Privacy Policy

The short version. We collect the information we need to run Nyvo: your sign‑in details, your profile, the posts and events you create, the Tickets you buy or sell, and basic device and usage data. We don't sell your data. We share it only with the service providers we need to operate the Service, with Event Organizers (your name and email, so they can run the Event you booked), with Meta if you agree to it on an Event page whose Organizer measures their ads, and where the law requires it. You have a right to access, correct and (in most cases) delete your information. We comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, for Users in Brazil, with the LGPD.

This Privacy Policy describes how Nyvo Pty Ltd (ACN 703 424 471, ABN 16 703 424 471), which operates Nyvo (we, us, our), collects, uses, discloses and otherwise handles Personal Information when you use the Service. Capitalised terms have the meanings given in our Definitions.

This Policy should be read together with our Terms of Service, Acceptable Use Policy, and (if you are an Organizer) the Organizer Agreement.

---

1. Who we are and how to contact us

Nyvo is operated by Nyvo Pty Ltd (ACN 703 424 471, ABN 16 703 424 471), a company registered in New South Wales, with address for notices at Unit 11, 7 Myers Street, Roselands NSW 2196, Australia. We are an "APP entity" under the Privacy Act and, in relation to Users resident in Brazil, the "controller" (controlador) under the LGPD. Until 5 November 2026 Nyvo was operated by Alick Ceglys Buscariolli as a sole trader (ABN 25 545 382 512). On that date he transferred the Nyvo business, including the Personal Information we hold, to Nyvo Pty Ltd (see section 4.5), which handles it under this Policy for the same purposes.

You can contact us about privacy matters in any of the following ways:

• Email: hello@nyvo.com.au
• DPO / Encarregado (LGPD): hello@nyvo.com.au (the same mailbox is monitored by our designated privacy contact)
• Post: Privacy Officer, Nyvo Pty Ltd, Unit 11, 7 Myers Street, Roselands NSW 2196, Australia

---

2. The information we collect

We collect Personal Information from you directly when you sign up and use the Service, and from third parties who help us operate the Service (such as Firebase, Stripe and our image moderation provider). The table below lists, by category, what we collect.

2.1 Account and profile

2.2 Your Content

We collect and store the Content you create on the Service, including:

• posts (text, images and polls), the audience scope you choose, mentions you make, and the moderation status of the post;
• comments on posts, businesses and articles, including mentions you make;
• reactions (like, love, haha, wow, sad, angry) and poll votes;
• event listings you create as an Organizer (title, description, location, latitude/longitude, city, time zone, start/end times, cover image, ticket price and currency);
• RSVPs and Ticket purchases (see section 2.3);
• business directory listings you create (name, category, description, address, latitude/longitude, contact methods, opening hours, photos);
• housing and job listings you create;
• articles you author (if you are a community leader);
• reports you file about other Content or other Users;
• bookmarks you save; and
• your English‑tips learning activity: the English level you choose, your current practice streak, your last practice date and your total days practised. We do not store your individual quiz answers — quiz performance is counted only as anonymous per‑question totals that are never linked to you.

We also automatically capture link previews when you paste a URL (title, description, image) so we can render them in the feed.

2.3 Events and Tickets

For Tickets, we collect and store:

• the Event the Ticket is for and the User who bought it;
• the Stripe payment intent ID, amount paid, Platform Fee, the QR code and the Ticket's status (PAID, REFUNDED, CHECKED_IN);
• the time the Ticket was issued and (where relevant) checked in.

We do not see or store your card number, CVC or full card details. Stripe collects and processes payment card information directly under PCI DSS.

2.4 Information shared with Organizers

When you buy or register for a Ticket, the Organizer of that Event can see, through the Service, your name, email address, profile picture (if you have one), the ticket type you hold and its status (paid, refunded or checked in), and when you bought it and checked in. This applies whether you bought with a Nyvo account or as a guest. The Organizer can download this as an attendee list, print it as a door list, and keep a copy on their device so they can check people in without internet. Staff the Organizer authorises can see it too; staff who only run the door see names and tickets, not email addresses.

We share this so the Organizer can run the Event you booked: check you in, contact you about changes, cancellations, refunds or access, and meet their legal duties as the seller. Once the Organizer has it, they handle it under their own privacy obligations, and our Organizer Agreement limits them to using it for your Event. They may not add you to a marketing list unless you agree to that with them directly. If you choose to interact with an Organizer outside the Service (for example, to ask a question by email), any further information you share is between you and the Organizer.

