BangBangBangBang Privacy Policy v2.3
Entity: BangBang Life Pty Ltd (ACN 703 821 738) ("the Platform", "we", "us")
Coverage: Victoria and New South Wales (shown in the app as Melbourne and Sydney) Version: v2.3 Effective: this version takes effect on the date stated when it is published in the app; the version shown to you when you confirm acceptance is the version that applies to you.
Language: this Policy is issued in Chinese and in English. Both versions have equal effect. If the two versions differ in meaning, the English version prevails.
This Policy explains how we collect, use, disclose, store and protect your personal information through the BangBang app (万能帮帮 in Chinese) and website. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we do not reduce the protection we give you on account of our size as a business.
1. Personal information we collect
· Identity and contact: name or nickname, mobile number (Australian +61), email address (optional link; once verified, used for account recovery and notices), account profile, and your public "BB ID".
· Referral and attribution information: the BB ID of the user who referred you (any registered user may be entered as a referrer), or the referral code of a Partner, if you entered one when registering; the referral or attribution recorded as a result (a referral by BB ID is used only to calculate referral rewards and to assess the referrer's application to become a Partner; see clauses 6.8 to 6.10 of the Terms of Service); the single-use invitation codes you generate or use (an irreversible hash and the status are stored; the last 3 characters of each code are also kept so that support staff can check which code is meant) and the own-client link records made through them; and records of BB Vouchers issued and used, records of where the own-client benefit applied, and records of referral rewards.
· Tax reporting information (Taskers): when you set up payouts, you give us in the app your legal name in English as shown on your identity document, your date of birth, residential address, email address and mobile number; if you are paid as a company (Pty Ltd), the company's ABN, registered name, trading name (optional) and address; the company's contact phone number and email address are the verified mobile number and email address on your account (if your account has no verified email address, you enter one in the form). You may also give your ABN (required if you are paid as a company). If you give an ABN, we check that it is in a valid format, and we may also check the public ABN register (ABN Lookup) to confirm that the ABN registration matches the person or company you entered. We also record the ID of your payout account with our payment provider, Stripe (which identifies the account you are paid into), and, for each quarter, the income you earn through the Platform, the number of tasks you complete and the platform service fee we charge you. We do not collect your tax file number (TFN). Identity verification and identity documents are handled by our payment provider, Stripe; we do not keep identity documents.
· Partner details: if you apply to become an independent promoter working with the Platform (a "Partner"), we collect the type of community group or account you give in your application, its member or follower count, and a link to it or a screenshot of it; this information is used only to assess your application and is kept for the period in 5.3. If you are a Partner, this also includes your ABN and GST registration status, your commission and settlement records, and your payout details: the payee name and PayID you give us (stored encrypted and used to pay your commission; we also keep a one-way hash of the PayID, used to check that referrals, rewards and commission are genuine and to compare against other accounts to prevent cheating (whether another account shares the same payout account; see 2.1)) or, if you are also a Tasker paid through Stripe, the ID of your Stripe payout account. We do not collect a BSB or bank account number from Partners.
· Tasks and transactions: tasks posted or taken on, offers, contracts, records of payments and charges, releases, bank payouts and refunds, refund requests, no-show reports, disputes and evidence, reviews.
· Messages: your in-app chat with other users.
· Photos and files: the task photos and completion evidence photos you upload, and the images and files (PDF and Office documents) you send in chat.
· Security and governance records: sign-in sessions and device information, phone-number change and account-recovery requests, email verification records, your block list, reports you make, performance records (such as cancellations after payment, no-shows and payment timeouts), and warning, restriction, ban and appeal records.
· Location: addresses and coordinates connected with tasks, and the location of a Tasker's device when the Tasker submits completion of a task other than an online task (attending in person, pickup and delivery, or running an errand in a stated area) (see section 4).
· Device and usage: device and push identifiers, network (IP) addresses, logs and usage records. Search terms you type on the home page are used only for that search and are not saved. We do not use third-party analytics or advertising SDKs.
· Errors and diagnostics: error and crash information from the app and servers (with personal information removed before sending; see section 3).
