Privacy Policy

Last updated: 24 October 2026

This policy explains how Celatus Pty Ltd, trading as Bluering Mobile (ABN 95 702 140 501, ACN 702 140 501), handles personal information through our website, enquiries, social channels and phone-service application systems.

Our privacy commitment

We commit to handling personal information in accordance with the Australian Privacy Principles. We intend to voluntarily opt in to coverage under the Privacy Act 1988 (Cth). Our voluntary opt-in registration has not yet been confirmed; this policy does not represent that the OAIC has approved our business or certified our compliance. Any privacy obligations that otherwise apply to our activities continue to apply.

Our website and enquiry channels operate while phone-service payment, identity-checking and activation systems are being prepared and tested. Tests use fictional information. The sections below distinguish those activities from the handling required when a customer applies for a service.

What we collect and how

• Enquiries and support: your name, email address, optional phone number, message, correspondence and information needed to resolve your enquiry. We collect these directly through forms, email or social messages.
• Website operation: network and technical information such as IP address, browser, request time and security events processed by our hosting and security services. On the private test site, access controls also process authorised testers’ sign-in details.
• Service applications: when enabled, name, date of birth, residential address, contact details, selected plan, account and service records, payment references, consent and verification outcomes. Identity verification is required before activation. We provide a collection notice and seek separate consent for verification.
• Payments: the selected payment provider collects payment credentials in its hosted checkout. Bluering receives necessary transaction, billing, refund and provider references; our checkout does not collect full payment-card numbers or security codes.
• Instagram: your username, public profile information and messages or comments you choose to send to our business account. Our contact page offers a click-to-load public Instagram embed. We obtain embed HTML and basic metadata for a selected public post through Meta’s oEmbed endpoint and serve that markup with our website. Clicking “Load Instagram post” loads Meta’s script and embedded content; Meta receives your IP address, browser information and any applicable cookies under its own privacy policy. No Instagram embed request is made from your browser before you choose to load it. We do not retrieve private messages, follower lists or follower counts through this embed.

You can make a general enquiry without giving your legal name where practical. We need a working reply address to answer a form submission. Account-specific assistance and service applications may require identification. Please do not send passwords, full payment details or identity documents through the contact form, ordinary email or Instagram.

Why we use information

We use information to answer enquiries, provide support, assess and administer service applications, process payments and refunds, meet applicable phone-service obligations, prevent misuse, maintain security, resolve complaints and keep necessary business records. We do not sell personal information or use Instagram information to build unrelated marketing profiles.

Optional measurement and marketing choices are separate from essential website operation and service consent. Optional analytics is not enabled merely by visiting the site. Where available, use the footer privacy settings to change your choices. Essential security and preference storage may still operate.

Identity checks and automated results

Planned document checks

Live document verification and phone-service activation are not yet available. Current identity-system tests use fictional details. The following collection information describes the planned document-check process; it does not mean that Bluering has been granted live access or Business User accreditation.

This document explains how Celatus Pty Ltd trading as Bluering Mobile (ABN 95 702 140 501, ACN 702 140 501) (we, us, our) will collect, use, disclose and store your personal information to verify your identity document(s) using the Attorney-General’s Department’s Document Verification Service (DVS). This will only occur with your express consent.

The information you provide will be sent to the DVS Hub, administered by the Attorney-General’s Department, and matched against official records held by the government agency responsible for issuing the identity document (document issuer).

The DVS Hub will advise us of whether the information you provide matches official records.

The DVS Hub facilitates information transfer between us and the document issuer. The DVS Hub itself does not retain any personal information and the Attorney-General’s Department cannot view or edit any of the personal information transmitted through the DVS Hub.

Our selected intermediary is Mobile Business Devices Pty Ltd trading as One Click Services. Read the One Click Privacy Policy and the Attorney-General’s Department’s Identity Verification Services Privacy Statement for information about their handling and the operation of the service. Document issuers handle their own official records under their privacy policies and legal obligations.

We collect the customer information needed to meet applicable telecommunications identity-checking obligations under the Telecommunications Act 1997 (Cth) and the Telecommunications (Service Provider — Identity Checks for Prepaid Mobile Carriage Services) Determination 2017, where applicable to the service. Participation in identity verification also carries obligations under the Identity Verification Services Act 2023 (Cth) and the participation agreement, including applicable privacy and consent requirements. These obligations do not replace your separate express consent to a document check.

Consent and your choices

We show the collection notice and request a separate, unchecked consent before sending document details. We record the wording/version and your consent before initiating a request.

You can decline a document check, correct your details, dispute a result or contact support about an accepted alternative and accessible assistance. Where an accepted bank-based method is available, it requires its own explanation and separate consent; it is not enabled by agreeing to a document check. We do not ask for your bank password. If an accepted identity check cannot be completed, we cannot activate your service. Review the cancellation and refund information supplied before purchase, or contact support for assistance.

Records and review

We retain necessary customer information and limited consent, method, time, actual provider reference, outcome and review evidence. We do not retain passport, driver licence or card numbers, document images, selfies or raw verification payloads in our customer archive. The document-check flow uses typed details, without document uploads or selfies. We do not use verification details or results for marketing, market research or profiling. Payment providers handle payment credentials separately.