Booking integrations (opt‑in). Some businesses — typically tour operators — run their own booking or customer system and can connect it to Nyvo so that bookings for their Events appear there automatically. When you buy a Ticket for (or register for) an Event run by one of those businesses, you will see a tick box at checkout that names the business and asks whether you consent to us sharing your name and email address with them so they can contact you about that booking.

That box is never pre‑ticked, and declining does not affect your purchase — you still get your Ticket, and the booking itself is still sent to the business without your name or contact details. If you do consent:

• we send the business your name and email address, together with the booking details (which Event, which ticket type, quantity, amount, and the current status of each Ticket);
• the business's system may be located outside Australia, in which case Australian privacy law may not protect the information once it is there and we will not be accountable to you under the Australian Privacy Principles for how that business handles it — consenting to the tick box is your consent to that overseas disclosure;
• the business is contractually required, under our Organizer Agreement, to use that information only for your booking and to delete it if we tell them you have asked us to; and
• if you later delete your Nyvo account or ask us to erase your information, we notify every business we sent your details to and instruct them to delete it. We cannot delete it from their systems ourselves, so we rely on that contractual obligation.

You can withdraw consent by contacting us at hello@nyvo.com.au. Withdrawing stops any further sharing immediately, including for bookings already made.

2.5 Device, app and usage information

2.6 Communications

• Transactional emails are sent through Resend (for example, sign‑up verification, ticket purchase confirmations, refund notices).
• Marketing emails (for example, news about Nyvo, Events and offers, or a note inviting you back if you have not used Nyvo for a while) are only sent if you have said yes to them, either by ticking the unticked box when you sign up or by turning on "Nyvo news and offers by email" in your settings. We record when and where you gave that consent. You can withdraw it at any time by turning that setting off or by clicking "unsubscribe" in any marketing email, and we will stop within five business days. Saying no never affects your Account, and transactional emails still reach you.
• Push notifications are sent through Firebase Cloud Messaging. You can disable categories from your notification preferences in the app.

2.7 Cookies and similar technologies (web)

Our website and our web app (app.nyvo.com.au) use a small number of cookies and equivalent technologies:

• Strictly necessary cookies (always on): session cookies, your locale preference, and a cookie that remembers your consent choices.
• Analytics cookies (consent‑gated): if you accept, Firebase Analytics may set cookies operated by Google to measure how the site is used.
• An Organizer's advertising pixel (consent‑gated, some Event pages only): see below.

Our consent banner gives you a clear "Reject all" option and a "Manage preferences" link. Your choice is stored and can be changed any time from the footer link "Cookie preferences".

Organizer advertising pixel (Meta Pixel). Some Organizers advertise their Events on Facebook and Instagram and want to know whether their ads work. If an Organizer has added their own Meta Pixel to their account, the Event pages they host on app.nyvo.com.au ask whether you allow it before anything loads. The question names the Organizer and Meta. Nothing loads unless you choose to allow it. If you choose not to, or you ignore the question, the pixel does not load and nothing is sent to Meta. Your choice is kept in that browser.

If you allow it:

• Meta's code loads on that Event page and Meta can set its own cookies (for example _fbp and _fbc) and receive your IP address, browser and device details, and the address of the page;
• we tell Meta that you viewed the Event page and, if you buy a Ticket for that Event, that a purchase happened, with its total amount and currency;
• we do not send Meta your name, email address, phone number or any other details from your Account or from the checkout form, and we switch off Meta's automatic collection of form fields and page details;
• Meta may link this to your Facebook or Instagram account and use it under its own Privacy Policy, including to show you ads and to measure the Organizer's ads. Meta may handle it outside Australia (see section 5).

We never load a Nyvo advertising pixel, and the Nyvo mobile app never loads this pixel. You can change your choice at any time from the link at the bottom of that Event page. Changing it stops anything further being sent, but it cannot remove what Meta has already received. To ask Meta about that, use Meta's own privacy tools.

2.8 Audit and security logs

We keep an internal AuditLog that records administrative and moderation actions on the Service (for example, when content is approved or rejected, when an Account is auto‑suspended, when an upload is removed by image moderation). These logs may identify the actor, the target and the action taken. They are used for safety, abuse investigation and accountability.