· Payment information: processed by a third-party payment provider. We do not store full card numbers or other sensitive payment credentials. We record only the payment amount and status and the settlement details we need, such as the card brand and the last four digits of the card number, the card's issuing country and card type, the result of 3-D Secure authentication, and the payment method (card, Apple Pay or Google Pay). We also obtain from the payment provider a card fingerprint that identifies whether two payments used the same card (for payments made with Apple Pay or Google Pay, the fingerprint relates to the wallet card on that device) and, for Taskers, an identifier that shows whether two payout accounts pay into the same bank account, and we also derive a supplementary comparison identifier from the card brand and the last four digits of the card number; we keep all of these only as one-way hashes (which cannot be turned back into a card number or bank account number), to prevent fake transactions and benefit abuse (see 2.1).
1.1 Information collected for sharing economy reporting
We collect the tax reporting information above because Subdivision 396-B of Schedule 1 to the Taxation Administration Act 1953 (the sharing economy reporting regime) requires us to collect and report it. We use it to report the income you earn through the Platform to the Australian Taxation Office twice a year (see section 3). When you set up payouts, we also give the relevant account-opening details to our payment provider, Stripe, in advance, for opening your payout account and verifying your identity (see section 3). We keep this information for 5 years (in line with the general retention period for tax records), counted from the date we lodge the last report that contains it, and we keep it after your account is deleted (see 5.3 and 5.4). If you do not provide it, you cannot set up payouts, and so cannot submit offers or take on tasks.
2. How we use information
· To provide and run the Service: matching, recording contracts, processing payment, delayed release and settlement, and notices.
· Content checks and risk grading, fraud and abuse prevention, account security, and handling disputes and refunds.
· When handling complaints, disputes, refund requests and card chargebacks, Platform staff may view the chat messages connected with the matter. Each access must be linked to an existing report, dispute, refund request, support ticket or chargeback record and is logged.
· To respond to card chargebacks (where a cardholder disputes a payment through the card issuer), by preparing evidence about the transaction and giving it to our payment provider.
· To meet legal, tax and compliance obligations, including reporting to the Australian Taxation Office.
· To apply the own-client benefit, and to issue and apply BB Vouchers and referral rewards, to assess applications to become a Partner, to calculate and pay Partners' commission, and to check that referrals and attributions are genuine.
· To find and fix faults and improve the Service.
· To communicate with you where you have agreed or the law allows.
2.1 Automated processing
The following is carried out automatically by our systems:
· Automated content checks and risk grading when a task is posted: a task that does not pass, or that the system cannot confirm, is not published, and the system prompts you to edit and resubmit. If you believe the result is wrong, you may contact us and staff will look into it and reply.
· Automated steps in the payment flow. Under clause 3.2 of the Refund and Dispute Rules, after the Tasker submits completion, the system releases the funds automatically if the conditions for automatic confirmation are met. Once 85 days from payment have elapsed, if the funds have not been released and there is no unresolved dispute or chargeback, the system automatically cancels the task and refunds the full amount to the original payment method under clause 4.5. Unresolved disputes or chargebacks are handled manually. If there is no valid payment when the payment window closes, the selection expires under clause 5.3. The Platform gives advance notice of the relevant times.
· Automated handling of Poster no-shows: if a Poster reported as a no-show does not respond within 24 hours, the system automatically returns the payment and records a warning or a 30-day restriction (on posting or editing tasks, selecting offers and paying) under clause 7.6 of the Refund and Dispute Rules; from the third occurrence, Platform staff also review the account. The Poster is notified and may appeal.
· Automated handling of platform service fee discounts and referral rewards: the system applies platform service fee discounts automatically to eligible tasks under clause 6.8 of the Terms of Service, and issues referral rewards automatically when the conditions in clause 6.9 of the Terms of Service are met. Before a reward is issued, the system automatically checks whether the referrer, the referred Tasker and the Poster of the relevant task share the same card (by card fingerprint hash; for wallet payments, the wallet card on that device), the same device or the same payout account; where a match is found, the reward is held and reviewed by Platform staff. The system does not impose any penalty automatically. After an own-client link is made, the system automatically checks whether the newly registered account shares the same card, the same device or the same payout account with any other account on the Platform (including deleted accounts); where a match is found, the own-client benefit is suspended for that link and the matter is referred to Platform staff for manual review, and the system does not impose any penalty automatically as a result.
· Account bans are never automated. They are always decided by Platform staff after a manual review of the evidence.
