HUSL Consumer Privacy Policy

This Privacy Policy explains how HUSL App Pty Ltd (we, us or our) collects, holds, uses and discloses personal information when a consumer interacts with any part of the HUSL ecosystem. This includes our websites (including huslbeauty.com, husl.io and unwritten.hair and any other website we operate), online booking experiences, ecommerce and marketplace services, receipts and communications sent through HUSL, customer support, AI-enabled features, promotions and other services we operate or provide (Services).

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. Depending on how you interact with us, we may collect:

• Identity Data, such as your name, title and pronouns.
• Contact Data, such as billing and delivery addresses, email address and telephone numbers.
• Financial Data, such as payment card information processed by third-party payment processors including Stripe. We do not generally store full card details ourselves.
• Transaction Data, including purchases, refunds, bookings, payments, receipts, commissions or other transaction details connected with our Services.
• Technical and Usage Data, including IP address, login and session data, browser and device information, network information, approximate or precise location where enabled, page views, search activity, acquisition source, cookie identifiers and how you use our Services.
• Profile and Interaction Data, including account information, preferences, support requests, feedback, survey responses, content you submit, messages and other interactions with HUSL or participating hairdressers.
• Marketing and Communications Data, including communication preferences and whether you interact with our marketing.
• Booking and service information, including appointment details and information supplied in connection with a booking or service.
• AI Input and Output Data, including prompts, questions, text, files, photographs, images, audio, metadata or other information you submit to an AI-enabled feature, and the responses, summaries, recommendations, classifications, images or other output generated from that information.
• Inferred Data, including information that an AI-enabled feature may infer or generate from information you provide. AI-generated or inferred information may be inaccurate.
• Sensitive information, which may include health, biometric or other sensitive information if you choose to provide it, including where a photograph or other content reveals sensitive characteristics. We do not require you to provide sensitive information unless reasonably necessary for a Service and, where required by law, we will obtain consent.

• Directly from you, including through purchases, bookings, account registration, forms, customer support, communications and AI-enabled features.
• From hairdressers, salons or other HUSL users where they use HUSL to provide services to you, issue a receipt, manage a booking, communicate with you or fulfil an order.
• Automatically when you use our websites, apps or online services, including through cookies, analytics, device technologies and logs.
• From service providers and business partners, including payment, delivery, analytics, identity, fraud prevention and marketing providers.
• From publicly available sources where permitted by law.

• To provide, operate and improve the Services, including ecommerce, bookings, receipts, customer support, fulfilment, account features and communications.
• To process payments, refunds and transactions and to prevent fraud or misuse.
• To personalise and improve your experience and to understand use of the HUSL ecosystem.
• To provide AI-enabled features, including transmitting relevant inputs to AI service providers, generating outputs, maintaining conversation or feature history where applicable, troubleshooting, quality assurance, security and abuse prevention.
• To contact you about bookings, orders, account activity, service messages and support requests.
• For analytics, research, product development and business operations, including use of aggregated or de-identified information where appropriate.
• For marketing and promotions where permitted by law and in accordance with your communication preferences.
• To comply with law, enforce our terms, protect users and the public, and establish, exercise or defend legal rights.

Some HUSL Services use AI or machine-learning systems to provide features such as conversational assistance, content generation, summaries, recommendations, image analysis or generation, search, categorisation and workflow assistance. We may add, remove or change AI-enabled features over time.

4.1 What may be sent to AI systems

When you choose to use an AI-enabled feature, the information necessary to provide that feature may be sent to one or more AI service providers. This may include personal information, images, files, prompts, prior conversation context and technical metadata. Only provide information that you are authorised to provide. If content contains another person, you should have that person’s permission where required.

4.2 No training of general-purpose models

HUSL does not use personal information submitted through HUSL AI features to train general-purpose AI models. We configure and contract with our AI service providers so that information submitted by HUSL for these Services is not used to train their general-purpose models, to the extent supported by the relevant service arrangements. We may use aggregated, de-identified or operational information to measure, secure, maintain and improve our Services, and we may retain inputs and outputs as described below.

4.3 Retention of AI inputs and outputs

We may retain AI inputs, outputs and associated metadata for as long as reasonably necessary to provide the requested Service, maintain feature or conversation history, operate and improve HUSL, investigate errors or misuse, maintain security, meet record-keeping requirements and comply with law. Retention periods vary by feature and may include backup or audit copies. When personal information is no longer required for a lawful purpose, we will take reasonable steps to destroy or de-identify it, subject to applicable legal requirements.

4.4 AI can be wrong

AI systems are probabilistic and can produce inaccurate, incomplete, misleading, outdated or inappropriate information. AI-generated information may also incorrectly infer information about a person. You should independently check important information and use appropriate professional judgment. HUSL may take reasonable steps to improve accuracy, but does not guarantee that AI outputs are correct, complete or fit for a particular purpose.

We may disclose personal information where reasonably necessary to provide or operate the Services, including to:

• our employees, contractors and related entities;
• cloud hosting, data storage, software, communications, cybersecurity and support providers;
• AI and machine-learning service providers that process information on our behalf to provide AI-enabled features;
• payment providers, including Stripe;
• delivery, logistics and fulfilment providers;
• participating hairdressers, salons and marketplace or brand partners where necessary for a booking, order, fulfilment, commission, support or other requested transaction;
• analytics and advertising providers, including Google and Meta where those services are enabled;
• professional advisers, bankers, auditors and insurers;
• prospective purchasers or participants in a genuine sale, merger, financing or restructuring of our business or assets;
• courts, regulators, law enforcement and other persons where required or authorised by law.

Some of our service providers, including cloud, analytics and AI service providers, may store or process personal information outside Australia. The countries involved may vary depending on the provider and technical infrastructure used. Where the Australian Privacy Principles apply, we take reasonable steps to ensure overseas disclosures are handled in accordance with applicable privacy law.

Where we access information through Google API Services, our use of information received from Google APIs will comply with the Google API Services User Data Policy, including applicable Limited Use requirements. We may also use Google Analytics, Meta technologies and other analytics or advertising tools. We use cookies and similar technologies to operate our Services, remember preferences, understand usage, prevent fraud and support marketing. You can control cookies through your browser or device settings, although disabling some technologies may affect functionality.

We use Google Analytics Advertising Features, including Google signals, remarketing, and demographics and interests reporting. These features use first-party cookies and third-party cookies (such as Google advertising cookies) to measure and improve our marketing and advertising. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, and you can manage how Google uses your information for ads personalisation at adssettings.google.com.

Where enabled, we may collect precise or approximate location information to facilitate delivery, location-based features, security, fraud prevention and other functionality you request. You can control location access through your browser or device settings, but some Services may not function correctly if location access is disabled.

We use reasonable physical, technical and organisational safeguards designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. No internet transmission or storage system can be guaranteed to be completely secure.

• You may request access to personal information we hold about you, subject to permitted exceptions.
• You may request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading.
• You may unsubscribe from marketing using the unsubscribe mechanism in a communication or by contacting us.
• Where practicable, you may deal with us anonymously or using a pseudonym.
• You may complain about our handling of personal information by contacting us. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Our Services may contain links to or integrations with third-party websites and services. Their privacy practices are governed by their own policies. We are not responsible for the privacy practices of third parties except to the extent required by law.

We may amend this Privacy Policy from time to time by publishing an updated version through our Services. We recommend checking the current version periodically. If a change materially affects how we handle personal information, we may provide additional notice where appropriate or required by law.