2.9 Information about people you mention or report

Where you mention or report another User, we process Personal Information about them as part of the normal operation of the Service (for example, to deliver a mention notification or to triage a report).

2.10 Direct messages

When you send a direct message to another User, we collect and store the message so we can deliver it and keep a record for safety and moderation:

• the text you write, any photo you attach, and any link preview generated from a URL in the message;
• who sent it, who received it, the conversation it belongs to, and the times it was sent, delivered and read;
• whether a message was deleted or reported, and whether you have muted or blocked the other person.

Direct messages are private between you and the other participant. They are not end‑to‑end encrypted: we store them in our database, encrypted in transit (TLS) and at rest, so they can be delivered across your devices and reviewed by our safety team only when a message or conversation is reported. Because they are not end‑to‑end encrypted, please do not share anything in a direct message that you would not want a moderator to be able to see if the conversation is reported.

Photos you send in a direct message are moderated by Google Cloud Vision SafeSearch in the same way as any other image you upload (see clause 4.5 of the Terms and the Acceptable Use Policy). If a URL appears in your message, we fetch a link preview (title, description and image) so we can render it, exactly as we do for posts.

So that new messages and read receipts appear without you having to refresh, we use a real‑time relay operated on Google Firebase. The relay only ever carries metadata — a signal that a conversation has changed, the participants' sign‑in identifiers, and read timestamps. The content of your messages (text, photos and link previews) is never written to the relay. It stays in our own database and is fetched over our authenticated API.

Plan group chats work the same way, except that every member of the chat can see the messages sent while they are a member.

2.11 What we don't collect

We do not collect:

• credit‑card numbers, expiry dates or security codes (these go to Stripe);
• biometric information. Where a business owner chooses to confirm their identity for business verification (section 2.12), Stripe collects a photograph of their face and compares it to their identity document. Nyvo does not receive, see or store that photograph;
• government identifiers. Stripe may collect them for KYC on Organizers, and for the optional identity confirmation in section 2.12 — see sections 2.12 and 5. Nyvo does not receive, see or store the identity document, its number, or the date of birth on it;
• sensitive information as defined in section 6 of the Privacy Act, unless you choose to include it in a post (which we discourage) or you choose the identity confirmation in section 2.12.

2.12 Business verification

If you subscribe a business to verification, we collect the Australian Business Number (ABN) you give us and the information the Australian Business Register publicly returns for it, including the registered entity name, entity type, ABN status and the date of that status. The Australian Business Register is a public register maintained by the Australian Government.

Where the ABN is registered to a sole trader, we may ask you to confirm your identity through Stripe Identity. If you choose to do this, Stripe collects a government photo identity document and a photograph of your face, and compares them. Nyvo receives only two things: a reference number for the Stripe session, and whether the name on your document matched the name on the register. We do not receive, see or store the document, the photograph of your face, the document number, or your date of birth. Stripe handles that material under Stripe's own privacy policy and may process it outside Australia, including in the United States (see section 5).

A photograph of your face used to confirm your identity this way is sensitive information under the Privacy Act. We ask Stripe to collect it only with your consent, which you give by choosing this option, and only where it is reasonably necessary to decide your verification request.

Confirming your identity this way is optional. If you would rather not, a person can review your application manually instead. We tell you this before you are sent to Stripe.

We use this information only to decide your verification request, to show the date of the check on your business page, to re-check the ABN against the register at least every twelve months, and to keep a record of the decision.

2.13 Plans

When you host or join a Plan we collect: the Plan details (title, description, activity, cover image, date and time, suburb and an approximate area, and, if the Host adds one, the exact meeting place); who hosts, joins, asks to join, leaves or is removed, and where you found the Plan; who asked to be told when a spot opens; your answer to "Did you make it?" and, if you don't answer, whether the Host marked you as attending; whether you left shortly before the start; your private "Who would you meet again?" choices; and your "Keep this group?" vote.

The exact meeting place is shown only to the Host and members who have joined, and we delete it 30 days after the Plan ends. Your "meet again" choices are never shown to anyone unless the choice is mutual, in which case we tell you both and open a conversation between you; choices that aren't matched are deleted after 30 days. Attendance is used to show how many people went, to understand whether Plans work, and to keep Plans safe; it is never shown to other members and is aggregated after 12 months.

Anyone with a Plan's link, including people without a Nyvo account, can see its title, activity, cover, suburb, date and time, how many people are going, and the Host's first name and photo, but never the exact place or other members' names or photos.

