Vottee Privacy Policy

Section 1 — Scope of this Policy

This Privacy Policy applies to personal information collected through the Platform, including where a person:

• creates an account;
• creates, manages or participates in a poll;
• completes a guest, verification or consent form;
• uploads content to a poll, including text or images;
• contacts us about the Platform; or
• otherwise interacts with the Platform, whether through the web application or the mobile application.

In this policy, personal information has the meaning given in the Privacy Act 1988 (Cth), and includes information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Section 2 — Information We Collect

We may collect the following categories of personal information.

Account registration

When a user creates an account, we collect an email address and password (handled by our authentication provider). We also collect a display name when the user completes their profile. Where a user signs up using a referral link, we store a referral association between the new account and the referring account so we can operate the referral program (including gifted Premium entitlements). Each account may also be assigned a unique referral code for sharing. We may temporarily store a referral code against the signup email address so attribution still works if email verification is completed on a different device or browser. On the web application, we may also store a referral code in the browser's local storage when you visit a signup link with a referral parameter.

Guest voting and public vote forms

Where a person votes without an account (or completes related public vote form steps), we may collect:

• name;
• email address;
• an age attestation confirming they are at least 16, or have parent or guardian permission to submit the form;
• an optional opt-in to receive reminder emails when voting opens or closes for that poll;
• an optional device push token when they enable voting-open and voting-closed notifications in the Vottee mobile app for that poll;
• their vote answers and related submission timestamps;
• the voter's display name and the time of their vote in an in-app notification history shown to the poll owner.

We may also store limited details in the browser's local storage on their device so they do not have to re-enter them on later visits from the same browser. This may include the voter's name and email, and (where used) previous answer selections for convenience. That local storage is controlled by the user's device and browser settings.

Reminder opt-in emails can be withdrawn using the unsubscribe link in those emails (or equivalent unsubscribe flow on the Platform). App notifications can be turned off on the poll vote screen or in system settings. Age requirements for guest forms are described further in Section 5.

Contact and support enquiries

When a person contacts us through the Platform contact form, we collect:

• name;
• email address;
• subject; and
• message content.

These details are sent to us by email (via our email delivery provider) so we can respond. We may also use bot-protection on the contact form. Contact form submissions are not stored as a separate database record in the Platform; copies may be retained in our email systems for as long as reasonably needed to handle the enquiry.

Poll participation and poll administration

When a user creates, manages or participates in a poll, we may collect:

• account and participation details;
• information submitted in connection with a poll;
• poll administration records;
• audit and activity logs relating to use of the Platform;
• collaborator invitation details (such as invitee email addresses) where a poll owner invites others to help manage a poll;
• report details submitted through the Platform's report function (which may include free-text descriptions and, where provided, a reported answer); and
• information needed to verify participation or investigate reports.

Poll options and user-submitted content

Poll creators may enter poll option text and other content into the Platform. That content may, in some cases, include personal information, including the names of individuals and, in limited cases, minors.

Poll creators may also upload an image for use with a poll. Uploaded images may contain personal information, including an individual's likeness, name, school, team, club or other identifying details.

Poll creators must only enter or upload content where they are authorised to do so, and must not include personal information relating to a minor or any person unable to provide their own consent unless the required authority or consent has been obtained.

Parental or guardian consent records

Where consent is required for the inclusion of a minor's personal information, we may collect and retain:

• parent or guardian full name;
• parent or guardian email address;
• the date and time consent was provided, confirmed or withdrawn;
• associated audit log records; and
• records of the consent workflow, including confirmation and withdrawal events.

Subscription and billing information

Where a user subscribes to a paid plan, payment information is processed by our third-party payment providers. We receive subscription-related information such as:

• subscription status;
• plan type; and
• renewal or expiry details.

We do not store full payment card details on our own systems.

Technical and usage information

We may collect technical and usage information necessary to operate, secure and improve the Platform, such as:

• login and session information (including last login timestamps);
• device or browser information;
• IP address or approximate location information;
• error, security and diagnostic logs;
• information generated by bot-protection and security challenge services (such as Cloudflare Turnstile), which may include challenge tokens, verification results, IP address, and limited device or browser signals used to distinguish human users from automated traffic; and
• records of interactions with the Platform.

