Effective date: 29 August 2026
Entity: Rocket Online Pty Ltd (ABN 43 672 902 626) trading as Pinvoy ("Pinvoy", "we", "us", "our").
1.1 This Privacy Policy explains how Pinvoy collects, uses, discloses, stores and protects your Personal Information when you use the Pinvoy website at www.pinvoy.app, our mobile apps, and related services (the ‘Service’).
1.2 We handle Personal Information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).
1.3 This policy should be read together with our Terms of Service. Any defined terms used in this policy have the meaning ascribed to such terms in the Terms of the Service, unless otherwise defined in this policy.
1.4 By using the Service, you consent to the handling of your Personal Information in accordance with this policy. If you do not agree, do not use the Service.
2.1 ‘Personal Information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not — as defined in the Privacy Act.
3.1 Depending on how you use the Service, we may collect:
(a) Account information — your name or display name, email address, a hashed password (we never store your password in plain text), and account settings;
(b) Profile and Creator information — for Creators, your public profile, handle, and information required to verify your identity and pay you, collected and held largely by our payment processor(s) (see cl 3.1(d));
(c) Content and location data — the Pins, coordinates, photographs, notes, ratings and other content you submit. Location coordinates you publish may reveal places associated with you. As such, publish only what you are comfortable making available to subscribers of the Service (Subscribers).
(d) Payment information — payments are processed by Stripe (and, for in-app purchases, Apple or Google). We do not collect or store your full card number. Stripe collects and processes your payment and (for Creators) identity/bank details under its own privacy terms. We receive limited information such as transaction status, the last few digits of a card and payout records.
(e) Usage, device and log data — collected automatically, including IP address, device and browser type, app version, pages/screens viewed, actions taken, timestamps, and diagnostic/crash data.
(f) Cookies and similar technologies — used to keep you signed in, remember preferences, secure the Service, and understand usage (see cl 9).
(g) Communications — records of your correspondence with us (e.g. support requests);
3.2 Sensitive Information - We collect Sensitive Information (as defined in the Privacy Act) only where you volunteer it in content or with your consent, and we discourage submitting it.
4.1 Directly from you — when you register, set up a profile, publish content, subscribe, contact support, or otherwise interact with the Service.
4.2 Automatically — through your use of the Service (see cl 3.1(d) – (e)).
4.3 From third parties — such as Stripe (payment/identity/payout status), Apple/Google (in-app purchase status), and providers that help us operate the Service (see cl 6). Where it is lawful and reasonable, we collect Personal Information about you only from you.
5.1 We use Personal Information to:
5.2 We will not use or disclose your Personal Information for a purpose unrelated to the above, unless you would reasonably expect it, you consent, or it is otherwise permitted or required by law.
6.1 We disclose Personal Information to:
(a) Service providers and processors who help us run the Service, including (as at the Effective Date), the following providers, who are authorised to use Personal Information only to provide services to us:
| Provider | Purpose |
|---|---|
| Stripe | Payment processing, Creator payouts (Stripe Connect), identity verification |
| Vercel | Application hosting and delivery |
| Supabase | Database hosting (our primary datastore) |
| Cloudflare | Image hosting / content delivery |
| Resend | Transactional email delivery (e.g. verification, password reset) |
| Apple / Google | App distribution and in-app purchases |
(b) Other Users — content you publish (including Pins and profile information) is disclosed to other Users as intended by the Service (e.g. to your Subscribers);
(c) Legal and safety — regulators, law enforcement, courts, or others where required or authorised by law, or where reasonably necessary to protect the rights, property or safety of Pinvoy, our Users, or the public;
(d) Business transfers — a purchaser or successor in connection with a sale, merger, restructure or financing of our business, subject to appropriate protections.
6.2 We do not sell your Personal Information.
7.1 Some of our providers may store or process Personal Information outside Australia. Based on our current stack, this may include:
| Provider | Likely location(s) |
|---|---|
| Supabase (database) | Singapore |
| Vercel (hosting) | United States (and edge locations) |
| Stripe (payments) | United States, Ireland/EU |
| Cloudflare (images/CDN) | United States and global edge |
| Resend (email) | United States |
| Apple / Google | United States and global |
7.2 By using the Service, you acknowledge that your Personal Information may be disclosed to, and stored or processed in, the countries above. We take reasonable steps to ensure overseas recipients handle your Personal Information consistently with the APPs, but their handling may also be subject to foreign laws.
8.1 We may send you marketing communications about Pinvoy, where permitted by law and, where required, with your consent.
8.2 Every marketing message includes an unsubscribe option, and you can opt out at any time by contacting hello@pinvoy.app. Transactional and service messages (e.g. security, billing, account notices) are not marketing and may still be sent.
9.1 We use cookies and similar technologies to keep you signed in, remember settings, secure the Service, and analyse usage. You can control cookies through your browser settings, noting that disabling some may affect functionality (e.g. staying signed in).
10.1 We take reasonable steps to protect Personal Information from misuse, interference, loss, and unauthorised access, modification or disclosure — including encryption in transit (TLS), hashed passwords, access controls, and restricting access on a need-to-know basis.
10.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential.
10.3 If a data breach likely to result in serious harm occurs, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act.
11.1 We keep Personal Information only as long as reasonably necessary for the purposes in cl 5, including to provide the Service, comply with legal, tax and accounting obligations, and resolve disputes.
11.2 You may delete your account through the Service. On deletion, we will delete or de-identify your Personal Information within a reasonable period, except where we are required or permitted to retain it (e.g. transaction and payout records for tax/audit, records needed to resolve disputes or meet legal obligations and content that has been shared with other Users or exists in backups until they cycle out).
11.3 Creators with active Subscribers. If you are a Creator and Users are currently paying for access to your content when you ask to delete your account, we stop all renewals immediately and begin closing your account, but your pins remain visible to those existing Subscribers until the billing period they have already paid for ends — so they receive the access they paid for. During this period, your profile is removed from discovery and no new Subscriptions can start. Your account and content are then permanently deleted. This delay is bounded: it never exceeds 45 days from your request, after which deletion completes regardless. Deleting an account of a User who is not Creator, or a Creator account with no paying Subscribers, takes effect immediately.
12.1 You may request access to, or correction of, the Personal Information we hold about you by contacting hello@pinvoy.app. Much of it can be viewed or updated directly in your account settings.
12.2 We will respond within a reasonable period. We may need to verify your identity, and in limited circumstances permitted by law, we may decline access or correction (we will explain why and how to complain).
13.1 The Service is intended for users 18 and over. We do not knowingly collect Personal Information from anyone under 18. If you believe a minor has provided us Personal Information, contact hello@pinvoy.app and we will take reasonable steps to delete it.
14.1 If you have a privacy concern or complaint, contact our Privacy Officer at hello@pinvoy.app. We will acknowledge and investigate and aim to respond within a reasonable time (generally 30 days).
14.2 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au, phone 1300 363 992.
15.1 We may update this Privacy Policy from time to time. The current version is always available on the Service, and we will take reasonable steps to notify you of material changes. The "Effective Date" above shows when it was last updated.
If you have any queries or concerns about the use of your Personal Information, or compliance by a User of the Service with this Privacy Policy, please contact our Privacy Officer at hello@pinvoy.app.