2.2 Automated decisions
The following decisions are made by a computer program, or mainly by a computer program, and may significantly affect your rights or interests:
· Automatic confirmation and release. After the Tasker submits completion in the app, the system releases the funds automatically if the Poster has not confirmed completion by the automatic confirmation time, neither party has raised a dispute directly under clause 6.1 of the Refund and Dispute Rules, and the other conditions in clause 3.2 of those Rules are met. Matters such as an unresolved dispute, refund request, no-show report, chargeback, risk review, payment matter in progress or account restriction are handled under that clause.
· Automatic refund on a time limit and expiry of selection. For a payment that remains unreleased after 85 days and has no unresolved dispute or chargeback, the system automatically cancels the task and refunds the full amount to the original payment method under clause 4.5 of the Refund and Dispute Rules. If a Poster reported as a no-show does not respond within 24 hours, the Poster is treated as having admitted the no-show. The payment is returned automatically and one no-show is recorded (see clauses 4.3 and 7.6 of those Rules). Refund requests and no-show reports with materials missing at the deadline are handled under clause 6.9. If there is no valid payment when the payment window closes after the Poster selects a Tasker, the selection expires under clause 5.3.
· Automatic restrictions based on the number of no-shows: according to the number of confirmed no-shows in the preceding 6 months, the system automatically records a warning or a 30-day restriction (for a Poster: on posting or editing tasks, selecting offers and paying; for a Tasker: on taking on tasks); from the third occurrence, Platform staff also review whether to ban the account. A ban is never made automatically.
· Automatic restriction while a case is unresolved: while a dispute, refund request or no-show report on a task is unresolved, the system automatically stops both parties to that task (the Poster and the Tasker) from posting a new task, or making a new offer or application, until the case is closed; selecting offers and paying on their other tasks go on as usual. The restriction ends automatically when the case is closed.
· Risk grading that refers a matter to a person. Content checks and risk grading take place when a task is posted. A task that does not pass or that the system cannot confirm is not published. A payment under risk review is held from automatic release and referred to staff for manual handling under clause 3.2 of the Refund and Dispute Rules.
· Automatic calculation and holding of referral rewards and Partner commission: the system calculates referral rewards and Partner commission automatically; where it finds a match such as sharing the same card, device or payout account, the reward, saving or commission is held and passed to Platform staff for manual review, and the system does not impose any penalty automatically.
The personal information used for these decisions is: records of the status and timing of tasks and payments; performance records (including confirmed no-shows); and the device, card and payout account identifiers used for comparison.
After the Tasker submits completion in the app and before release, either party may raise a dispute directly under clause 6.1 of the Refund and Dispute Rules. Before completion is submitted, the Poster may request a refund under clause 4.4 and either party may report a no-show by the other under clause 4.3. This timing restriction does not apply to a no-show report or refund request that becomes a dispute under those Rules. If you disagree with the outcome of a release or a refund, you may contact us to request a manual review by Platform staff (see section 10). If you disagree with a no-show record or a restriction, you may appeal under section 7 of those Rules.
3. How we disclose personal information
We disclose information only where necessary, to the following recipients:
· Other users: information shown to the other party as part of the task flow (public name, task content; after payment and confirmation, the necessary exact location is shown to the Tasker; after payment is confirmed, the Poster and the matched Tasker can see each other's mobile numbers so that they can contact each other directly), and the Tasker profile shown to signed-in users (public name, introduction, service tags, number of completed tasks, published reviews, a "New user" label, and "Repeat clients: N", which counts only tasks completed through the Platform). Signed-in users can find the public profile of a Tasker who has set up payouts, by BB ID, in the app and send an invitation; a Tasker can generate and share their own name card, which contains only information from that public profile. "Repeat clients" means Posters who have, through the Platform, completed with that Tasker two or more tasks, each of A$30 or more in a single task amount, released and not fully refunded, counted by person. The "New user" label means the user has fewer than 3 tasks completed in that role, paid out and with no open dispute; it is counted separately for a user's activity as a Tasker and as a Poster. Beside a Tasker's offer or application, the Poster also sees the Tasker's cancellation count, which is the number of confirmed times the Tasker cancelled after the Poster had paid plus the Tasker no-shows the Platform has confirmed.