Mobile application information

Where a user accesses the Platform through the mobile application, we may additionally collect:

• device identifiers and operating system information;
• push notification tokens, where the user has granted permission (used to deliver notifications via our push delivery provider);
• camera or photo library access, only where the user chooses to upload a poll cover image and grants the relevant device permission; and
• information about in-app purchases or subscription status as provided by the relevant app store platform.

We do not receive full payment card details from Apple or Google in connection with in-app purchases. Payment processing for in-app purchases is handled directly by Apple (via the App Store) or Google (via Google Play) in accordance with their respective terms and privacy policies.

Section 3 — How We Use Personal Information

We may use personal information for the following purposes:

• to create and manage user accounts;
• to operate polls and enable users to create, share, administer and participate in polls;
• to verify the identity of users completing guest, verification or consent forms;
• to process and record parental or guardian consent where required;
• to maintain audit trails for security, compliance and dispute handling;
• to detect, prevent and respond to spam, abuse, fraud and automated or malicious activity, including through bot-protection and security challenge services;
• to provide transactional and service-related communications;
• to send poll reminder emails where a voter has opted in, and to process unsubscribe requests;
• to manage subscriptions and payments through our payment providers;
• to operate our referral program, including attributing signups, tracking eligibility for gifted Premium, and sending referral-related notifications;
• to show poll owners an in-app history of vote notifications for polls they created, including the voter's display name and the time of the vote;
• to respond to enquiries, complaints and requests, including messages submitted through the contact form;
• to investigate reported polls, misuse of the Platform, or suspected breaches of this policy;
• to protect the safety of users, including minors;
• to maintain, secure and improve the Platform; and
• to comply with legal and regulatory obligations.

We will not use personal information for a purpose that is unrelated to these purposes unless permitted or required by law, or unless consent has been obtained.

Who may access personal information

Personal information held in connection with the Platform may be accessed by authorised personnel of Snowyden Software (JTC Software Pty Ltd) where reasonably necessary for the purposes described in this policy, including support, security, abuse investigation, billing support, and platform operations. That access may occur through internal operational tools that are restricted to authorised accounts and are not available to the public.

We may also disclose personal information:

• to third-party service providers who process information on our behalf, as described in Section 7;
• to poll creators and authorised poll collaborators, where the information relates to participation in a poll they manage (for example, voter name, email and vote answers for that poll). The poll owner may also see the voter's display name and vote time in that poll's in-app notification history;
• to a referring user, where limited information about a successful referral signup is needed to operate the referral program (for example, the new user's display name in a notification or email);
• where required or authorised by law, including to law enforcement or regulators; or
• with the individual's consent, or otherwise where permitted under the Privacy Act 1988 (Cth).

Section 4 — How Poll Information is Visible

Poll participation on Vottee is not public by default in the way described below.

Where a person participates in a poll:

• their information is collected for participation, verification, administration and related Platform purposes;
• poll results and voting information are generally visible only to the poll creator or authorised poll administrators; and
• a participant's personal information is not made visible to other voters by default unless the relevant poll setup or feature expressly provides otherwise.

Poll creators are responsible for configuring and using polls appropriately and for ensuring they only include or upload content they are authorised to use.

Section 5 — Minor Data and Consent Requirements

Where a poll creator wishes to include the name, image or other personal information of a person under the age of 16, or any person unable to provide their own consent, the poll creator must ensure the required consent or authority has been obtained.

Where our consent workflow is used, the following process applies:

1. named people in preset options are treated as under 16 unless the poll creator confirms they are 16 or older;
2. a consent email may be sent to the relevant parent or guardian for anyone not confirmed as 16 or older;
3. the parent or guardian may confirm consent by completing the consent process; and
4. the relevant content may remain available only once consent has been confirmed, where consent is required.

We retain records of the consent process for audit, compliance and safety purposes.

If a parent or guardian withdraws consent, we will take reasonable steps to remove or restrict the relevant content as soon as reasonably practicable.

A parent or guardian may withdraw consent by:

• using the withdrawal link provided in the relevant email, where available;
• contacting the poll owner; or
• contacting us at admin@snowyden.com.au.

If a poll includes personal information about a minor or another individual in a way that may breach this policy, it may be reported through the Platform or by contacting us. We may pause, restrict, review or remove the poll while the matter is assessed.

