Privacy Policy

Last updated: June 2026

Pixel Pundit (ABN 89 110 117 979) ("Parichay", "we", "our", "us") operates the Parichay mobile application ("App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using the App, you consent to the practices described in this policy. If you do not agree, please do not use the App.

1. Information We Collect (APP 3 & 5)

We collect the following personal information:

• Full name and email address (at registration)
• Phone number (optional, for provider contact)
• Suburb and city (for location-based search)
• Profile and portfolio photos (uploaded by providers)
• Booking details (dates, locations, guest counts, messages)
• Payment information (processed securely by Stripe — we do not store, access, or retain card numbers, CVVs, or full payment credentials)
• Device identifiers, IP address, and usage analytics
• Authentication tokens (via Google or Apple OAuth, if used)

We collect personal information directly from you when you register, create a booking, communicate with providers, or contact support. We may also collect information automatically through the App (device type, OS version, crash reports).

If you choose not to provide certain information (such as your phone number), some features may be unavailable or limited.

2. How We Use Your Information (APP 6)

We use your information to:

• Provide, operate, and maintain the Parichay marketplace
• Connect customers with service providers and facilitate bookings
• Process payments and refunds via Stripe
• Send transactional notifications (booking confirmations, updates, reminders, and receipts)
• Respond to support requests and resolve disputes
• Verify provider identity and ABN where applicable
• Improve the App experience, fix bugs, and analyse usage patterns
• Detect and prevent fraud, abuse, or security incidents
• Comply with legal obligations, including tax reporting

We will not use your personal information for a purpose other than the primary purpose of collection unless you would reasonably expect the secondary use, you have consented, or it is required or authorised by law (APP 6).

3. Direct Marketing (APP 7)

We may send you promotional communications about new features, providers in your area, or special offers. You can opt out of marketing communications at any time by:

• Using the unsubscribe link in any marketing email
• Contacting us at privacy@parichay.com.au

Opting out of marketing will not affect transactional messages related to your bookings or account security.

4. Third-Party Disclosure (APP 6)

We share your information only with:

• Stripe (payment processing — governed by Stripe's privacy policy)
• Supabase (secure cloud hosting and database infrastructure)
• Apple / Google (authentication, if you use OAuth sign-in)
• Other users as necessary for bookings (e.g., your name and contact details are shared with your booked provider, and vice versa)
• Professional advisers (lawyers, accountants) under confidentiality
• Law enforcement, regulators, or courts when required by Australian law or to protect the safety of our users

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5. Overseas Disclosure (APP 8)

Your data may be stored on servers located outside Australia, including in the United States (Supabase infrastructure) and other jurisdictions where our service providers operate.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient complies with the APPs or is subject to a substantially similar privacy regime (APP 8). Our key overseas service providers:

• Supabase Inc. — United States (SOC 2 Type II compliant)
• Stripe Inc. — United States (PCI DSS Level 1 certified)

By using Parichay, you acknowledge and consent to the transfer of your data to these overseas recipients.

6. Data Security (APP 11)

We protect your data using:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-Level Security (RLS) on all database tables ensuring users can only access their own data
• Supabase infrastructure with SOC 2 Type II compliance
• Secure authentication with bcrypt-hashed passwords
• Regular review of access controls and security configurations
• Secrets and API keys stored in environment variables, never in client-side code

No system is 100% secure. We take reasonable steps as required by APP 11 to protect your data from misuse, interference, loss, and unauthorised access, modification, or disclosure.

7. Data Breach Notification

In accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act, if we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable
• Notify affected individuals, including a description of the breach, the type of information involved, and recommended steps to mitigate potential harm

We maintain an internal data breach response plan and will assess any suspected breach within 30 days of becoming aware of it.

8. Your Rights (APP 12 & 13)

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you (APP 12)
• Request correction of inaccurate, out-of-date, or incomplete information (APP 13)
• Request deletion of your account and all associated data
• Withdraw consent for marketing communications at any time

To exercise these rights:

• Edit your profile directly in the App (name, phone, avatar)
• Use the "Delete Account" option in Settings for full account deletion
• Email privacy@parichay.com.au for access requests or corrections

We will respond to access and correction requests within 30 days. If we refuse a request, we will provide written reasons and inform you of your right to complain to the OAIC.

9. Data Retention & Destruction

We retain your personal data for the duration of your active account. When you delete your account:

• Your profile, bookings, messages, reviews, and uploaded photos are permanently deleted
• Payment records may be retained for up to 7 years as required by Australian tax law (Tax Administration Act 1953)
• Anonymised, aggregated data may be retained for analytics

We will take reasonable steps to destroy or de-identify personal information once it is no longer needed for any purpose for which it may be used or disclosed under the APPs (APP 11.2).

10. Cookies & Analytics

The App uses local device storage (Hive) for preferences and caching. We do not use third-party tracking cookies. Analytics data is collected in aggregate form to improve App performance and user experience.

Third-party services integrated into the App (Stripe, Supabase, Google, Apple) may use their own cookies or tracking technologies, governed by their respective privacy policies.

11. Children's Privacy

Parichay is not directed at children under 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@parichay.com.au.

12. Complaints (APP 1)

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us:

• Email: privacy@parichay.com.au
• We will acknowledge your complaint within 7 days and provide a response within 30 days

If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

13. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via in-app notification or email at least 14 days before the changes take effect. Continued use of the App after changes constitutes acceptance of the updated policy.

Contact: privacy@parichay.com.au