Privacy policy

1. About this policy

1.1StallsApp (stallsapp.com) is operated by Mighty Projects Pty Ltd (ABN 44 654 198 553), an Australian private company registered in Victoria, Australia (we, us, our). This policy explains how we collect, hold, use and disclose personal information, and how you can access, correct or complain about our handling of it.

1.2We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are in New Zealand, we also handle your personal information consistently with the information privacy principles in the Privacy Act 2020 (NZ).

1.3"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. This policy applies to all personal information we handle, whether collected through the platform, by email or otherwise. It forms part of our terms of service.

1.4This policy does not apply to third-party websites or services we link to or interoperate with, or to how a market organiser handles information it receives through the platform — see clause 2.

2. Our role, and the organiser's role

2.1StallsApp is software provided to market organisers. For much of the information on the platform we act on an organiser's behalf: an organiser publishes its market, receives stall applications and sells tickets, and we host and process that information so it can do so.

2.2When an organiser receives your information through the platform — your application, your profile, your compliance documents, your booking or your ticket order — that organiser handles it as a separate entity responsible in its own right under the Privacy Act, and not as our agent. Its own privacy policy and practices govern what it does with it. We are not responsible for an organiser's handling of your information, and requests about it should be directed to that organiser.

2.3We handle information in our own right where it relates to your relationship with us — your account, our billing, security and support, and our own analytics about how the platform is used.

3. What personal information we collect

3.1Account information: your name, email address, whether your email is verified, and, where you sign in with a password, a cryptographic hash of that password (we never store the password itself). If you sign in with Google or Facebook, we receive your name, email address and profile image from that provider, together with the tokens needed to complete sign-in.

3.2Stallholder profile and application information: business name, contact name, email, phone number, ABN, product category, biography, website and social links, profile and product images, and the content of your applications (including your pitch and the dates and stall types you request).

3.3Compliance documents you upload, such as certificates of currency for public liability insurance and food business registrations, and any personal information contained in them.

3.4Organiser and team information: organisation name, the members and email addresses you invite to your team, your role, and identifiers for your connected Stripe account and subscription.

3.5Booking, order and ticket information: the stalls, market days, ticket types and prices booked; booking, waitlist and payment status; promotional codes used; buyer name and email on a ticket order; the tickets issued and their QR identifiers; and the time a ticket is scanned at a market entrance. We do not collect or store card numbers — card details are collected directly by Stripe.

3.6Communications: emails we send you through the platform (sign-in links, verification, confirmations, payment and market-day reminders, waitlist notifications, organiser notifications), and any correspondence you send us.

3.7Technical and security information: IP address, browser user-agent, session identifiers and expiry, timestamps, request and error logs, information generated by our bot-protection and rate-limiting measures, and usage information collected through the analytics cookies described in clause 10.

3.8We do not deliberately collect sensitive information (as defined in the Privacy Act). Please do not include health, biometric or other sensitive information in free-text fields or uploaded documents. Where you do, you consent to us handling it for the purposes in clause 6.

4. How we collect it

4.1Directly from you, when you create an account, complete your profile, submit an application, book a stall, buy a ticket, upload a document or contact us.

4.2From market organisers and their team members, when they add, invite, annotate or record decisions about you on the platform.

4.3From third parties who provide part of the service: Google or Facebook (if you choose to sign in with them), Stripe (payment and payout status, dispute and chargeback notifications) and our bot-protection provider (bot-protection outcomes).

4.4Automatically, through your device and browser interacting with the platform, as described in clauses 3.7 and 10.

4.5Where it is reasonable and practicable, we collect personal information about you directly from you. Where we collect it from someone else — for example, an organiser inviting you to a team — we take reasonable steps to ensure you are made aware of the matters in APP 5.

4.6You may deal with us anonymously or under a pseudonym where it is lawful and practicable, but we generally cannot provide accounts, applications, bookings or tickets without the information described in clause 3.

5. What happens if you don't provide it

5.1The information described in clause 3 is generally necessary to provide the platform. If you choose not to provide it we may be unable to create or maintain your account, allow you to apply for or book a stall, issue you a ticket, admit you to a market, process a payment or refund, or respond to your enquiry.