If we become aware that personal information about a person under 16 has been collected, used or disclosed without the required consent or authority, we will take reasonable steps to investigate and take appropriate action, which may include restricting access to, removing, or deleting the relevant information.

Section 6 — Image Uploads

Poll creators may upload images for use with a poll.

Images uploaded to the Platform may contain personal information. This may include a person's image, likeness, name, uniform, school, club, team or other identifying details.

By uploading an image, the poll creator represents that they:

• are authorised to upload and use the image in connection with the poll;
• have obtained any consent required from the individuals shown or from a parent or guardian, where applicable;
• will not upload unlawful, misleading, offensive or infringing content; and
• understand that we may remove, disable or restrict access to an image if we believe it may breach this policy, another person's rights, or applicable law.

We may store uploaded images and associated metadata for the purposes of operating the Platform, administering the poll, handling reports or complaints, maintaining audit records, and complying with legal obligations.

Section 7 — Third-Party Service Providers

We use third-party service providers to help operate the Platform. These may include providers that support hosting, infrastructure, authentication, email delivery, bot protection and payment processing. We do not use advertising networks to serve ads on the Platform.

Current providers may include:

• Vercel, for frontend and backend hosting and deployment;
• Supabase, for authentication, database and related infrastructure services;
• Resend, for transactional email delivery, including consent emails, reminder emails, collaborator invites, subscription lifecycle notices (such as when Premium ends and all open polls are closed if they exceed the free limit), contact form delivery and other account or poll notifications;
• Cloudflare Turnstile, for bot protection and security challenges on account and public forms (including login, signup, voting, poll unlock, reporting and the contact form);
• Firebase Cloud Messaging (Google), for delivering push notifications to the mobile application where permission has been granted;
• Stripe, for subscription and payment processing on the web application; and
• Apple (App Store) and Google (Google Play), for in-app purchase and subscription processing on the mobile application.

Where bot-protection or CAPTCHA-like challenge services are used, the relevant provider may process limited technical information (such as IP address and browser or device signals) to verify that a request is likely made by a human user. That processing is subject to the provider's own privacy terms. For Cloudflare Turnstile, see Cloudflare's privacy documentation and related terms.

These providers may handle personal information on our behalf in connection with the services they provide to us. They may also be subject to their own privacy policies and contractual terms.

For in-app purchases made through the mobile application, payment processing is handled directly by Apple or Google. We do not receive or store full payment card details from these transactions. Users should refer to Apple's and Google's respective privacy policies for information about how they handle payment and personal information.

Section 8 — Data Storage and Cross-Border Disclosure

We store Platform data in Australia, including our database and core hosted application environment where configured in Australia.

However, some third-party providers may process or access limited personal information outside Australia in connection with the services they provide. For example:

• emails sent through Resend may be processed through infrastructure located in Japan;
• bot-protection and security challenge processing by Cloudflare may involve overseas processing;
• push notification delivery through Firebase Cloud Messaging may involve overseas processing;
• payment-related processing by Stripe may involve overseas processing; and
• in-app purchase processing by Apple or Google may involve processing in the United States or other jurisdictions in which those providers operate.

Where we disclose personal information to overseas service providers, we take reasonable steps to ensure that the information is handled in a manner consistent with applicable Australian privacy law, having regard to the nature of the service and the information involved.

By using the Platform, you acknowledge that some disclosures or processing may occur outside Australia where this is reasonably necessary for the operation of the Platform and related services.

Section 9 — Cookies and Similar Technologies

We may use cookies, session technologies and similar technical tools where reasonably necessary to operate, secure and improve the Platform.

These technologies may be used for purposes such as:

• maintaining user login sessions;
• supporting authentication and account security;
• supporting bot protection and security challenges (including Cloudflare Turnstile), which may set or rely on cookies or similar technologies;
• remembering functional preferences; and
• monitoring performance, reliability and basic usage of the Platform.

We may also use browser local storage (rather than cookies) for limited purposes such as remembering guest voter details on public vote pages, storing a referral code from a signup link, or similar convenience features. That local storage is controlled by the user's device and browser settings.

We do not display third-party advertisements on the Platform, including on public vote pages. We do not use advertising networks, and we do not use cookies or similar technologies for advertising or ad personalisation.

Users can usually manage certain browser-based cookies through their browser settings. Disabling some technical features may affect how parts of the Platform operate.

