Privacy Policy

Last updated: October 2026

Pixel Pundit (ABN 89 110 117 979) ("Parichay", "we", "our", "us") operates the Parichay mobile application ("App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using the App, you consent to the practices described in this policy. If you do not agree, please do not use the App.

1. Information We Collect (APP 3 & 5)

We collect the following personal information:

• Full name and email address (at registration)
• Phone number (optional, for provider contact)
• Suburb and city (for location-based search)
• Profile and portfolio photos (uploaded by providers)
• Booking photos you take with the in-app camera: completion photos and dispute photos. The other party to that booking and our support team can see them.
• Booking details (dates, locations, guest counts, messages)
• Payment information (processed securely by Stripe — we do not store, access, or retain card numbers, CVVs, or full payment credentials)
• Device identifiers, IP address, and usage analytics
• Authentication tokens (via Google or Apple OAuth, if used)

Providers only — verification information:

• Australian Business Number (ABN), checked against the national ABR register
• Identity verification outcome (a government photo ID document and a liveness selfie are submitted by you directly to our verification partner, Didit)

Identity and biometric information is sensitive information under the Privacy Act. We collect it only from providers, only with your consent, and only to verify that you are who you say you are before your listing goes live. Parichay never receives or stores your ID document or your biometric data: Didit collects those directly and returns only a pass/fail result, a session reference, and the date of the check.

We collect personal information directly from you when you register, create a booking, communicate with providers, or contact support. We may also collect information automatically through the App (device type, OS version, crash reports).

If you choose not to provide certain information (such as your phone number), some features may be unavailable or limited.

2. How We Use Your Information (APP 6)

We use your information to:

• Provide, operate, and maintain the Parichay marketplace
• Connect customers with service providers and facilitate bookings
• Process payments (and any refunds) via Stripe
• Send transactional notifications (booking confirmations, updates, reminders, and receipts)
• Respond to support requests and help resolve issues between users
• Verify provider identity and ABN where applicable
• Improve the App experience, fix bugs, and analyse usage patterns
• Detect and prevent fraud, abuse, or security incidents
• Comply with legal obligations, including tax reporting

We will not use your personal information for a purpose other than the primary purpose of collection unless you would reasonably expect the secondary use, you have consented, or it is required or authorised by law (APP 6).

3. Direct Marketing (APP 7)

We may send you promotional communications about new features, providers in your area, or special offers. You can opt out of marketing communications at any time by:

• Using the unsubscribe link in any marketing email
• Contacting us at privacy@parichay.com.au

Opting out of marketing will not affect transactional messages related to your bookings or account security.

4. Third-Party Disclosure (APP 6)

We share your information only with the service providers below, and only the information each one needs:

• Supabase (secure cloud hosting and database) — all App data
• Stripe (payment processing) — your name, email, and payment amounts; providers also complete Stripe's own identity checks to receive payouts. Governed by Stripe's privacy policy
• Didit (provider identity verification) — a reference to your account only; your ID document and liveness selfie go to Didit directly and are never held by us
• Checkify (provider ABN verification) — the ABN you supply
• Anthropic (AI support assistant) — the content of the messages you send in the in-App support chat
• Zoho Desk (support ticketing) — your email address and the contents of any ticket you raise, including dispute details
• OneSignal (push notifications) — a reference to your account and the notification text (service category and booking status; we do not put names in push notifications)
• Resend (email delivery) — your email address
• PostHog (product analytics) — a reference to your account, the screens you view, and key actions such as sending a booking request
• Sentry (crash diagnostics) — error details, device type, OS version, and App version. We do not attach your identity to crash reports
• OpenFreeMap (map tiles): map tiles are provided by OpenFreeMap and delivered through Cloudflare's global network, so your request (including your IP address and the map area you view) is handled by a server near you, which can be in Australia or elsewhere; no account or identifier is sent.
• Apple / Google (authentication, if you use OAuth sign-in)
• Other users as necessary for bookings (e.g., your name and contact details are shared with your booked provider, and vice versa)
• Professional advisers (lawyers, accountants) under confidentiality
• Law enforcement, regulators, or courts when required by Australian law or to protect the safety of our users

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5. Overseas Disclosure (APP 8)