6. Why we collect, hold and use it

6.1We collect, hold and use personal information for the following purposes:

1. (a)creating and administering accounts, authenticating you, and keeping you signed in;
2. (b)operating the platform — publishing markets, receiving and assessing applications, managing bookings, waitlists and capacity, issuing and scanning tickets, and running market-day tools;
3. (c)showing organisers the applications, profiles, documents, bookings and orders for their own markets;
4. (d)processing payments, refunds, payouts, subscriptions, fees, disputes and chargebacks through Stripe;
5. (e)sending service communications you cannot opt out of while you hold an account or a booking, including sign-in links, verification, receipts, confirmations, changes and cancellations, payment reminders and market-day reminders;
6. (f)providing support and responding to your enquiries and complaints;
7. (g)securing the platform — authentication, bot protection, rate limiting, fraud prevention, logging, debugging and incident investigation;
8. (h)improving the platform, including analysing how it is used and diagnosing faults;
9. (i)marketing our own products and services in accordance with clause 9;
10. (j)meeting our legal, tax, accounting and record-keeping obligations, and establishing, exercising or defending legal claims; and
11. (k)any other purpose you consent to, or that is required or authorised by law.

6.2We do not sell personal information. We do not disclose personal information to third parties for their own advertising or marketing, and we do not use it for third-party advertising or profiling.

7. Who we disclose it to

7.1Market organisers and their team members: when you apply to, book with or buy a ticket for a market, the organiser of that market sees the information relevant to it — your application, profile, uploaded documents, booking history and order details, and for buyers your name and email. That is the purpose of applying or buying. Clause 2 explains the organiser's separate responsibility for it.

7.2Our service providers, who may access personal information only to provide services to us and under contractual confidentiality and security obligations. They provide our application hosting, database and file storage, payment processing and payouts (Stripe), transactional email delivery, bot protection, analytics, and sign-in (Google or Facebook, only where you choose to sign in with them).

7.3Professional advisers — lawyers, accountants, auditors and insurers — where reasonably required.

7.4Law enforcement, regulators, courts or other authorities where we are required or authorised by law to disclose, or where we reasonably believe disclosure is necessary to prevent a serious threat to life, health or safety, or to investigate unlawful activity or serious misconduct.

7.5A purchaser or prospective purchaser of our business or assets, in connection with a merger, acquisition, restructure or sale, subject to appropriate confidentiality protections.

7.6Any other person with your consent.

8. Overseas disclosure

8.1We host the platform, and store our database and the files you upload, in Australia (Sydney). Some of our service providers nevertheless store or process personal information outside Australia — for example, email is delivered, payments are processed and bot-protection checks are performed on overseas infrastructure, and our providers' support and monitoring operations may access information from other countries.

8.2The countries in which our providers may handle personal information include the United States, and other countries in which they and their sub-processors maintain infrastructure or support operations.

8.3Before disclosing personal information overseas we take steps that are reasonable in the circumstances to ensure the recipient does not breach the APPs, including by contracting with reputable providers on terms that require them to protect personal information and use it only for the purposes we specify.

9. Marketing communications

9.1Service communications — sign-in links, verification emails, confirmations, receipts, changes, cancellations, payment reminders and market-day reminders — are necessary to operate the platform and to perform your bookings. They are not marketing, and you cannot opt out of them while you hold an account or an active booking or ticket.

9.2We may send you marketing communications about our own products and services where you have consented, or where you would reasonably expect them because of your existing relationship with us. Every marketing message includes an unsubscribe facility, and we will action an unsubscribe request promptly. Our marketing complies with the Spam Act 2003 (Cth).

9.3Where a market organiser uses the platform to send communications to its stallholders and customers, we act solely as a service provider transmitting those messages on the organiser's behalf. The organiser chooses the recipients and the content and is identified in the message as its sender, and the organiser is responsible for ensuring those communications comply with applicable privacy and spam laws.

9.4Organiser marketing sent through the platform carries its own unsubscribe facility, which we action on the organiser's behalf — unsubscribing stops that organiser's marketing to you, without affecting the communications described in clauses 9.1 and 9.2. For marketing an organiser sends outside the platform, contact that organiser.

10. Cookies and similar technologies

10.1We use strictly necessary cookies — a session cookie that keeps you signed in, and cookies set by our bot-protection provider to distinguish humans from automated traffic — and analytics cookies set by our analytics provider, which we use to understand how the platform is used: pages visited, approximate location (city level), and device and browser type.

10.2We use analytics only as our own measurement of the platform. We do not use advertising, profiling or cross-site tracking cookies, and we do not permit our analytics provider to use analytics data for its own advertising purposes — advertising and personalisation signals are disabled in our analytics configuration.