· Partners (independent promoters working with the Platform): a Partner receives only aggregate figures about the users they brought to the Platform (number of users, number of completed tasks and commission amount). They receive no user's name, mobile number, BB ID, task content or other personal information; where the number of users is very small, the number is shown only as a range. Your profile does not show whether you were brought to the Platform by a Partner.
· Payment provider (Stripe, United States): processing payments and charges, transferring the funds after deducting the platform service fee into the Tasker's Stripe payout account, arranging bank payouts as instructed by the Platform, and processing refunds and transfer reversals, responding to card chargebacks, Tasker payout onboarding and identity verification, and transfers of commission to Partners who are also Taskers with a Stripe payout account (see "Partner details" in section 1). Bank cards, Apple Pay and Google Pay are accepted; the payment form does not enable Stripe Link or similar features that save card details and contact information. When you set up payouts, we send Stripe the name, date of birth, address, email address and mobile number you entered in the app (if you are paid as a company: the company's registered name, ABN, address, phone number and email address, and the email address and mobile number of the company's representative), for opening your payout account and verifying your identity, so you do not have to enter them again; you can confirm or change them on Stripe's pages. Where a Poster raises a chargeback with their card issuer for a payment that has been released, we submit evidence in the Stripe dashboard: the contract, completion record and dispute record for that payment; the chat messages of both parties on that task; the Poster's account name, verified email address, mobile number (last three digits only), account creation date and the network address the payment was started from; and the card brand and last four digits. Stripe passes this evidence to the card issuer and card network. It does not include the Tasker's mobile number, email address, bank details or ABN, or the task's full address.
· Our bank (Australia; used for PayID transfers): paying commission to Partners who are paid by PayID (see "Partner details" in section 1). We give the bank only what the transfer needs: the payee name, the PayID and the amount.
· Wallet providers (Apple Pay: Apple, United States; Google Pay: Google, United States and worldwide): when you choose to pay with Apple Pay or Google Pay, Apple or Google, as the wallet provider, processes the payment token and passes it to the payment provider to complete the payment.
· Maps provider (Google Maps Platform, United States and worldwide): address standardisation, maps and service-area checks. The map is requested directly from Google by the Google Maps component on your device, and Google receives the information needed to show the map (for example, your device's network address and the map area).
· Push notification providers (Google Firebase Cloud Messaging, United States and worldwide; Apple APNs, United States): app push notifications.
· Web push services (the push service of your browser's maker: Google, United States and worldwide; Mozilla, United States; Apple, United States): if you turn on browser notifications on the web version, notifications are delivered through the push service of the maker of the browser you use; that service receives your browser's push subscription address and the encrypted content of the notification.
· SMS provider (Twilio, United States): verification codes, task notices and security notices.
· Email provider (Resend, United States): email verification codes (sent to the address you are linking), and notices and security emails (sent only to a verified linked email address).
· Error and performance diagnostics provider (Sentry, Germany): collecting error and crash information from the app and servers. Before sending, personal information such as mobile numbers, addresses, payment details and sign-in credentials is removed, and the provider's default collection of personal information is turned off.
· App update provider (Expo EAS Update, United States): when over-the-air updates are on, the app checks with this provider for a newer version when it starts; it receives technical information such as the device's network address, app version and runtime version, but no account information.
· Cloud infrastructure (Amazon Web Services, Sydney, Australia; daily off-site backups are held with Amazon Web Services S3, also in Sydney, Australia, and kept for 30 days): servers, database, file storage and database backups.
· Operations alerts (Better Stack, United States and other locations): sending system alerts to Platform operations staff. Alerts contain only public numbers, internal identifiers, amounts and handling status, and do not contain mobile numbers, names, addresses or message content.
· Australian Taxation Office (ATO): every six months, under the sharing economy reporting regime, we report each Tasker's identity and contact details (name, date of birth, address, email, phone and ABN; for a company, its ABN, registered name, address, email and phone), the ID of the Tasker's Stripe payout account, and, for each quarter, the income earned through the Platform, the number of tasks and the platform service fee (see 1.1).