Your data may be stored on servers located outside Australia. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient complies with the APPs or is subject to a substantially similar privacy regime (APP 8). Our overseas recipients are:

• Supabase — United States (hosting and database; SOC 2 Type II)
• Stripe — United States (payments; PCI DSS Level 1)
• Didit — European Union, on Amazon Web Services (provider identity verification, including biometric liveness. The EU is subject to the GDPR, a substantially similar privacy regime)
• Anthropic — United States (AI support assistant)
• OpenRouter and TypeSafe — United States (automated screening of booking chat messages for attempts to move the booking off Parichay. Message text is sent for scoring at the moment you send it; neither vendor is given your name, your account or the booking it belongs to, and we do not use it to train any model)
• OneSignal — United States (push notifications)
• Resend — United States (email delivery)
• PostHog — United States (product analytics)
• Sentry — European Union, Germany (crash diagnostics; GDPR)
• OpenFreeMap, via Cloudflare — a server near you, in Australia or elsewhere (map tiles)
• Apple / Google — United States (authentication, if you use OAuth)

Some of our providers keep your data in Australia and are not overseas recipients: Zoho Desk (support ticketing, Australian data centre) and Checkify (ABN verification, Australia).

By using Parichay, you acknowledge and consent to the transfer of your data to the overseas recipients listed above.

6. Data Security (APP 11)

We protect your data using:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-Level Security (RLS) on all database tables ensuring users can only access their own data
• Supabase infrastructure with SOC 2 Type II compliance
• Secure authentication with bcrypt-hashed passwords
• Regular review of access controls and security configurations
• Secrets and API keys stored in environment variables, never in client-side code

No system is 100% secure. We take reasonable steps as required by APP 11 to protect your data from misuse, interference, loss, and unauthorised access, modification, or disclosure.

7. Data Breach Notification

In accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act, if we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable
• Notify affected individuals, including a description of the breach, the type of information involved, and recommended steps to mitigate potential harm

We maintain an internal data breach response plan and will assess any suspected breach within 30 days of becoming aware of it.

8. Your Rights (APP 12 & 13)

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you (APP 12)
• Request correction of inaccurate, out-of-date, or incomplete information (APP 13)
• Request deletion of your account and all associated data
• Withdraw consent for marketing communications at any time

To exercise these rights:

• Edit your profile directly in the App (name, phone, avatar)
• Use the "Delete account" option on the Profile tab for full account deletion
• Email privacy@parichay.com.au for access requests or corrections

We will respond to access and correction requests within 30 days. If we refuse a request, we will provide written reasons and inform you of your right to complain to the OAIC.

9. Data Retention & Destruction

We retain your personal data for the duration of your active account. When you delete your account:

• Your profile, bookings, messages, reviews, and uploaded photos are permanently deleted, except the booking photos in the next point
• Completion and dispute photos on a booking are kept as dispute records. The other party to that booking and our support team can still see them.
• Payment records may be retained for up to 7 years as required by Australian tax law (Tax Administration Act 1953)
• Anonymised, aggregated data may be retained for analytics

We will take reasonable steps to destroy or de-identify personal information once it is no longer needed for any purpose for which it may be used or disclosed under the APPs (APP 11.2).

10. Cookies & Analytics

The App uses local device storage (Hive) for preferences, caching, and unsent drafts. We do not use third-party tracking cookies.

Product analytics (PostHog) records the screens you view and key actions against a reference to your account, so it is linked to you rather than anonymous. Crash diagnostics (Sentry) records errors, device type, OS and App version, with no identity attached. You can ask us to delete your analytics history at privacy@parichay.com.au.

Our website uses Cloudflare Web Analytics, which is cookieless and does not identify individual visitors.

Third-party services integrated into the App (Stripe, Supabase, Google, Apple, PostHog, Sentry, OneSignal) may use their own cookies or tracking technologies, governed by their respective privacy policies.

11. Children's Privacy

Parichay is not directed at children under 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@parichay.com.au.

12. Complaints (APP 1)

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us:

• Email: privacy@parichay.com.au
• We will acknowledge your complaint within 7 days and provide a response within 30 days

If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

13. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via in-app notification or email at least 14 days before the changes take effect. Continued use of the App after changes constitutes acceptance of the updated policy.

Contact: privacy@parichay.com.au