Release summary: Seller and payment-loss responsibility; annual liability caps and conditional Australian Consumer Law remedies; contracting identity; eligible payment channels; closure and credit deadlines; material provider changes.
1 Who we are
BusinessThing is operated by Joseph Jack Nutt trading as HumanKindly, ABN 93 140 434 991. Contact humankindlytech@gmail.com, or write to 28 Godfrey St, Port Adelaide SA 5015, Australia, for privacy questions, requests and complaints.
We provide operational software to Australian organizations and technology for their customer-facing storefronts. This policy explains information handling across our website, accounts, Portal, storefronts and enabled staff applications.
2 Organizers and the platform
The organizer you buy from determines its event offering and information needed for its customer relationship. We handle relevant information to operate the technology and assist that organizer. We also handle account, billing, support, security and platform-usage information for our own legitimate operations.
Both parties can have legal obligations for information they collect or hold. Contractual descriptions do not remove those obligations. Contact the organizer first about a booking, attendee record or event form; contact us about platform information or if you need help identifying the appropriate contact. We will coordinate where necessary.
3 Information handled
Depending on the enabled service, information includes:
Account and organization details: names, email, business and contact details, roles, login identifiers and authentication records.
Purchaser and attendee details: contact information, registration answers, age-category and guardian declarations, order/ticket references, admissions and attendance.
Payment and billing records: amounts, currency, tax declarations, provider identifiers, payment/refund/dispute status, instalment schedules and the financial terms authorized.
Agreement evidence: the document version/text, contracting legal name and applicable ABN/ACN or trustee capacity, signer details, declarations, acceptance time and relevant IP address and user-agent where collected for that workflow. A workspace display name and the legal customer may differ.
Support and operational information: correspondence, device and app/session details, diagnostics, security logs and recovery records.
Mobile operation: local copies of attendee, admission and order details, minor/guardian status, pending commands, sale drafts and offline cash receipts; installation and notification identifiers; camera, device and reader information and permissions needed for the selected feature.
Website and product usage: visited public pages, browser/device information, preferences, and analytics where enabled.
Full card numbers and card security codes are handled by payment providers; do not send them to us. Public organization content and media may be visible to anyone accessing the published storefront. Do not place private customer or health information in public event descriptions or imagery.
We collect information from you and your device, the organizer and its authorized staff, a purchaser arranging attendance, identity/payment providers and support interactions. Some attendee information is provided by another person. Collection notices should identify that circumstance and its purpose.
Staff Mobile keeps operational copies and pending work on a staff device to support offline admissions and sales workflows, then synchronizes through the supported process. The native offline store uses encrypted storage with its key held through the device secure-storage service. This is a device-side copy as well as a server record; device security, disconnection and cleanup affect its lifecycle. Report lost or compromised devices promptly; offline copies may not disappear immediately on remote revocation.
The camera is used for supported ticket or code scanning when permission is granted. Supported Stripe Terminal reader features may require Bluetooth, local-network and location permissions and related device/connection information. Payment providers and operating-system services process information needed for their functions. Payment-result push notifications, when enabled, use an installation push token and Expo with the relevant Apple or Google delivery service. Device notification settings control those permissions; the current payment push message uses a generic payment-status alert rather than an attendee name.
We use information to authenticate access, create and operate workspaces, process and reconcile orders, deliver tickets and necessary messages, capture required agreements, support events, manage billing, prevent abuse, resolve requests/disputes and comply with law. Necessary information can be required to complete a purchase or operate the service; optional fields should be identified as such. Where practicable, general inquiries can be made without identifying yourself.
5 Sensitive information and children
The beta is not intended to collect injury, medical or other sensitive information. Organizers must not request it in registration questions, uploads or ordinary support messages. Free-text answers, images or correspondence may nevertheless contain such information accidentally; contact us securely so we and the organizer can restrict access and assess lawful removal or other handling. A prohibition does not erase obligations applying to information actually received.
Business accounts are intended for adults. Organizers may offer activities for children using supported registration and guardian workflows. Authority, capacity and safety must be assessed under applicable law. A guardian checkbox does not independently establish authority or waive a child's legal rights. Contact us and the organizer if information appears to have been supplied without authority or disclosure could create a safety risk.
6 Providers and disclosures
Relevant information is available to the organizer and its permitted staff, and to providers needed for hosting, database/file storage, identity, email, analytics and payments. See the provider register. Payment and identity providers may also use information independently under their own policies.
