Private by design, from the first request.

What BelleTime collects

Only what the private request journey needs.

The request journey collects one email address, the selected provider, appointment type, time and incall or outcall mode, plus the versions and time of the required collection, sensitive-information and request acknowledgements. Stripe separately handles payment of BelleTime's A$19 booking fee; card details are entered with Stripe.

An adult-service appointment request can reveal sensitive personal information. BelleTime asks for a separate sensitive-information acknowledgement before the request can be submitted.

Purpose and disclosure

Inbox control, discreet updates and private access recovery.

BelleTime uses the email to verify control of the inbox, send a discreet alert when the request status changes and, if the private access code is lost, verify that same original inbox before replacing the code. The alert contains no provider, appointment, price, location or request-reference details. A provider receives the selected request details but not the raw email address.

After a completed or missed appointment, the provider may record a private rating and fixed feedback tags, such as “on time” or “arrived late”. BelleTime links this feedback to a one-way code made from the verified email, not to the email itself. For up to 24 months, other providers who receive a request from the same email see only the combined ratings and tags — never the provider’s private note, who wrote the feedback, or the email. Privacy access and correction requests about this feedback can be made to support.

The selected purpose does not authorise marketing, tracking, SMS, a direct provider-contact channel or unrelated use. The private status page still requires the guest’s saved request details, and a recovery response does not reveal whether a request reference or email exists.

Protection and retention

Encrypted contact, hashed codes and bounded access.

The design encrypts the email separately, decrypts it only at an authorised email-delivery boundary, stores verification and private-access codes only as cryptographic evidence, limits repeated attempts and keeps raw contact data out of provider views, URLs and audit records. A successful recovery replaces the former private access code rather than retrieving it.

Unused guest contact records become eligible for deletion after 24 hours. An active request, confirmed appointment or lawful hold delays deletion. Once the retention period has passed and no such reason remains, scheduled cleanup removes the encrypted email and its encryption metadata. Booking, acknowledgement, payment and audit records are separate; deleting the email does not delete the financial history.

Netlify hosts the application and its Sydney database, Resend delivers verification, recovery and status emails, and Stripe processes BelleTime's booking fee. These suppliers may process information outside Australia. Authorised BelleTime staff can access the information needed for support, privacy requests and operational or legal review; provider views do not disclose the raw guest email.

Choice and support

No request without the required acknowledgement.

A guest can choose not to continue. The request is not created until the verification and separate acknowledgements are completed. Mandatory privacy rights and legally required access or correction processes are not excluded.

For privacy questions, access or correction requests, or a complaint, contact support@belletime.com.au. Founder and managing staff monitor support from 9:00 am to 4:00 pm Monday–Saturday, Australia/Brisbane. Do not email verification codes, private access codes, card details or identity documents.