Privacy Policy

In the Event Of Pty Ltd (ABN 38687352647) ("we", "us", "our", or "In the Event Of") is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, and store your personal information when you use our services, including our website at https://intheeventof.co and related services (collectively, the "Services"). It should be read together with our Terms of Service.

By using our Services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

We may collect the following categories of personal information:

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether recorded in a material form or not.

Sensitive Information is a subset of personal information that includes information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, criminal record, health information, genetic or biometric information. We do not generally collect sensitive information unless you voluntarily provide it, and we will only use it as permitted by law.

We use cookies and similar tracking technologies to collect and store certain information when you interact with our Services. Cookies are small text files stored on your device that help us provide and improve our Services.

We use your personal information for the following purposes:

• Provide Services: To deliver, maintain, and improve our Services, including helping you manage your digital footprints and complete life event journeys.
• Authentication and Security: To verify your identity, secure your account, prevent fraud, and protect against unauthorised access.
• Personalisation: To customise your experience based on your location, preferences, and usage patterns.
• Analytics and Improvement: To analyse how our Services are used and to improve functionality, user experience, and develop new features.
• Customer Support: To respond to your enquiries, provide technical support, and address your concerns.
• Communications: To send you service-related notifications, updates, and (with your consent) marketing communications.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
• Consent Management: To record and honour your consent preferences and privacy choices.

We may disclose your personal information to:

Your personal information may be stored and processed in countries outside of Australia, including but not limited to the United States and the European Union, where our service providers (such as Supabase, PostHog, and Sentry) maintain their servers and infrastructure.

When we disclose personal information to overseas recipients, we take reasonable steps to ensure that the recipients do not breach the APPs in relation to that information. This includes:

• Only using service providers that implement appropriate security measures and privacy protections
• Ensuring contractual obligations are in place to protect your personal information
• Selecting providers that comply with internationally recognised privacy frameworks

By using our Services, you consent to the disclosure of your personal information to overseas recipients as described in this Privacy Policy.

While our Services are primarily governed by Australian privacy law, we recognise that users may access our Services from other countries, including the European Union.

For EU/EEA Users: If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) may apply to our processing of your personal data. Under GDPR, you have additional rights including:

• The right to lodge a complaint with your local supervisory authority
• The right to data portability in a machine-readable format
• Enhanced rights to object to processing and automated decision-making

The legal basis for processing your personal data includes:

• Contract Performance: Processing necessary to provide our Services to you
• Consent: Where you have given explicit consent (e.g., marketing communications, Google integration)
• Legitimate Interests: For analytics, security, and service improvement
• Legal Obligations: To comply with applicable laws

To exercise your GDPR rights, please contact us using the details in the Contact Information section.

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Encryption: Data is encrypted both in transit (using TLS/SSL) and at rest in our databases.
• Access Controls: Strict access controls and authentication requirements, including Row Level Security (RLS) policies in our database.
• Security Monitoring: Continuous monitoring for security threats and suspicious activities.
• Audit Logging: Comprehensive audit trails of data access and modifications with correlation IDs for end-to-end traceability.
• Secure Token Management: OAuth tokens are encrypted and stored securely with server-side exchange using PKCE.
• Regular Security Reviews: Periodic security assessments and updates to our infrastructure and practices.
• Employee Training: Staff are trained on privacy and security best practices.

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining best-practice security standards.

We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Under the Privacy Act and the APPs, you have the following rights regarding your personal information:

• Right to Access: You may request access to the personal information we hold about you. We will provide you with a copy of your information in a commonly used format.
• Right to Correction: You may request correction of any inaccurate, incomplete, or out-of-date personal information we hold about you.
• Right to Erasure: You may request deletion of your personal information, subject to certain exceptions under law (e.g., records we are required to retain).
• Right to Data Portability: You may request a copy of your personal information in a structured, machine-readable format (JSON or CSV).
• Right to Object: You may object to certain processing of your personal information, including direct marketing.
• Right to Restrict Processing: You may request that we limit how we use your personal information in certain circumstances.
• Right to Withdraw Consent: Where we rely on your consent to process personal information, you may withdraw that consent at any time.

You can exercise many of these rights directly through your account settings here, or by contacting us using the details provided in the Contact Information section below.

We will only send you direct marketing communications if you have consented to receive them. Marketing communications may include:

• Email newsletters about our Services and updates
• Information about new features or improvements
• Special offers or promotions

Even if you opt out of marketing communications, we will still send you essential service-related notifications about your account, security alerts, and important policy updates.

Where practicable, we will give you the option of not identifying yourself or using a pseudonym when dealing with us. However, in most cases, we will need to collect personal information (including your name and email address) to provide our Services.

You can browse certain areas of our website without creating an account, but you will need to provide personal information to:

• Create an account and access our Services
• Manage digital footprints and life event journeys
• Connect third-party accounts (Google, Spotify, PayPal)
• Receive customer support

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately using the details in the Contact Information section. We will take steps to delete such information from our systems as soon as possible.

By using our Services, you represent and warrant that you are at least 18 years of age.

If you believe that we have breached the APPs or your privacy rights, you may lodge a complaint with us.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

When we make changes:

• We will update the "Last Updated" date at the top of this Privacy Policy
• For material changes, we will notify you by email or through a prominent notice in our Services
• The updated Privacy Policy will be posted on this page

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information. Your continued use of our Services after any changes indicates your acceptance of the updated Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:

We aim to respond to all enquiries within 5 business days.