contact us. Refusing marketing does not prevent use of the core service. Necessary service and legal messages may continue.
Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Where we rely on legitimate interests, you may object; you may always object to direct marketing. We will not treat publication of a revised policy as fresh consent.
Information is made available to the Provider and authorised staff involved in your booking or queue entry, and to operational suppliers as needed for the relevant feature. Some suppliers process information on instructions; others have independent obligations or purposes. A supplier privacy policy is not a substitute for contractual safeguards where those are required.
Mailjet, Google and other relevant supplier privacy notices describe their own handling. The Stripe notice is relevant to any previous payment activity. Contact us for information about the suppliers relevant to your use. Disabling an integration stops the relevant future connection but does not necessarily remove copies already received by that supplier or by a Provider.
Supplier privacy notices: Stripe, Mailjet, Google, Jitsi Meet, Cloudflare.
We may also disclose information to professional advisers, insurers, regulators or authorities where necessary and lawful, or in connection with a genuine business transfer subject to appropriate safeguards and any required notice. This does not authorise unrestricted disclosure or unrelated marketing.
We do not sell personal information for money or rent contact lists for third-party marketing. Any assessment of "sale" or "sharing" under a particular privacy law must also consider advertising and other enabled technologies; see section 7.
Our Australian operation uses international suppliers, and Providers or integrations you choose may be overseas. Information may be stored, accessed or processed outside Australia and outside your country. Supplier headquarters do not necessarily identify every processing location.
Where Australian cross-border disclosure obligations apply, reasonable steps and applicable exceptions must be assessed before disclosure. Where EU or UK transfer restrictions apply, a valid transfer mechanism and any necessary supplementary safeguards must be in place. Accepting this Policy is not a blanket waiver of those protections.
Different records serve different purposes. Retention depends on account and booking administration, legitimate recordkeeping needs, applicable tax or other laws, security investigations, disputes and legal claims. Information should not be kept merely because storage is available.
For a personal-information deletion request, contact us rather than assuming account closure has erased everything. We will assess the request, explain information that must be retained and why, and take the action required by applicable law. Where information is no longer needed and no legal exception applies, applicable destruction or de-identification obligations remain in force.
You can contact us to request access to your information, correct inaccuracies, ask about its use or retention, request deletion, or raise a concern. We may need proportionate information to verify your identity or authority before releasing or changing records. Do not send identity documents unless we explain why they are needed and how to provide them safely.
Where a Provider independently holds the relevant records, you may also need to contact that Provider. We will explain our role and assist with requests relating to information we handle, as required by law.
Applicable law may provide access, correction, complaint and other rights, subject to exceptions. If we decline a request or need to retain information, we will explain the reason and available complaint options unless the law prevents us doing so. We will not charge a prohibited fee.
Where EU or UK GDPR applies, rights may include access, rectification, erasure, restriction, objection, and portability of eligible information. You may withdraw consent where it is relied upon and complain to the relevant supervisory authority. These rights have conditions and exceptions; the right to object to direct marketing is not conditional on giving a reason.
Where applicable US state privacy law covers our processing, rights may include knowing or accessing information, correction, deletion, portability, and opting out of sale, sharing or targeted advertising. Additional rights may apply to sensitive information, authorised agents and appeals. We will not unlawfully discriminate against you for exercising a privacy right.
The available rights depend on the law and processing involved. Contact us to make a request or ask how it applies; this statement does not represent that every statutory threshold is met.
Send a request to [email protected] or through our contact page. We aim to respond within 30 days and will comply with any applicable legal deadline. EU/UK GDPR requests generally require a response within one month, subject to lawful extensions and procedural rules. We will explain a permitted extension or other delay as required.
We use browser storage and technical processing for authentication, security and saved preferences. Depending on the feature, third-party services can also receive technical information when their scripts or content load.
You can clear or restrict cookies and local storage through your browser, but doing so may affect login, saved preferences or other features. Browser settings and a privacy-policy link do not replace prior consent or other controls where those are legally required. Google advertising settings do not by themselves provide every applicable privacy-law opt-out.
Automated rules help assess bot activity, reject suspicious registration or contact attempts, manage booking capacity, expire reservations and route queue entries. Relevant inputs can include browser/security signals, booking state and queue or availability information. These rules can prevent an action from completing or affect its timing. Contact support if you believe a decision is incorrect or need assistance.
A walk-in kiosk collects the contact details, service selection, notes and configured fields needed to administer the queue. Where no account exists for the supplied email address, the Platform can create one. Providers can also create customer records or bookings on behalf of customers.
The relevant Provider and authorised staff can access the queue or booking information. Operational messaging suppliers and enabled Provider integrations may also receive the information needed for their functions, as described in section 4. The same information is not made available to every business simply because that business uses the Platform.
Providers must explain this collection when obtaining your information and have authority to submit it. Joining a queue does not itself authorise unrelated marketing. Contact the Provider or us if you did not request the record, need a correction, or want to discuss deletion and its effect on an active booking or queue entry.
Measures in the application include password hashing, authenticated access controls, request protections and rate limits. HTTPS protects data in transit where correctly deployed. Security also depends on configuration, access management, operational procedures and the suppliers used; no system is completely secure.
Protect your account credentials and use trusted devices. Providers must appropriately manage staff access and integration credentials. Our obligations for security and lawful handling are not transferred to you by this advice.
If we become aware of a suspected personal-information breach, we will assess and respond to it and notify affected people and regulators where and when applicable law requires. Contact support promptly if you suspect unauthorised access or disclosure.
Support may require information about a problem, but you should never provide passwords, full payment-card details or unnecessary sensitive records.
The Platform is intended for people aged 16 or older who have legal capacity to use it. Children under 16 must not operate their own accounts. A parent or guardian may use their own account to arrange an appropriate Provider service for a child. Provider accounts must be established by an authorised adult.
We do not currently provide a general age-verification or verified parental-consent system. If a Provider needs to process information about a child, it must assess the applicable requirements and ensure its collection is necessary and appropriately authorised. We must also meet obligations applying to our own processing.
If you believe a child has created an account contrary to these rules or that child information has been collected inappropriately, contact us. We will assess the circumstances and take appropriate steps, which may include restricting the account, contacting an authorised guardian, and deleting information where lawful and required.
We may update this Policy to describe changes to the service, our information handling or applicable law. We will show the version and effective date and give appropriate notice of material changes by email or a prominent Platform notice.
A revised notice does not retrospectively authorise a new purpose, remove an existing privacy right, or substitute for consent. Where a change requires consent or another legal step, that requirement applies before the new processing starts.
For privacy questions, requests or complaints, contact [email protected] or use our contact page. These channels reach the operator responsible for this Policy. Describe the concern and the outcome you seek, without including unnecessary sensitive information.
We will consider your complaint, investigate as appropriate and explain our response. We aim to respond within 30 days, subject to any shorter applicable deadline. If more time is needed, we will explain why and the expected next step.
In Australia, you may contact the Office of the Australian Information Commissioner about matters within its jurisdiction. It generally expects you to first complain to the organisation and allow a reasonable opportunity to respond. See OAIC privacy complaints.
Where EU or UK law applies, you may complain to the competent supervisory authority, including the UK Information Commissioner. Users elsewhere may contact the relevant local privacy regulator or pursue other rights available under applicable law. Our internal complaint process does not remove those rights.