Legal

Privacy Policy

Last updated: 9 August 2026  ·  Groovo Pty Ltd ABN {{ABN}}

Groovo Pty Ltd (Groovo, we, us, our) is committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy explains how we collect, use, hold, and disclose your personal information when you use our mobile application, website, and services (collectively, the Services).

By using the Services you consent to the practices described in this Privacy Policy.

1. What information we collect

We collect the following categories of personal information:

• Account information: Your name, email address, and a password. Your password is stored only as a salted cryptographic hash by our authentication provider — we cannot read it, and neither can our staff.
• Phone number (optional): You may add a phone number to your profile. It is not required, it is not used to sign in, and we do not send you SMS.
• Transaction information: Orders placed, items purchased, payment method type (card, Apple Pay, Google Pay, Afterpay). We do not store full card numbers — these are handled by Stripe.
• Vehicle information: Vehicle make, colour, and licence plate number, which you provide to help store staff identify your car at the collection bay.
• Notification information: If you enable push notifications, we store a device push token and the platform it belongs to (iOS or Android) so we can tell you when your order is ready. We do not collect advertising identifiers.

We do not collect sensitive information as defined by the Privacy Act (such as health information, racial or ethnic origin, or biometric data).

What we do not collect. We think it is worth being specific:

• No home or delivery address. Groovo is collection-only — you drive to the store and collect from a numbered bay. We have no reason to know where you live and we do not ask.
• No location tracking. The app does not request access to your device location, in the foreground or the background.
• No behavioural analytics. We do not record which screens you view, how long you spend in the app, or what you search for.
• No advertising or tracking identifiers, and no third-party trackers of any kind.

2. How we collect your information

We collect personal information directly from you when you:

• Create an account with your name, email address and password
• Place an order, including the vehicle details you give us for the collection bay
• Contact our support team

Our servers keep operational logs — request timestamps, error records and similar — which are used to keep the Services working and secure. We do not run product analytics.

3. How we use your information

We use your personal information to:

• Create and manage your Groovo account
• Process and fulfil your orders
• Send you order status notifications by push notification
• Process payments via Stripe
• Detect and prevent fraud or security incidents
• Comply with our legal obligations

We will not use your personal information for any purpose that is incompatible with the purposes described above without your consent.

4. Disclosure of your information

We may share your personal information with:

• Partner stores: We share your name, order details, vehicle information, and collection slot with the store fulfilling your order. Stores are contractually required to handle this information in accordance with applicable privacy laws and only for the purpose of fulfilling your order.
• Stripe: Our payment processor. Stripe processes card payments and is PCI DSS compliant. See stripe.com/au/privacy.
• Supabase: Our database and authentication provider. Data is stored on servers located in Sydney, Australia (AWS ap-southeast-2 region).
• Law enforcement or government agencies: Where required by law, court order, or to protect Groovo's rights.

We do not sell your personal information to third parties. We do not share your information for advertising purposes.

5. Data storage and security

Your personal information is stored on servers located in Sydney, Australia. We implement industry-standard security measures including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Row-level security policies ensuring each user can only access their own data
• Passwords stored only as salted cryptographic hashes, never in readable form
• Payment card details handled entirely by Stripe — they never reach our servers

No method of transmission over the internet is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

6. Data retention

We retain your personal information for as long as your account is active or as needed to provide the Services. You may request deletion of your account and associated data at any time (see Section 8 below). We may retain transaction records for up to 7 years to comply with Australian taxation law.

7. Cookies and tracking

Our website is a static site and sets no cookies at all — not for analytics, not for advertising, and not for sessions. Our mobile app does not use cookies. We do not embed third-party trackers, advertising pixels, or social media widgets on any page.

The app stores your sign-in session on your own device using the operating system's secure storage (iOS Keychain / Android Keystore). That never leaves your device except to authenticate you with us.

8. Your rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or out-of-date personal information
• Delete your account and personal information (subject to our legal obligations)
• Opt out of marketing communications at any time
• Complain about a privacy breach

To exercise these rights, contact us at privacy@Groovo.com.au. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Children's privacy

The Services are not directed to children under 16 years of age, and you must be at least 16 to create an account. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected information from a child, contact us at privacy@boota.com.au and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify you via the app or email if the changes are material. Your continued use of the Services after the changes take effect constitutes your acceptance of the updated policy.

11. Contact us

If you have any questions about this Privacy Policy or our privacy practices, please contact our Privacy Officer:

• Email: privacy@Groovo.com.au
• Post: Privacy Officer, Groovo Pty Ltd, Sydney NSW Australia