Privacy policy

Draft prepared for OzzBaba. Have a lawyer review it for every country you operate in before relying on it.

OzzBaba ("OzzBaba", "we", "us") runs a global business-to-business marketplace. This policy explains what personal information we collect, why, who we share it with, and the choices you have. It is written to meet the Australian Privacy Act 1988 and the Australian Privacy Principles, and also describes rights under the EU and UK GDPR and California privacy law.

1. Who is responsible

OzzBaba is the controller of personal information described here. Contact us at the contact details on our Help page or for any privacy question or request.

2. What we collect

You give us:

• account details: name, work email, phone, company name, country, role (buyer, supplier or shipping company), password (stored hashed by our authentication provider);
• business details: tax or business registration number, address, logo, description, service countries, banking or payout details if payments are enabled;
• marketplace activity: products, quotes and RFQs, orders, delivery addresses, messages, reviews, disputes, shipment updates and files you upload;
• messages to support and anything you enter into the AI assistant or AI writing tools.

We collect automatically:

• device and usage data: IP address, approximate location (country or region), browser, app version, pages viewed and actions taken;
• cookies and similar technologies, as described in our Cookie policy;
• push notification tokens if you enable app notifications.

From others: payment, fraud-check and identity-verification partners (if enabled); other users (for example a buyer enters a delivery contact); public business registers when we verify a business.

3. Why we use it, and our legal basis

• Provide the Marketplace (contract): create accounts, show listings, process orders, arrange shipping, send order and message notifications.
• Verification, safety and fraud prevention (legitimate interests, legal obligation): check businesses, detect abuse, enforce our terms, comply with sanctions and anti-money-laundering rules.
• Support and disputes (contract, legitimate interests).
• Improve and secure the service (legitimate interests): analytics, debugging, security monitoring.
• Marketing and advertising (consent where required): measure campaigns and show relevant ads. You can say no in the cookie banner and unsubscribe from marketing emails at any time.
• Legal compliance (legal obligation): tax, accounting, responding to lawful requests.

4. AI features

When you use the AI assistant or AI writing tools, the text you enter and relevant marketplace data (for example product details you ask about) are sent to our AI provider to produce a reply. We do not use your content to train our own models. Do not enter confidential information or other people's personal information. The provider processes it under its own terms for us as a service provider.

5. Who we share it with

• Other users: a supplier sees the buyer details needed to fulfil an order (name, company, delivery address, phone). A shipping company sees pickup and delivery details for shipments it is booked on. Your public profile (company name, country, description, ratings) is visible to everyone.
• Service providers that run the platform for us: hosting and database (Supabase, Vercel), email (Resend), SMS (Twilio), push notifications (Expo), AI (Anthropic), spam protection and maps (Google), analytics and advertising platforms you consent to (Google, Meta, LinkedIn, TikTok), and payment partners if enabled. They may only use the data to provide their service to us.
• Professional advisers, regulators and authorities where the law requires or to protect rights and safety.
• A buyer of our business in a merger or sale, under confidentiality.

We do not sell personal information for money. Some advertising features can count as "sharing" or "selling" under California law. You can opt out by declining cookies or contacting us.

6. International transfers

We and our providers operate in several countries, including Australia, the United States and the EU. If we send personal information out of your country we use safeguards the law accepts, such as standard contractual clauses, or take reasonable steps to make sure the recipient protects it consistently with the Australian Privacy Principles.

7. How long we keep it

We keep information while your account is open and as long as needed for the purposes above. Order, tax and dispute records are kept for the period the law or our legitimate needs require (generally 5 to 7 years, depending on the country). When you delete your account we delete or anonymise your personal information, except records we must keep for open orders, disputes and legal obligations.

8. Security

We use encryption in transit, access controls, and row-level security in our database. No system is perfectly secure. If a breach is likely to cause serious harm we will notify affected people and regulators as the law requires.

9. Your rights

Depending on where you live you may have the right to: access your information; correct it; delete it; restrict or object to some uses; receive it in a portable format; withdraw consent; opt out of marketing and of "sale" or "sharing"; and complain to a regulator. You can edit your profile and delete your account in the app or on the website (Account page). For any other request email the contact details on our Help page. We may need to verify your identity. We will not penalise you for exercising your rights.

• Australia: you can ask for access or correction under the Privacy Act and complain to us. If unhappy, contact the Office of the Australian Information Commissioner (oaic.gov.au).
• EU/UK: you can complain to your local data protection authority.
• California: you can ask what we collect and disclose, ask us to delete or correct it, and opt out of sale or sharing. We do not knowingly sell the personal information of anyone under 16.

10. Children

The Marketplace is for businesses and people aged 18 or over. We do not knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.

11. Changes

We will post updates here with the date. For material changes we will notify you by email or in the app.

12. Contact

• OzzBaba

• Email: the contact details on our Help page