Privacy Policy

1. About this policy

This policy explains how Bundle (a marketplace operated under the registered business name LETSBUNDLE, ABN 47 119 307 431) ("Bundle", "we", "us", "our") collects, uses, stores and discloses personal information. We are bound by the Privacy Act 1988 (Cth) ("Privacy Act") and the 13 Australian Privacy Principles ("APPs").

We have written this policy in plain English. Where a clause has specific legal weight, we have marked it so.

APP entity:
LETSBUNDLE (registered business name)
ABN: 47 119 307 431
Based in: Sydney, New South Wales, Australia
Privacy contact: hello@letsbundle.online

2. What personal information we collect

We collect only what we need to operate the marketplace and meet our legal obligations.

Account and contact information

• Name, email address, mobile phone number
• Suburb / postcode
• Password (stored as a salted hash, never in plain text)

Listing information (sellers)

• Photos and descriptions of items you list
• Move-out date and address (address is only revealed to a buyer after the deposit is confirmed — see our Terms of Service)
• Item lists, condition notes, asking prices

Buyer activity

• Move-in date and target suburb
• Saved listings, messages with sellers, deposit history

Identity verification information (sensitive information)

To use Bundle you must complete identity verification through a trusted third-party identity verification provider. As part of this process the provider collects and processes:

• A government-issued ID document (e.g. driver's licence or passport)
• A selfie image
• A liveness check

Government-issued identifiers and biometric information are classified as "sensitive information" under the Privacy Act. We treat this information with the higher standard of care that sensitive information requires (APP 3.3). The provider returns to Bundle only a verification outcome (pass/fail) and a verification reference. We do not store the underlying ID document images on our own systems.

Payment information

Payments and deposits are processed by Stripe. Stripe collects and stores card and bank details directly. We receive transaction metadata only (amounts, transaction IDs, status) — we do not see or store full card numbers.

Communications

• Messages exchanged between users on the platform
• Support tickets and correspondence with us
• Marketing communications you have opted into

Technical information

• IP address, device and browser information
• Pages visited, actions taken on the platform
• Cookies and similar technologies (see Section 9)

3. How we collect personal information

We collect personal information:

• Directly from you when you sign up, list items, message users, lodge deposits, or contact support.
• From our identity verification provider when you complete a verification check.
• From Stripe when you complete a payment or deposit transaction.
• Automatically when you use the platform (cookies, analytics, server logs).
• From third parties only where you have authorised it (e.g. signing in via a third-party account, if offered).

If you do not provide the information we ask for, we may not be able to provide some or all of the Bundle service to you.

4. Why we collect personal information

We collect personal information for these purposes:

• To operate the marketplace, including matching sellers with buyers
• To verify your identity and reduce fraud risk
• To process payments and deposits via Stripe
• To facilitate communication between users
• To send transactional emails (account, deposit, dispute updates)
• To send marketing communications, where you have consented (you can opt out at any time)
• To investigate complaints, disputes and suspected misuse
• To meet our legal and regulatory obligations
• To improve the platform (analytics, product research)

We will not use your personal information for any other purpose unless we have your consent or are required or permitted to by law (APP 6).

5. Who we disclose personal information to

We disclose personal information only to:

• Stripe Payments — payment and deposit processing
• Our identity verification provider — to perform identity checks
• Our hosting and infrastructure providers (including Supabase and Vercel) — to host the platform and store data
• Analytics and error-monitoring providers — to understand and improve platform usage
• Other users of the platform — only the information necessary to complete a transaction (e.g. seller suburb to buyers; seller address to a buyer who has confirmed a deposit)
• Professional advisers — accountants, lawyers, insurers, bound by their own confidentiality obligations
• Law enforcement, regulators or courts — where we are required or authorised by law

We do not sell personal information to anyone.

6. Cross-border disclosure

Some of our service providers — including Stripe (payments and identity verification), Vercel and Supabase (hosting), and our analytics providers — store or process personal information outside Australia, including in the United States and the European Union.

By using Bundle you acknowledge that your personal information may be disclosed to these overseas recipients. Before disclosing your information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs, except where an exception in APP 8.2 applies — for example, where you have consented to the disclosure after being informed that APP 8.1 will not apply, or where the disclosure is required or authorised by law.

7. How we secure personal information

We take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification or disclosure (APP 11), including:

• Encryption of data in transit (TLS) and at rest where supported by our infrastructure
• Hashed passwords (never plain text)
• Access controls limiting who can see personal information
• Secure handling of sensitive information by our identity verification provider
• Regular review of access logs and security posture

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at hello@letsbundle.online.

Eligible data breach response

We are bound by the Notifiable Data Breaches scheme. If an eligible data breach occurs we will assess it as soon as practicable (within 30 days as required by law) and, if confirmed, notify affected individuals and the Office of the Australian Information Commissioner ("OAIC") as soon as practicable.

How long we keep your information

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as the law requires (APP 11.2). In practice:

• Identity verification — our provider handles your ID document and selfie; Bundle stores only the verification outcome and a reference, and does not retain the underlying ID or selfie images.
• Account information — kept while your account is open, and for a reasonable period after closure to meet legal, tax, dispute-resolution and fraud-prevention obligations.
• Transaction and dispute records — kept for up to 7 years to meet Australian record-keeping and consumer-law obligations.
• Messages and support correspondence — kept while relevant to operating the platform and resolving disputes, then deleted or de-identified.

When we no longer need personal information and are not required by law to keep it, we take reasonable steps to destroy or de-identify it.

8. Accessing and correcting your personal information

You have the right to:

• Access the personal information we hold about you (APP 12)
• Correct information that is inaccurate, out-of-date, incomplete, irrelevant or misleading (APP 13)
• Delete your account and ask us to delete personal information we are not required by law to retain

To exercise these rights, email hello@letsbundle.online. We will respond within 30 days. We may need to verify your identity before acting on the request.

We may decline access in limited circumstances permitted by the Privacy Act — for example, where giving access would unreasonably affect another person's privacy or reveal commercially sensitive information. If we decline, we will tell you why in writing.

9. Cookies and analytics

We use cookies and similar technologies to:

• Keep you signed in
• Remember your preferences
• Understand how the platform is used (analytics)
• Detect and prevent fraud

You can disable cookies in your browser, but parts of Bundle may not work properly without them.

We use third-party analytics tools to understand how people use Bundle so we can improve your experience. These tools don't capture what you type into forms, and we don't sell your data. Some of this information may be processed overseas.

10. Marketing communications

We will only send you marketing communications where you have opted in or where permitted by the Spam Act 2003 (Cth). Every marketing email includes an unsubscribe link. You can also email hello@letsbundle.online at any time to opt out.

11. Children

Bundle is not intended for use by anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Complaints

If you have a privacy complaint:

1. Email us at hello@letsbundle.online with the subject line "Privacy complaint". Describe the issue and what outcome you are seeking.
2. We will acknowledge within 5 business days and aim to resolve within 30 days.
3. If you are not satisfied with our response, you can lodge a complaint with the OAIC at www.oaic.gov.au or call 1300 363 992.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be notified via email and on the platform at least 14 days before they take effect.

14. Contact

Privacy contact: hello@letsbundle.online
LETSBUNDLE (registered business name)
Sydney, New South Wales, Australia
ABN: 47 119 307 431