Application Privacy Policy

POPOUT MARKET PTY LTD ("we", "us", or "our") is committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose and store your personal information when you use the Popout Market application and related services.

Where practicable, you may interact with us using a pseudonym, such as a nickname displayed on your public profile.

However, because Popout Market is designed as a secure local marketplace, we require certain identifying information, including a verified phone number and verified suburb, to support user safety, fraud prevention and trusted transactions. For that reason, full anonymity is not available when creating and using an account.

We may collect the following categories of personal information:

• Identity and contact information, such as your name, email address and phone number;
• Account and profile information, including your suburb verification status and profile nickname;
• Marketplace content, such as listing text, listing images, descriptions and chat messages;
• Location information, limited to temporary GPS coordinates used to verify your suburb;
• Technical information, such as IP address, device identifiers, crash logs and app usage diagnostics; and
• Communications and support information, including messages you send to us and records of complaints or support requests.

We collect personal information from two main sources:

• Directly from you, when you create an account, submit listings, upload photos, send messages, contact support or otherwise use the application; and
• Automatically from your device or application use, including technical data collected through our service providers and temporary GPS access used for suburb verification.

To support a local and trusted marketplace, we request GPS access approximately every 30 days for around 10 seconds to verify your suburb.

The GPS coordinates collected for this purpose are used only for suburb verification and are deleted immediately after verification. We retain your verified suburb name, but we do not track or store your location history.

We collect, hold and use personal information for purposes including to:

• provide and operate the Popout Market application;
• create and manage user accounts;
• verify user identity and suburb location;
• facilitate local transactions between users;
• detect, prevent and investigate fraud, misuse and security issues;
• generate, translate and moderate marketplace content;
• communicate with you about your account, transactions or support requests;
• send marketing communications where you have given consent; and
• comply with legal, regulatory and record-keeping obligations.

We use third-party AI service providers, including OpenAI and Anthropic, to support features such as listing generation, translation and content moderation.

Where practicable, we take steps to minimise the personal information sent to those providers. For example, personal identifiers such as phone numbers are removed before content is processed where this is reasonably possible.

We require these providers, under our contractual arrangements, not to use your content to train their general models.

We also use automated systems to help detect fraud and moderate listings. In some cases, these systems may suspend or hide listings that are flagged as suspicious or non-compliant.

If an automated decision significantly affects your account or access to our services, you may request an explanation and human review by contacting privacy@popoutmarket.com.au. We aim to respond within 5 business days.

We will only send you promotional communications where you have given your prior express consent, or where otherwise permitted by law.

You may opt out of marketing communications at any time through the application settings or, where applicable, by replying STOP to an SMS message. We aim to process opt-out requests within 5 business days.

We may disclose personal information to third-party service providers who help us operate the application and deliver our services.

This may include the following overseas recipients:

• Twilio (United States), for SMS one-time password verification using your phone number;
• OpenAI and Anthropic (United States), for processing listing content or chat content used in AI-supported generation, translation or moderation; and
• Supabase, for hosting, database and related infrastructure services. While primary data storage is intended to be located in Sydney, Australia, some support, administration or related service functions may involve overseas access or processing.

We take reasonable steps to ensure overseas recipients handle personal information in a manner consistent with the APPs, including by implementing contractual protections and security safeguards such as encryption in transit and at rest.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

We maintain an incident response process to identify, contain, investigate and remediate security incidents.

If we become aware of an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

We retain personal information only for as long as reasonably necessary for our functions and legal obligations. Our current retention practices include:

• Suburb verification logs: membership duration plus 1 year;
• Transaction and dispute records: 7 years;
• Fraud investigation records: 3 years after closure;
• Chat history: 1 year after exchange; and
• Technical logs (IP address and device identifiers): 90 days.

When personal information is no longer required, we take reasonable steps to delete or de-identify it, unless we are required or authorised by law to retain it.

You may request access to the personal information we hold about you and request correction of inaccurate, incomplete or out-of-date information by contacting privacy@popoutmarket.com.au.

Before actioning certain requests, we may need to verify your identity to protect your privacy and the security of your account.

If you have a privacy complaint, you can contact us at privacy@popoutmarket.com.au.

We aim to acknowledge privacy complaints within 7 business days and provide a substantive response within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) through its website.

We may update this Privacy Policy from time to time.

If we make a material change, we will notify users through the application, by email, or by other appropriate means at least 30 days before the change takes effect, where practicable.

For privacy questions, requests or complaints, please contact:

Privacy Officer
POPOUT MARKET PTY LTD
Email: privacy@popoutmarket.com.au