Loading page content…
Last updated: 9 October 2026
SpaLedg is operated by SpaLedg (ABN: to be confirmed). SpaLedg is ledger, booking, and payout software built for spas, massage studios, and salons, currently offered as a beta product primarily to businesses in Australia. This policy explains what personal information we collect through the app, why we collect it, and the rights you have over it. It applies to shop owners, staff, and therapists whose accounts are created inside a shop, and — where a shop chooses to store them — the shop's own clients.
Account information: your email address and authentication details. Shop information: shop name, address, phone number, ABN, currency, tax settings, and operating hours. Staff information: therapist names, contact details, wage arrangements, and employment dates entered by the shop owner. Transaction data: sales, tips, discounts, service records, expenses, cash drawer counts, cash movements, and staff payouts. Client information: any customer name, phone number, or appointment details a shop chooses to record. Billing information: subscription status, invoices, and payment method metadata from Stripe (SpaLedg does not store full card numbers). Security and diagnostic information: sign-in activity, rate-limiting records, and an audit trail of changes to financial records, kept to protect your account and investigate disputes.
We use your information to operate the ledger and reports, calculate therapist commissions and wages, synchronise data in real time across devices, authenticate and secure access to your shop's data, process subscription billing and send billing-related notices, respond to support requests, detect and prevent abuse (for example through rate limiting), and maintain an audit trail so financial records can be reviewed or reconstructed if something goes wrong. During the beta period we may also use aggregated, de-identified usage patterns to fix bugs and improve the product.
SpaLedg is built and operated primarily for businesses in Australia and is designed around the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth): we only collect personal information that is reasonably necessary to run the service, we don't sell personal information, and we give you ways to access, correct, or delete it (see below). If you or your clients are located in the European Union or United Kingdom, we rely on performance of a contract and our legitimate interest in running the service as our bases for processing under the GDPR/UK GDPR. SpaLedg does not currently have a dedicated EU or UK representative appointed under Article 27 GDPR; if you operate a business in the EU/UK and this is a compliance requirement for you, please contact us before relying on SpaLedg so we can discuss whether we can meet your requirements.
We share data with the service providers that run SpaLedg on our behalf, and with no one else except as required by law. Supabase provides authentication, database, file storage, and realtime sync, and hosts our production database in the Asia-Pacific (Singapore, ap-southeast-1) region. Stripe processes subscription payments, invoices, payment methods, and customer billing portal sessions, and may process data outside Australia under its own privacy policy. Vercel hosts the application and its edge network. Sentry may receive technical error logs (stack traces and request metadata) to help us diagnose bugs — we configure it to avoid sending full financial records where possible. Each of these providers is contractually restricted to using your data only to provide their service to us; we do not permit them to use it for their own marketing purposes.
Your shop's operational data (sales, expenses, staff, clients, drawer records) is stored in Supabase's Asia-Pacific (Singapore) region as its primary location. Billing data passes through Stripe's global payment infrastructure, and application hosting/edge requests pass through Vercel's global network — both under their own published privacy and security terms. If your business is subject to specific data residency requirements (for example, a requirement that financial data never leave Australia), please contact us before relying on SpaLedg so we can confirm whether our current infrastructure meets that requirement.
We keep account and Business records while the account is active. Not renewing or a failed payment does not request deletion. Before confirming account closure, download, open and securely retain your complete archive and original receipts for your own record-keeping obligations. Account closure starts a 720-hour recovery window. Sign in again and explicitly choose Restore account before the displayed deadline; renewal does not restart. Businesses with other Owners stay open. For closing Businesses, our live-system deletion target is day 37 and ordinary backup expiry target is day 90 from closure. Health or treatment records, unresolved payments, disputes and legal holds require separate review and may delay deletion. We retain minimal closure evidence for two years and SpaLedg subscription billing records for seven years from each underlying transaction; this does not retain the entire shop ledger. Provider failure leaves deletion pending for retry. Backup expiry is verified separately and is not inferred from the recovery deadline. Contact support@spaledg.com for the status or reason for records retained.
You can ask us to access, correct, export, or delete the personal information we hold about your account or your shop, by contacting us using the details below. Under the Australian Privacy Principles you have the right to access and correct your personal information and to make a complaint about how we've handled it; if you're not satisfied with our response, you can escalate a complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If GDPR/UK GDPR applies to you, you additionally have rights to erasure, restriction of processing, data portability, and to object to processing, subject to the exceptions in that law, and you may lodge a complaint with your local supervisory authority. Some financial or billing records may need to be retained even after a deletion request where required by law or by our payment provider's own rules — where that applies, we'll tell you what we're keeping and why.
Data in transit to and from SpaLedg is encrypted (HTTPS/TLS). Shop data is protected by row-level security so that one shop's staff cannot see another shop's records, even though all shops share the same database. Every change to a sale, expense, or daily cash closing is written to an audit log capturing who made the change and what changed. We rate-limit sensitive actions to reduce the risk of automated abuse. No method of transmission or storage is 100% secure, and we can't guarantee absolute security, but we work to keep these protections current as the product matures out of beta.
SpaLedg is a business tool and is not directed at, or knowingly used to collect personal information from, children under the age of 18. If you believe a child has provided us with personal information, please contact us and we will delete it.
SpaLedg uses strictly necessary cookies and local session storage to keep you signed in and to remember basic display preferences. We do not currently use third-party advertising cookies or cross-site tracking.
We may update this Privacy Policy as SpaLedg moves out of beta or as our data practices change. We'll update the "last updated" date above, and where a change is material we'll aim to also notify shop owners by email or an in-app notice.
For privacy questions, or to make an access, correction, export, or deletion request, contact SpaLedg at support@spaledg.com.