10.3You can block or delete cookies through your browser, and blocking analytics cookies does not affect how the platform works. The platform will not function correctly without the session cookie — you will not be able to stay signed in.

11. Aggregated and de-identified information

11.1We may create aggregated and de-identified information from platform activity — for example, statistics about application volumes, booking patterns or sector trends. That information does not identify you or any individual, and we may use, publish and commercialise it for any purpose, including improving and marketing the platform.

11.2We take reasonable steps to ensure de-identified information cannot be re-identified, and we do not attempt to re-identify it.

12. How we hold and protect it

12.1Personal information is held in our database and file storage with our providers, and in our email and support systems. Access is restricted to those who need it to do their job, controlled by authentication and permissions, and gated per market and per organisation.

12.2We take steps that are reasonable in the circumstances to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include encryption of data in transit, access controls, hashed credentials, single-use sign-in links, private file storage served only through authenticated requests, bot protection and rate limiting, and logging.

12.3No method of transmission or storage is completely secure. While we take the steps described above, we cannot guarantee absolute security, and any transmission of information to us is at your own risk. You are responsible for keeping your own devices, email account and sign-in links secure.

12.4If we suffer a data breach that is likely to result in serious harm, we will assess and respond to it in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth), including notifying affected individuals and the Office of the Australian Information Commissioner where required.

13. Retention and destruction

13.1We hold personal information while your account is open, while the market records that reference it remain current, and afterwards for as long as we need it for the purposes in clause 6 or are required to keep it by law.

13.2Records connected to payments, tax and accounting are generally retained for at least seven years to comply with our obligations under Australian tax and corporations law. Organisers may separately need to retain booking records for their own obligations.

13.3Technical and security logs are retained for a shorter period appropriate to their purpose, and then deleted or de-identified.

13.4When we no longer need personal information for any purpose for which it may be used or disclosed, and we are not required by law to retain it, we take reasonable steps to destroy it or de-identify it. Residual copies may persist in backups for a limited period before being overwritten in the ordinary cycle.

14. Accessing and correcting your information

14.1You may request access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Much of it you can view and correct yourself in your account.

14.2Requests should be sent to hello@stallsapp.com. We will need to verify your identity before we act on a request.

14.3We will respond within 30 days. We do not charge for making a request, but we may charge a reasonable fee for giving access where the request requires substantial work; we will tell you the fee before we incur it.

14.4We may refuse access or correction where the Privacy Act permits — for example, where giving access would unreasonably affect another person's privacy, be unlawful, or prejudice an investigation or legal proceedings. If we refuse, we will tell you why in writing and how to complain. If we refuse to correct information, you may ask us to associate a statement with it noting that you consider it inaccurate.

14.5To request deletion of your account and the personal information we hold about you, write to hello@stallsapp.com. We will respond within 30 days, and will delete or de-identify the personal information we are not required or permitted to retain — clause 13 describes what we keep, including records connected to payments, tax, disputes and fraud prevention, and residual copies in backups. Where the information sits in an organiser's market records, we will also tell you to contact that organiser, whose own obligations under clause 2 apply.

15. Complaints

15.1If you believe we have breached the APPs or mishandled your personal information, write to our Privacy Officer at hello@stallsapp.com with details of your concern. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

15.2If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5218, Sydney NSW 2001. In New Zealand, you may complain to the Office of the Privacy Commissioner: privacy.org.nz.

16. Children

16.1The platform is not directed at children. Accounts are for individuals aged 18 or over, and we do not knowingly collect personal information from a child other than incidentally (for example, a child named on a ticket order made by an adult). If you believe we hold information about a child that we should not, contact hello@stallsapp.com and we will delete it.

17. Changes to this policy

17.1We may update this policy from time to time. The current version is always published on this page with its version number and effective date.

17.2Where a change materially affects how we handle your personal information, we will give notice by email to your account address or by notice in the platform before it takes effect. Other changes take effect when published. Continuing to use the platform after a change takes effect means you accept the updated policy.

18. Contact us

18.1Privacy Officer, Mighty Projects Pty Ltd (ABN 44 654 198 553), Victoria, Australia. Privacy enquiries, access, correction and complaints: hello@stallsapp.com. General enquiries: hello@stallsapp.com. If you would prefer to write to us by post, email us and we will provide a postal address.