We may disclose information to professional advisers, insurers, authorities or another recipient where lawfully necessary, and in a business transfer with appropriate safeguards and notice. We do not sell customer lists or use identifiable customer records for unrelated advertising. Information that can reasonably be re-identified is still treated as personal information.
7 Overseas handling
We are based in Australia. Providers and their support arrangements can handle information overseas, including the United States and United Kingdom and other relevant locations identified in the provider register where practicable. Database location alone does not establish the location of media, emails, analytics, support access or backups.
We assess overseas arrangements and take the safeguards required by applicable law. We do not treat agreement to this policy as a blanket waiver of overseas-handling protections.
8 Cookies and analytics
Necessary cookies and storage support login, security and the requested transaction. Public web pages can use PostHog usage analytics and masked session replay when configured. The current web implementation can start this when a public page loads; it does not yet provide a general cookie-consent preference interface. Masking reduces exposure but does not guarantee anonymity. Tokenised order, ticket, checkout-agreement, consent and payment-plan routes are excluded by the current route controls. The generic /checkout page is not excluded by that matcher and can be recorded when analytics is configured. These controls do not establish that every page containing personal information is excluded.
Staff Mobile provides a separate choice for optional usage/crash diagnostics where that feature is enabled. Necessary authentication, payment, security and synchronization records remain processed. Browser settings can restrict storage, though this may affect functionality. Contact us with a privacy concern or a request to discuss available controls.
9 Marketing and messages
Product/launch marketing is optional and separate from acceptance of business terms and necessary service messages. We handle the consent and submission information you provide to manage your marketing choices. For commercial messages we send, we provide a working unsubscribe route requiring neither an account nor extra personal information and apply suppression to subsequent marketing. A waitlist signup records a marketing request; it does not establish that a newsletter delivery system has been activated or replace the unsubscribe and suppression controls required before sending. We must have a lawful basis for marketing, keep adequate consent and suppression evidence, and respect unsubscribe requests. Booking or waiver acceptance alone is not permission for unrelated marketing.
Factual confirmations, account security notices and required operational messages may continue when appropriate. Adding promotions can change the legal treatment of a message; we review its whole content. An organizer is responsible for marketing it initiates and we remain responsible for messages we authorize or send.
10 Retention and security
We keep information while reasonably needed for service delivery, lawful financial/legal records, disputes and proportionate security purposes. Then we take reasonable steps to destroy or de-identify it. Different categories have different schedules: some internal analytics expire after 396 days and storefront email event logs after 90 days; these are not deletion periods for all order, message or waiver records.
Financial retention depends on the record and applicable law. Most business-tax records have a five-year baseline, while other laws or specific circumstances can require longer. We do not apply a universal seven-year rule to every customer record. Waiver/child/incident evidence may require a separately justified period. Legal holds are documented and reviewed.
We use reasonable safeguards appropriate to risk, including controlled access and secure transport, and provider-backed protections. No system is completely secure. Closure, data return and deletion assistance follow the agreement and applicable law. Backups expire according to confirmed provider schedules; lawful restrictions must be reapplied after restoration.
11 Requests and complaints
Ask us for access to or correction of your information at humankindlytech@gmail.com. We may verify identity and authority proportionately. We aim to acknowledge within five business days and respond within 30 calendar days; if more time is reasonably necessary we explain why and give an update. Any applicable legal requirement prevails.
You may also ask us to assess deletion or restriction. Australian law does not create an unlimited right to erase every record on request. We explain lawful retention or refusal and assist with organizer-held information where relevant. Requests for correction and making an access request are not charged; any lawful reasonable cost of providing access would be explained in advance.
To complain, describe the concern and preferred response. We investigate, communicate the outcome and explain review options. If unresolved, you may contact the Office of the Australian Information Commissioner, https://www.oaic.gov.au/privacy/privacy-complaints, where it has jurisdiction, or the applicable state/territory body. You need not use our complaint process in a way that loses a legal right or deadline.
12 Incidents and automated decisions
We investigate suspected incidents, contain harm and coordinate with affected organizers. Where applicable notification thresholds are met, we notify the regulator and people as required. A statutory assessment period is not a general notification grace period.
The Service uses rules for matters such as ticket availability, eligibility, payment/default status, fraud/security restrictions and refund-policy calculations. An organizer can also make decisions using those outputs. We will assess which decisions require additional automated-decision transparency, including the Australian requirements commencing 10 December 2026, before claiming that none has a significant effect. Contact us about an error or an available human review route.
13 Changes
Published versions will carry an effective date and change summary. Material changes receive an appropriate additional notice, and consent is sought where required for a new purpose. The published policy and relevant earlier versions will be available through our legal pages.