· Related companies, business transferees and their advisers (only on a restructure, merger, acquisition or sale of the business): if the Platform restructures, merges with another company, is acquired, or transfers all or the main part of the BangBang business to a related company or a business transferee (as defined in clause 12.4 of the Terms of Service), we may give personal information to that related company or transferee and to its advisers (such as lawyers and accountants), only for due diligence and for handing over the business. During due diligence we give only the information needed and require the recipient to keep it confidential. The recipient must protect the information to a standard no lower than this Policy and, after taking over, remains bound by this Policy until it is revised under section 9; if the recipient is overseas, 3.1 applies. We notify you before the handover is completed, and again at the handover, saying who the recipient is and that your information has been transferred. If you do not agree, you may delete your account under 6.3 before the handover (records the law requires us to keep are handled under 5.4).
· Legal requirements: disclosure required by law, a regulator, a court or a tribunal.
3.1 Overseas disclosure
Of the recipients above, Stripe, Google, Apple and Expo are located in the United States or process data worldwide (including Apple and Google processing payment tokens as the wallet providers for Apple Pay and Google Pay); Twilio and Resend are located in the United States; Better Stack processes data in the United States and other locations; Sentry is located in Germany. Before disclosing information to an overseas recipient, we take reasonable steps to ensure it handles your information to a standard no lower than the Australian Privacy Principles, including: sending only the information needed; removing personal information from diagnostic data; and binding the provider by contract. Your core data (account, tasks, contracts, messages and addresses) is stored in Australia.
4. Special handling of location information
4.1 The exact location of a task is revealed in stages. During browsing, offering, and after selection but before payment, no exact coordinates or address are provided; the public listing shows only an obscured approximate location (a fixed point within a grid cell: the cell is about 1 km across where many people live and is enlarged to several kilometres or even tens of kilometres where few people live, so that every cell holds at least about 50 dwellings) and a rough distance. How many dwellings an area has is worked out from the dwelling counts published by the Australian Bureau of Statistics (ABS) (CC BY 4.0), aggregated by us; no user's personal information is involved.
4.2 Only after payment and confirmation of the task is the necessary exact location shown to the matched Tasker.
4.3 The full address and exact coordinates of a task are stored encrypted; public map markers are obscured; every access to an exact address is logged in an audit trail, and Platform staff view a full address only where customer service, safety or dispute handling needs it, with a record kept. The completion location (see 4.6) is stored separately, is viewed only by the Platform when handling a case, and every view is logged in an audit trail.
4.4 After a task is completed, the Tasker can view the exact address only for 7 days after completion (for follow-up such as items left behind), and it is not shown to the Tasker after that; the Poster can continue to see the address they entered.
4.5 The content-only mini-program does not show live task locations.
4.6 Completion location: when a Tasker submits completion of a task other than an online task (attending in person, pickup and delivery, or running an errand in a stated area), we read the location of the Tasker's device once (latitude, longitude and accuracy) and keep it with the completion record, as evidence of completion and for review when handling disputes, refund requests and no-show reports. We read it only at the moment completion is submitted and do not track location continuously. A Tasker who has not granted location permission cannot submit completion; where permission is granted but the location cannot be obtained at that moment, the Tasker can still submit and we record "location not obtained". The completion location is not shown to the Poster or other users; only the Platform reviews it when handling those matters. We do not read a completion location for online tasks.
4.7 If you choose "use my location" to see nearby tasks, your device's location is sent to our servers to filter tasks and work out distances; we do not add it to your account profile. Your location and search terms are used only for the query at hand and are not saved; our cloud infrastructure provider (section 3) may record the request in short-term technical logs.
5. Storage, security and retention
5.1 Data is stored in Amazon Web Services' Sydney, Australia region; database backups are held in Amazon Web Services' Sydney, Australia region (see section 3).
5.2 Security measures include: encrypted storage of sensitive data such as addresses and Partners' PayIDs, access auditing, access controls, a second verification step for back-office operations, and sign-in session management.
5.3 Retention periods:
· Account profile: for the life of the account; after deletion, handled under 5.4.
· Your messages with other users (including the images and files in them), and reviews: 24 months from the end of the related task; if the task has a dispute, refund request or no-show report that is still open or has been closed for less than 24 months, the messages are kept with that case; after account deletion they are kept in de-identified form, with the sender shown as "Deleted user". Before a review is deleted at the end of its retention period, its star rating and count are added to the running totals, so the publicly displayed rating is not affected.
· Contracts, payment, settlement and refund records: 7 years from completion of the transaction (tax and accounting requirements).
