Privacy Policy

1. Who we are

Sepal Co Pty Ltd (ABN 62 689 669 814), Springfield Lakes QLD 4300, operates Sepal. This policy is written to be clear to overseas visitors too, though Sepal is built for the Australian market and is handled under Australian law.

2. Information we collect

From everyone with an account: name, email, birth month and year, your 18+ attestation, avatar image, and a default postcode/suburb/state used to centre your searches. Once you verify a phone number by SMS code, that number is stored against your profile.

From business owners, additionally: your ABN and the details it verifies against the Australian Business Register (entity name, business name, state, postcode); your business name, story, making process and category; logo and cover images; contact email, website and social links; your business’s base location; each product you list (name, category, description, price, images, materials/ingredients/allergens if you provide them, and an optional external purchase link); and each market day you schedule (address, time, and an optional public note). You may also set a separate verified phone number just for one market day’s reminder — for example, if a staff member is covering that day instead of you.

Once you publish a business, its verified contact phone number becomes visible to anyone viewing that listing, so visitors can call or text it directly. An unpublished or draft business’s phone number stays private. When you check in to a market day, Sepal also records your device’s precise location at that moment, to confirm you’re actually there — this is kept separately from your everyday approximate location and used only for that verification.

From visitors: browsing Sepal’s discovery pages doesn’t require an account and doesn’t collect any personal information by default. If you allow location access, your device’s approximate coordinates are sent with that search to show nearby results — Sepal doesn’t store these against an account unless you’re signed in and they become your saved default location. Saving a vendor is stored only in your browser’s local storage, on your own device — it’s never sent to or stored by Sepal.

Automatically, on the visitor side only: Sepal uses third-party analytics and advertising tools on visitor-facing pages (the discovery feed and public vendor profiles) — see Section 4 for which ones, and why. These collect things like pages viewed, device and browser information, approximate location derived from your IP address, and cookie or device identifiers. This does not apply to the vendor dashboard — pages a vendor only sees signed in to manage their own business never load any of these tools.

3. How we use it

To operate Sepal: show and search listings, verify businesses and phone numbers, confirm market-day attendance, send service emails and SMS codes, and suggest business and product categories using AI (Section 5). On the visitor side, additionally: to understand how people use the discovery feed, and to run and measure advertising campaigns, including retargeting people who visited but didn’t act, and building lookalike audiences of people who resemble Sepal’s best visitors, as described in Section 4.

4. Analytics & advertising

On the visitor-facing side of Sepal only, Sepal uses, or may use, third-party analytics and advertising tools to understand visitor activity and run advertising campaigns. These may include, for example:

• A web analytics tool (such as Google Analytics) — usage and traffic reporting, and, if connected, feeding search or display ad platforms.
• Advertising pixels (such as those offered by Meta, TikTok and Reddit) — for retargeting people who visited but didn’t act, and building lookalike audiences of people who resemble Sepal’s best visitors. A comparable server-side conversion API may also be used for the same purpose.

These tools set cookies or device identifiers and receive information about your visit — pages viewed, general location, device/browser details, and actions like viewing a market or vendor — so Sepal can measure and target advertising. Each operates under its own privacy policy once data reaches it, and each offers its own controls — for example, Google’s Ads Settings, and the ad-preference pages Meta, TikTok and Reddit each provide — which you can use to limit interest-based advertising independently of Sepal.

The vendor dashboard is deliberately excluded from all of this. Vendors are known, signed-in account holders, not anonymous ad targets, so vendor activity is recorded only in Sepal’s own first-party logging, described in Section 7 — never sent to any third-party analytics or advertising tool.

5. AI-assisted category suggestions

Sepal uses a third-party AI provider to suggest a business or product category. For a business, this sends the provider your business’s display name, Sepal’s own category options, your business story and making process. For a product, it sends the business’s category and story alongside the product’s name and description. In both cases, contact details, account credentials, images and any other private information are not included. The provider processes this text to generate suggestions; you can always override a suggestion before it’s saved.

6. Email & SMS, including marketing

Sepal sends service communications you can’t opt out of without stopping use of the relevant feature: SMS one-time codes to verify a phone number, and account or business emails like sign-up confirmation, email-change confirmation, and market-day reminders.

Sepal does not currently send marketing email. If that changes, Sepal will ask for your separate consent first, in line with the Spam Act 2003: every marketing message will clearly identify Sepal as the sender, won’t be sent without consent, and will include a working unsubscribe link that Sepal honours promptly. Service communications continue regardless of your marketing preferences, since they’re necessary to deliver the features you’re using.

7. Who we share information with

Sepal shares information only as needed to run the service: our hosting, database and authentication provider; our email delivery provider, for business-related emails; our SMS provider, for phone verification codes; our AI provider, for the category suggestions in Section 5; and, for visitors only, the analytics and advertising tools described in Section 4. Some of these providers may process data outside Australia. Vendor dashboard activity — Sepal’s own first-party event logs — is not shared with any advertising or analytics tool.

8. Data retention

Sepal keeps account and business data while your account is open. Archiving a business starts a 30-day recovery period before that data is more permanently removed. Expired phone verification codes are periodically removed. Backups may persist for a limited disaster-recovery period after deletion. Analytics and advertising data held by our third-party analytics and advertising tools is retained under each provider’s own settings, which Sepal configures conservatively.

9. Your rights & choices

You can access, correct or delete your account information from profile settings. For privacy questions, complaints, help with access or correction, or if a deletion request didn’t work as expected, contact hello@sepalapp.com.au. If you’re not satisfied with Sepal’s response, you can complain to the Office of the Australian Information Commissioner.

10. Children

Sepal is not directed at children, and you must be at least 18 to hold an account. Visitor-side analytics and advertising are not knowingly used to target children.

11. International data transfers

Some of Sepal’s service providers, including the analytics and advertising tools described in Section 4, may process data outside Australia. Sepal only works with providers that give appropriate protection to your information wherever it’s processed.

12. Security

Sensitive values like phone verification codes are stored as one-way hashes, not as plain text, and access to your data is restricted to your own account. No online service can guarantee perfect security, but Sepal takes reasonable steps to protect your information.

13. Changes to this policy

Material changes will be versioned, like this one, and where appropriate, presented for renewed acceptance.

14. Contact

Sepal Co Pty Ltd (ABN 62 689 669 814), Springfield Lakes QLD 4300 — hello@sepalapp.com.au.