Applies to indigenoustourism.com.au, operated by Songlines Digital ("we", "us", the "Platform").
1. Who this policy covers
1.1 This policy explains how we collect, hold, use and disclose personal information when you browse the site, book an experience, or apply to list as an Operator.
1.2 Each Operator is an independent business. When you book, you also deal with the Operator, who is separately responsible for information they collect from you directly, for example at check in. This policy covers what we collect through the Platform.
1.3 We comply with the Australian Privacy Principles in the Privacy Act 1988 (Cth) in full, whether or not the small business exemption would otherwise apply to us.
2. Information we collect
2.1 When you book: your name, email address, phone number, the experience, date and number of guests, any notes you choose to add such as dietary or accessibility needs, and whether you ticked the marketing box. Card details are entered into Stripe's payment form and never reach our servers.
2.2 When you join a waitlist or leave a review: your name, email address and what you submit.
2.3 When an Operator applies to list: the business name, ABN, contact details, the owner's name and email address, a description of the business and its cultural authority, photos and artist attributions. We check the ABN against the Australian Business Register.
2.4 Automatically: server logs with your IP address, browser type, pages requested and timestamps, kept for security and fault diagnosis. Cloudflare, which sits in front of the site, also sees this traffic.
3. Why we collect it, and who processes it for us
3.1 We use your information to process your booking, take payment through Stripe, issue your ticket, send booking emails, run waitlists, reviews and store credit, verify Operators, and, only with your consent, send marketing emails.
3.2 These organisations process personal information on our behalf:
| Organisation | What it does | Information involved |
|---|---|---|
| Stripe | Payment processing, with each Operator's own Stripe account receiving the payment | Name, email, amount; card details go to Stripe directly |
| Fly.io | Hosting of the booking system and its database, Sydney region | All booking and application data |
| Cloudflare | Content delivery, caching and protection against attacks | IP address, request logs |
| Postmark | Sending booking, ticket, review and application emails | Name, email, ticket content |
| WorkOS | Sign in for Operator and platform staff | Staff names and email addresses only, no guest data |
| Tigris, through Fly.io | Storage of Operator supplied photos and media | Operator files, not guest information |
| Seeka | Our first party marketing and attribution platform | Name, email and booking context, only where you ticked the marketing box |
3.3 We do not sell personal information. We do not give one Operator the guests of another, and we do not build cross Operator marketing lists.
3.4 Operator listing content is public. It is published on this site and made available to search engines and AI assistants in machine readable form so that travellers can find the experiences. Guest information is never included in any public or machine readable output.
3.5 We may disclose information where the law requires it, to enforce our terms, or to protect the safety of guests, Operators or the public.
4. Marketing consent
4.1 At checkout you can tick a box to receive updates and offers. The box is unticked by default. You must choose to opt in.
4.2 If you opt in, your name, email address and booking context are passed to Seeka so that we and the Operator can send you updates, including a single reminder if you leave a booking unfinished.
4.3 Every marketing email includes a working unsubscribe link, as the Spam Act 2003 (Cth) requires. Unsubscribing takes effect immediately.
4.4 Booking confirmations, tickets, review invitations and waitlist notices are sent regardless, because they relate to a booking you made and are not marketing.
5. Cookies
5.1 The public site runs no analytics, advertising or tracking scripts and sets no tracking cookies.
5.2 Three functional cookies may be set: a Cloudflare security cookie that distinguishes people from automated traffic; a sign in cookie for Operator and platform staff, set only after they sign in; and cookies Stripe sets on the checkout page for fraud prevention, which are governed by Stripe's privacy policy.
5.3 If we add analytics in future we will update this policy first.
6. How long we keep information
6.1 Booking and payment records are kept for seven years after the booking for tax, accounting and dispute purposes, then deleted or de identified.
6.2 Marketing consent and unsubscribe records are kept to show compliance with the Spam Act.
6.3 Operational records are deleted automatically on a nightly schedule: expired checkout holds after 7 days, payment event records after 90 days, sent emails after 180 days and failed emails after one year, marketing hand offs after 90 days, and ABN lookup results after 30 days.
7. Access, correction and complaints
7.1 You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We respond within 30 days.
7.2 If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. Please give us 30 days to resolve the matter first.
8. Indigenous data sovereignty
8.1 Data about Indigenous Operators, their businesses and their guest relationships is not ours to commercialise or control. Our approach follows the Maiam nayri Wingara principles and the CARE Principles for Indigenous Data Governance.
8.2 In practice: each Operator owns the relationship with, and the data about, their own guests, and we process it only to run the booking service. We never aggregate or share guest data across Operators. Operators can ask for an export of their booking data, and for deletion where our retention obligations allow. Cultural and ownership information given to us during verification is used only for that purpose and is not passed on.
9. Security
9.1 Data is stored in Australia, encrypted in transit, in a database that keeps each Operator's records separate from every other Operator's. Access by staff is logged. Card data never reaches our systems.
10. Changes
10.1 We may update this policy. The current version is always on this page with its date. Material changes to how we use information already collected will be announced on the site.
Last updated: 30 October 2026. Version 0.2.