Messages in a Plan's group chat are handled as described in section 2.10.

---

3. How we use Personal Information

We use Personal Information for the following purposes. For each purpose we state the lawful basis under the Privacy Act and, where relevant, under Article 7 of the LGPD.

We do not engage in automated decision‑making with legal or significant effects on you, other than:

• automatic content removal when our profanity filter or Google Cloud Vision SafeSearch returns a positive result;
• automatic temporary suspension of an Account when the volume of substantiated reports against it exceeds the threshold described in the Acceptable Use Policy.

In both cases you can request a human review by contacting hello@nyvo.com.au (for content) or hello@nyvo.com.au (if a privacy concern is involved).

---

4. Who we share information with

4.1 Other Users

Some information is visible to other Users by design — your display name, profile picture, the Content you post and the audience scope you set for it. Your email, phone, date of birth, gender, country of residence and Stripe account details are not shown to other Users.

When you host a Plan, anyone with the Plan's link, including people without a Nyvo account, can see the Plan's title, activity, cover, suburb, date and time, how many people are going, and your first name and photo. They never see the exact place or other members' names or photos (see section 2.13).

4.2 Organizers

If you buy or register for a Ticket, the Organizer of that Event (and staff they authorise) receives your name, email address, profile picture, ticket type, ticket status and purchase and check‑in times, as described in section 2.4, to run that Event. They are responsible for how they handle it once they have it.

Separately, if you tick the box at checkout that names the business, the opt‑in booking integration also sends your name and email address into that business's own booking system, which may be outside Australia (section 2.4).

We never give an Organizer your date of birth, gender, country of residence, phone number, other profile details, or any payment or Stripe details.

4.3 Service providers (sub‑processors)

We use the following third parties to operate the Service. Each is bound by contract to handle Personal Information only as we instruct and consistent with applicable privacy laws.

We may add, change or remove sub‑processors. We will publish an up‑to‑date list at this page; for material changes we will give notice through the Service.

4.4 Law enforcement and legal process

We may disclose Personal Information where we reasonably believe it is necessary to:

• comply with a law, regulation, valid court order or lawful request from a regulator or law‑enforcement agency;
• enforce the Terms or investigate breaches of the Acceptable Use Policy;
• protect the safety of any person or the public;
• prevent or investigate fraud; or
• establish, exercise or defend legal claims.

Where we are permitted to, we will notify you before disclosing Personal Information in response to a request.

4.5 Corporate transactions

If Nyvo is involved in a merger, acquisition, financing, restructure, sale or insolvency, Personal Information may be transferred or disclosed as part of that transaction, subject to the recipient agreeing to obligations consistent with this Policy.

4.6 No sale of Personal Information

We do not sell Personal Information. We do not share it for advertising, with one exception that you control: if you allow it on an Event page, the Organizer's Meta Pixel sends Meta the information described in section 2.7. Nobody is paid for this information.

4.7 Meta, for an Organizer's ads (only if you allow it)

If an Organizer has added their own Meta Pixel and you choose to allow it on that Organizer's Event page, Meta Platforms, Inc. (United States) and, where Meta's own terms say so, Meta Platforms Ireland Limited receive the information described in section 2.7. Meta is not our service provider. It receives the information under its own terms and its own Privacy Policy, and the Organizer receives Meta's reports about their ads. The Organizer is responsible, under our Organizer Agreement, for telling you about their use of Meta's tools in their own privacy notice.

---

5. Cross‑border transfers (APP 8 and LGPD)

Most of our service providers are based in or process data in the United States, the European Union or other jurisdictions outside Australia. Where Personal Information is transferred outside Australia, we take reasonable steps to ensure that the recipient handles it in a way consistent with the Australian Privacy Principles, including by relying on contractual protections (such as Stripe's, Google's, Resend's and Sentry's data processing addenda).

Where you choose to confirm your identity for business verification (section 2.12), the identity document and the photograph of your face are collected and held by Stripe, not by Nyvo, and may be processed by Stripe outside Australia, including in the United States. Nyvo does not receive that material. We tell you this before you are sent to Stripe, and the check is optional — a manual review by a person is available instead.