· Tax reporting information and the reports we lodged: we keep them for 5 years (in line with the general retention period for tax records), counted from the date we lodged the last report that contains the information.
· Own-client link records and the invitation codes that were used to make them: deleted once 30 days have passed since the own-client benefit period ended (for a link that was revoked, once 30 days have passed since both the end of the period and the revocation; a link under Platform review is not deleted). After deletion, payment records still keep the platform service fee rate that applied and the reason it applied. An invitation code that was never used is kept until it expires or is withdrawn.
· Partner attribution records: once the commission period has ended, there is no commission recorded under that attribution that is still unsettled, and 180 days have passed since the last commission entry (a release or an adjustment; the chargeback and recovery window; where there are no entries, the end of the commission period is enough), the identity of the attributed user is removed and we keep only a relationship record containing no personal information and a marker of whether the attributed person had completed a task; records that form the basis of a commission settlement are kept with the settlement records for 7 years.
· Personal referral records (referrals by BB ID): deleted once the referral reward has been issued or declined, the BB Vouchers issued under it have been used or voided, no review flag on it is open, and 12 months have passed since the referred person registered; before deletion, a referral that counts toward the number needed for a Partner application is added to the referrer's tally, a number that contains no personal information.
· Partner application information (type of group or account, member or follower count, link or screenshot): if the application is declined, 90 days from the decision; if it is approved, for as long as you are a Partner and for 24 months after your Partner status ends; if approved but the Partner Agreement is never accepted, 24 months from the approval.
· Partner payout details (payee name and PayID): until you change them, or your Partner status ends and all commission has been paid; the record of each payment is kept with the settlement records for 7 years. The ABN and GST registration status you give us are kept with the settlement records for 7 years.
· Disputes, refund requests, no-show reports and their evidence (including the evidence documents we prepare to answer a dispute or a card chargeback): 24 months from the close of the case.
· Task photos: 24 months from the end of the related task; if the task has a dispute, refund request, no-show report or card chargeback that is still open or has been closed for less than 24 months, they are kept with that case.
· Completion photos and completion locations: 24 months from the end of the related task; where they become evidence in a dispute, refund request or no-show report, they are kept with that case's evidence.
· Report material: 90 days from the close of handling; where it led to account action, kept with the record of that action.
· Account actions (warnings, restrictions, bans) and appeal records: 24 months from the end of the action.
· Performance records (such as cancellations after payment, no-shows and payment timeouts): 24 months from when the record is made; where they led to account action, kept with the record of that action.
· Audit logs and security records: 24 months, for the identifiers used to recognise the same device, card or payout account, counted from the last time each was seen; entries that record consents, own-client links, Partner matters, payment, release, refund and dispute decisions are kept with the transaction records for 7 years, with the network (IP) address in them cleared after 24 months and the entries deleted after 7 years.
· Notifications in the app: 12 months from when sent.
· Channel send logs (records of SMS, email and push messages sent): 90 days from sending.
· Phone-number change and account-recovery request records: 24 months from when the request is closed.
· Sign-in sessions and device information: 12 months from last use.
· Support tickets and attachments: 24 months from when the ticket is closed.
· Privacy export files: 7 days from generation.
· Exact address after task completion: the Tasker can view it for 7 days after completion and it is not shown to the Tasker after that; the encrypted record is kept for the same period as the contract records.
Information past its retention period is deleted or anonymised within a reasonable time (clean-up runs in scheduled batches); other records not listed above are likewise deleted or anonymised once they are no longer needed. Messages and reviews are deleted in their entirety when their retention period ends; when the retention period for a dispute, refund request, no-show report, or account action or appeal record ends, its text and evidence files are deleted and only a single result record containing no personal information is kept.