Section 10 — Subscriptions and Payments

Vottee offers optional subscription plans, available through the web application and the mobile application.

Web application subscriptions

Subscription management and payment processing for the web application are handled through Stripe.

When a user subscribes through the web application:

• payment information is collected and processed by Stripe;
• we receive limited subscription and billing status information; and
• we do not store full payment card details on our own systems.

Mobile application subscriptions and in-app purchases

Subscription management and in-app purchase processing for the mobile application are handled directly by Apple (via the App Store) or Google (via Google Play), in accordance with their respective terms and policies.

When a user subscribes or makes a purchase through the mobile application:

• payment information is collected and processed directly by Apple or Google;
• we receive limited subscription and entitlement status information from the relevant app store platform; and
• we do not receive or store full payment card details from these transactions.

For billing enquiries relating to the web application, contact admin@snowyden.com.au. For billing enquiries relating to in-app purchases, users should contact Apple or Google directly through their respective support channels.

Section 11 — Data Security

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification and disclosure.

These steps may include:

• encrypted data transmission using HTTPS;
• access controls limiting internal access to personal information;
• secure authentication and credential management;
• logging and monitoring of relevant system events; and
• audit records relating to consent, account and poll activity.

No method of transmission over the internet, or method of electronic storage, is completely secure. Because of this, we cannot guarantee absolute security.

Section 12 — Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, and as otherwise required or permitted by law.

Unless a longer retention period is required for legal, security, dispute, audit or compliance reasons:

• account data is retained for the duration of the account. When you delete your account through the Platform, we permanently delete your account and associated poll data as described in our Terms of Service, subject to any information we must or may retain under this clause;
• in-app vote notification records for a poll (including the voter's display name and the time of the vote) are removed when that poll is deleted;
• guest vote records and poll reminder opt-in records associated with a poll are removed when that poll (or related account records) is deleted. Guest identity details (such as name and email stored as a participant record) may be retained in Platform systems after related votes are removed, including where the same identity has been used across multiple polls, until we destroy or de-identify the record or action a valid deletion request;
• poll reminder opt-in records are retained until the subscription is unsubscribed or otherwise deactivated, or until related poll or account records are deleted;
• parental or guardian consent records and related audit logs are retained for the duration of the relevant poll and associated account records, unless a longer period is reasonably required for compliance, safety, complaint handling or dispute resolution;
• uploaded images and related poll content are retained for the duration of the relevant poll and associated account records, unless earlier removed or a longer period is required for review, reporting, legal or safety reasons; and
• contact form messages delivered by email may be retained in our email systems for as long as reasonably needed to handle the enquiry;
• referral program records (including referral associations, referral codes, and pending signup attribution records) are retained for as long as reasonably necessary to operate the program, resolve disputes, and maintain audit records, including while the relevant accounts remain active; and

When personal information is no longer required, we will take reasonable steps to destroy or de-identify it, unless we are required or permitted by law to retain it.

Section 13 — Access and Correction

A person may request access to the personal information we hold about them, or request correction of inaccurate, incomplete or out-of-date information, by contacting us at admin@snowyden.com.au.

We may need to verify the identity of the person making the request before providing access or making a correction.

We will respond within a reasonable period and in accordance with applicable privacy law. In some cases, we may refuse access or decline a correction request where permitted by law. If that occurs, we will provide reasons where required.

Section 14 — Complaints

If you believe we have handled personal information in a way that does not comply with the Privacy Act 1988 (Cth) or the APPs, you may lodge a complaint by contacting us at admin@snowyden.com.au.

When handling a complaint, we may:

• ask for further information to verify identity or understand the complaint;
• review relevant records, audit logs and communications;
• investigate the issue internally; and
• provide a written response within a reasonable time.

We aim to respond to privacy complaints within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) through oaic.gov.au or by calling 1300 363 992.

Section 15 — Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform, our practices, our service providers, or our legal obligations.

When we make a material change, we will update the "Last updated" date at the top of this policy. Continued use of the Platform after an updated policy takes effect is taken as acceptance of the updated policy, to the extent permitted by law.

Section 16 — Contact Us

For privacy-related questions, requests or concerns, please contact:

Snowyden Software (JTC Software Pty Ltd)
Email: admin@snowyden.com.au
Contact form: vottee.app/contact