Effective 7 September 2026
Privacy Policy
How Thyme HQ handles account, workforce, operational, reservation, authentication, payment, and cookie data.
1. Scope, roles, and contact
Thyme HQ provides hospitality workforce, operations, subscription, and dining reservation tools. This policy covers information used when you visit our website, create or use an account, join a workspace, contact us, subscribe, or use a public booking page. Thyme HQ, ABN 81 932 315 481, is registered at 4 Russell St, Evandale, Tasmania, Australia 7212. For staff, applicant, workplace, guest, and reservation information entered into a customer workspace, the hospitality business normally determines the purposes and means of processing; Thyme HQ acts as its service provider or processor on documented instructions, except for security, legal compliance, billing, or legal claims.
2. Information we collect
Depending on how Thyme HQ is used, we collect account and contact details; mobile launch notification email addresses and consent records; staff and workplace information entered by a business; guest and reservation details; operational records; subscription and transaction details; authentication, device, and technical data; and communications and support information you send to us. We do not store full payment-card details.
3. Sources, purposes, and legal grounds
We receive information from account holders, guests, managers and authorised staff, mobile launch waitlist signups, staff invitation and public booking flows, use of the service, and authentication and payment providers. We use it to secure accounts, deliver features, send requested mobile launch notices and invitations, administer subscriptions and payments, provide support, prevent fraud and misuse, improve the service, and meet legal obligations. Mobile launch email addresses are used for that requested notification on the basis of consent, which can be withdrawn by contacting us. Other applicable grounds include contract performance, legitimate interests, legal obligations, and a customer business’s instructions and lawful basis.
4. Customer responsibilities
Customer businesses are responsible for giving staff and guests required privacy notices, having a lawful basis for collection and use, setting appropriate access permissions, responding to requests about their records, and complying with applicable laws. Guests should not include sensitive information in a public booking unless it is necessary and lawful for the hospitality service.
5. Service providers and disclosures
We disclose information only as needed to operate Thyme HQ. Providers include Clerk for authentication, identity verification, and session management; Stripe for checkout, payment methods, subscriptions, invoices, and fraud checks; and hosting, database, infrastructure, security, and support providers. We may also disclose information when required by law, to protect rights and safety, investigate misuse, or in connection with a financing, merger, reorganisation, or sale. We do not sell personal information or share it for cross-context behavioural advertising.
6. International processing, cookies, and security
Providers may process information outside the country where you live. Where required, we use contractual or other safeguards intended to protect international transfers. Thyme HQ uses essential cookies and local storage for secure sign-in, sessions, checkout, interface preferences, and remembering the cookie notice. We use reasonable administrative, technical, and organisational safeguards, but no system is completely secure.
7. Retention and anonymisation
We retain personal information only as long as needed for the purposes described here, including legal, tax, accounting, workforce-record, security, fraud-prevention, backup, and dispute-resolution requirements. While a workplace account remains active, schedules and their supporting staff assignments, shifts, clock records, and break records are retained for at least seven years, and managers can export individual schedules as PDF or CSV. Deleting the workplace account removes those records. Inactive staff profile data not needed for a retained schedule is normally de-identified after 90 consecutive days. Our other current defaults are to delete or de-identify cancelled reservation or no-show guest data after 90 days and anonymise other guest reservation data after 12 months, subject to documented customer instructions and legal obligations.
8. Security incidents
If we confirm a security incident involving customer workspace personal information, Thyme HQ will investigate, take reasonable containment and remediation steps, and notify the affected customer without undue delay. The customer is responsible for deciding whether to notify staff, guests, regulators, or others unless law requires us to notify directly.
9. Your rights and complaints
Subject to applicable law, you may ask to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, or request review of certain automated decisions. We may verify identity and may refuse or limit a request where law permits. Staff and guests should first contact the hospitality business that controls their records. Australian users may complain to the Office of the Australian Information Commissioner, New Zealand users to the Privacy Commissioner, and UK users to the Information Commissioner’s Office where applicable.
10. Children and changes
Thyme HQ accounts are not intended for children. Public booking pages are for people legally able to make a reservation or acting with a parent or guardian. We may update this policy for changes to Thyme HQ, providers, or legal requirements and will post an updated effective date and provide additional notice where required.
11. Contact
The operator and privacy contact is Thyme HQ, ABN 81 932 315 481, registered at 4 Russell St, Evandale, Tasmania, Australia 7212. Email admin@thymehq.app.