5.4 Retention after account deletion: after your account is deleted we keep: the versions of the Terms and Privacy Policy you accepted, the account creation and deletion times, and the account status; transaction and compliance records the law requires us to keep (see 5.3); and the records you shared with the other party in a task (the task, messages, reviews and dispute records), kept in de-identified form for the periods in 5.3. De-identified means that we delete information that directly identifies you, such as your name, mobile number and email address, and keep the content of the record; the other party sees the sender or party shown as "Deleted user". If you earned income through the Platform before deleting your account, we keep the tax reporting information described in section 1 to complete any report not yet lodged, and keep it for the period in 5.3; it is no longer linked to your public profile. Of referral and attribution relationships, we keep only the relationship record, which contains no personal information, to complete any commission or benefit calculation not yet settled. We also keep a one-way hash of your mobile number (the hash cannot be turned back into the number and is not linked to your account number) only if, when your account was deleted, it was banned (a banned account can be deleted only after the appeal period has ended or the appeal has been decided and the ban is final; see 6.3) or was under a restriction for a Poster no-show or a Tasker no-show (see clauses 7.6 and 7.8 of the Refund and Dispute Rules). Its only use is to stop the same number being used to register again, or being added to another account, before that action ends: where the account was banned the hash is kept for 24 months, and where it was restricted the hash is kept until the restriction ends. When a number is stopped, you are asked to contact support. For any other account deletion, we do not keep a hash of your mobile number. Deleted data may remain in backups for up to 30 days.
5.5 Data breaches: where a breach of personal information is likely to result in serious harm to you, we assess it within 30 days of becoming aware of it and notify the Office of the Australian Information Commissioner (OAIC) and the people affected, following the approach of Part IIIC of the Privacy Act 1988 (the notifiable data breaches scheme).
6. Your rights
6.1 Access and correction: you may access and correct the personal information we hold about you. Most of your details can be viewed and edited directly in the app.
6.2 Obtaining a copy: you may request an export of your personal information in the app. The export file is available for download for 7 days after it is generated. It includes: account profile and consent records; account security records (sessions and their device information, phone-number change and recovery requests, email verification records) and the actions you yourself took on your account, with the network (IP) address at the time where one was recorded; tasks, offers, contracts and payment records; file records; messages; reviews (those you gave, and published reviews you received); notifications; your block list; warnings, restrictions and bans you received and your appeal records; the statements you made in disputes and the text of reports you made; your performance records; support tickets and the attachments you uploaded (including photos for refund requests and no-show reports); for Taskers, your tax reporting information and the locations recorded when you submitted completion; and your referral and attribution records, your own-client links and invitation code status (not including the other party's identity), and BB Voucher and own-client benefit records (and, if you are a Partner, your Partner details, commission summary and payout records, but no information about any user you brought). Payment records are exported according to your role in each payment: as the Poster, the amount, currency, status, refunded amount and your own card's issuing country; as the Tasker, the amount, currency, status, refunded amount, the platform service fee and the amount you received. The export does not include the other party's internal identifiers, the identity of anyone who made a report, the content of reports others made about you (providing it would disclose other people's information and could prejudice an investigation), or the Platform's internal handling notes.
6.3 Deleting your account: you may request deletion in the app. If you have a task in progress or still open for offers, an open dispute or a payment still being handled, that must be resolved first; if your account is banned, you can request deletion only after the appeal period has ended or the appeal has been decided and the ban is final; if you are a Partner, you must also first leave the Partner programme, and any commission recorded but not yet paid must first be paid or waived in writing. After you submit the request there is a 7-day waiting period, during which you can sign in and withdraw it. After that, the deletion is carried out, except for records the law requires us to keep (see 5.4).
6.4 Complaints: you may complain to us first (section 10), and we reply within 10 business days (a "business day" is a Monday to Friday that is not a public holiday in Victoria). To the extent the Privacy Act applies to us, you may also complain to the Office of the Australian Information Commissioner (OAIC).
7. Cookies and similar technologies
Our website and web app use only the cookies or similar local storage needed for sign-in, security and basic functionality. We do not use advertising or cross-site tracking cookies.
8. Minors
The Service is for people aged 18 and over. We do not knowingly collect information from minors.
9. Changes to this Policy
This Policy is version-controlled. The Platform may revise this Policy. A revision that is adverse to you (for example, adding a new purpose of use, a new disclosure to a third party or overseas, or a longer retention period) is notified by in-app notice, together with the full new version, at least 30 days before it takes effect. Other revisions (for example, clarifying wording, giving more specific explanations, or changes more favourable to you), and revisions that must be made immediately because the law requires it, may take effect when published, and the Platform will say so in the notice. After a new version takes effect, you must confirm your acceptance at your next sign-in.
10. Contact us
· Privacy matters, data requests, complaints and support: support@bangbanglife.com.au
Version v2.3. This Policy is publicly available on the Platform's website.