If you allow an Organizer's Meta Pixel on an Event page (section 2.7), Meta receives the information directly from your browser and may handle it in the United States, Ireland and other countries where Meta operates. We have no contract with Meta about this information. That is why we ask you first and load nothing unless you allow it. By allowing it, you agree to this overseas disclosure knowing that we cannot make Meta handle it in line with the Australian Privacy Principles, and that we will not be accountable to you under those Principles for what Meta does with it (APP 8.2(b)). For Users resident in Brazil, this transfer is made with your specific consent (LGPD Art. 33, VIII).

For Users resident in Brazil, international transfers rely on ANPD‑recognised mechanisms (such as standard contractual clauses or transfers to jurisdictions with an adequate level of protection), or are made with your specific consent or on another legal basis allowed by Articles 33–36 of the LGPD.

---

6. How long we keep information (retention)

We retain Personal Information only as long as we need it. The table below sets out our default retention periods. Where a longer period is required by law (for example, for tax records), the longer period applies.

When you delete your Account, we set deletedAt and start the deletion process. Some Content (for example, comments left on a public discussion thread) may be retained but anonymised so that it no longer identifies you, in order to preserve the integrity of community conversations.

---

7. Your rights

You have the following rights in relation to your Personal Information.

7.1 Rights under the Australian Privacy Principles

• Access (APP 12): you can request a copy of the Personal Information we hold about you.
• Correction (APP 13): you can ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

7.2 Rights under the LGPD (for Users resident in Brazil)

Under Article 18 of the LGPD, you have the right to:

• confirm the existence of processing;
• access your data;
• correct incomplete, inaccurate or outdated data;
• anonymise, block or delete unnecessary, excessive or non‑compliant data;
• request portability to another service provider;
• be informed about public and private entities with which we have shared your data;
• be informed about the possibility and consequences of refusing consent;
• revoke any consent you have given; and
• request a review of decisions made solely by automated processing.

7.3 How to exercise your rights

You can:

• update most profile fields yourself from your profile settings in the Nyvo app;
• close your Account from your profile settings or by emailing hello@nyvo.com.au;
• for everything else, email hello@nyvo.com.au.

We will respond:

• within 30 days for requests under the Privacy Act (the maximum period under APP 12.4 / 13.3); and
• within 15 days for requests under the LGPD (LGPD Art. 19, §1).

We may need to verify your identity before acting on a request. There is no fee for most requests, but we may charge a reasonable cost‑recovery fee for large or repeat access requests.

7.4 If you are not satisfied

If you are not satisfied with how we have handled your Personal Information, please contact us first at hello@nyvo.com.au so we have an opportunity to resolve the issue. You also have the right to complain to:

• the Office of the Australian Information Commissioner (OAIC) — see https://www.oaic.gov.au; or
• (for Users resident in Brazil) the Autoridade Nacional de Proteção de Dados (ANPD) — see https://www.gov.br/anpd.

---

8. Security and data breach notification

We take reasonable steps to protect Personal Information from misuse, interference, loss and unauthorised access, modification or disclosure, including:

• TLS encryption in transit;
• encryption at rest provided by our hosting and storage providers;
• access controls limiting who in the Nyvo team can access user data, with audit logging;
• payment data isolation (card data goes directly to Stripe; we never see it);
• automated content moderation pipelines to reduce exposure to harmful Content; and
• rate limiting and other anti‑abuse measures.

If we suffer a data breach that is an "eligible data breach" under Part IIIC of the Privacy Act, we will notify affected individuals and the OAIC as soon as practicable and within the timeframes required by the Notifiable Data Breaches scheme.

For Users resident in Brazil, we will notify the ANPD and affected individuals of any security incident likely to cause relevant risk or damage, within the timeframes contemplated by Article 48 of the LGPD.

---

9. Children's privacy

The Service is intended for Users aged 18 or older (see clause 2 of the Terms). We do not knowingly collect Personal Information from children under 18. If you believe a child has provided Personal Information to us, please contact hello@nyvo.com.au and we will take steps to delete it.

---

10. Changes to this Policy

We may update this Privacy Policy from time to time. For material changes, we will give you at least 30 days' notice through the Service before they take effect. The "version" and "last_updated" fields at the top of this page tell you which version is in force, and the change log at the bottom summarises significant changes.

---

11. Contact

For any privacy question, request or complaint:

• Email: hello@nyvo.com.au
• Post: Privacy Officer, Nyvo Pty Ltd, Unit 11, 7 Myers Street, Roselands NSW 2196, Australia

For the Encarregado / DPO contact required under LGPD Article 41: hello@nyvo.com.au.

---

Change log