Matching systems may return a match, mismatch or unavailable result. Application software uses these outcomes to control progression; a mismatch, unavailable check or unaccepted alternative cannot activate a service. A check result alone does not mean your number is ready. A document match does not verify your current residential address. Contact support for human review, correction or a privacy complaint. Our identity collection notice is available before you submit details; access, correction, deletion and complaint options are explained below.

Service providers and disclosures

We disclose only information reasonably needed for the relevant purpose to providers supporting hosting, security, email, payment processing, identity checking and service delivery, and to professional advisers or authorities where authorised or required. Current and selected providers include:

• Cloudflare: website delivery, security, private-test access controls, email routing and form-message delivery.
• Google Gmail and SMTP2GO: receiving business enquiries and sending human email replies. Business mail is currently forwarded into an owner-operated Gmail inbox; access and retention must remain limited to business needs.
• Amazon Web Services: the separate Australian sandbox backend and encrypted backup storage in Sydney. The selected future production hosting provider is BinaryLane in Sydney; this does not mean production hosting is already operating.
• Stripe and PayPal: payment processing when that method is used. Current integration testing uses sandbox transactions.
• One Click Services: identity checking when enabled and separately consented to.
• Meta/Instagram and Ringotel: interactions on Instagram and use of the Ringotel app are also subject to those providers’ privacy information. Ordinary outbound links do not load embeds; our contact-page embed connects to Meta only when you choose to load it.

We will identify the relevant carriage supplier and any additional recipients in the information supplied before live service collection. We do not put identity-document fields or raw identity results into ordinary enquiry email, marketing or website analytics.

Overseas handling

Some providers operate internationally. Information may be processed or accessed outside Australia, including in the United States through Cloudflare, Google, Meta and payment providers; New Zealand through SMTP2GO; and Ireland through Ringotel. Providers may use additional international infrastructure and support teams. Australian storage for our sandbox and backups does not mean that every provider or support person is in Australia. These are identified provider locations, not a promise that processing is limited to those countries. Before enabling new service or identity-data flows, we must assess relevant overseas recipients and give updated collection information.

Security and retention

We use restricted access, protected administration, encryption where implemented, and security and recovery procedures appropriate to the information. Our sandbox customer profiles and backups are encrypted, with restricted access, audit controls and documented recovery procedures. No system is immune from misuse or a security incident. We assess incidents and notify affected people and authorities when required.

The public contact form sends your message through Cloudflare to our business email. Cloudflare Turnstile provides an anti-spam check when you interact with the form, processing technical and security information. The handler uses a temporary hashed IP-based rate-limit key to control abuse; message bodies are not saved in website storage or application logs. Our separate private-test form remains access-restricted. Email correspondence remains in the receiving mailbox and is reviewed for deletion when it is no longer needed. A support request does not automatically attract a seven-year retention period.

Our selected service-record schedule retains necessary account, consent and verification evidence throughout active service and for seven years after closure or final dispute resolution, whichever is later. Financial records use seven years after transaction completion, or longer when required. This is a schedule for necessary evidence, not permission to keep every field or an archive of identity documents. Temporary recovery and delivery information has shorter operational lifetimes. We review necessity, legal obligations and holds before deleting or de-identifying information.

Deletion is handled through reviewed requests; we do not promise that automated retention deletion is already enabled. Backup copies may persist until their applicable expiry or required retention period. Restored information must have applicable deletion restrictions reapplied before use.

Access, correction and deletion

Contact our Privacy Officer to ask what information we hold, request a copy, correct inaccurate information or request deletion. We will verify your authority proportionately, explain any information we need to locate the record, and respond within a reasonable period. If we cannot grant all or part of a request, we will explain the reason and available complaint options. We do not charge to make a request; any permitted access charge will be explained before proceeding.

See our data-deletion instructions for the email process, including Instagram-related requests. Deleting Bluering-held data does not delete your Instagram account or information held independently by Meta or another provider. We may need to retain limited records for legal, accounting, service, security or dispute purposes.

Privacy complaints

Email support@bluering.mobile with the subject “Privacy complaint”. Explain your concern and preferred safe reply method. We will acknowledge the complaint, investigate relevant records and respond with our findings and proposed resolution. We aim to respond within 30 days; if more time is needed, we will explain why and provide an update.

If you are dissatisfied, you can contact the Office of the Australian Information Commissioner for advice about available complaint options and its jurisdiction. This does not limit other rights or complaint avenues available to you.

Contact and policy updates

Privacy Officer, Celatus Pty Ltd trading as Bluering Mobile
Email: support@bluering.mobile
Post: PO Box 5044, Pacific Pines QLD 4211, Australia
Registered office: 16 Matthew St, Stanthorpe QLD 4380, Australia.

Contact us for an accessible copy of this policy. We update it when our handling changes and show the revision date above. Where a change requires notice or fresh consent, we will provide it before the relevant collection or use.