Privacy Policy

The short version. We collect the information we need to run Nyvo: your sign‑in details, your profile, the posts and events you create, the Tickets you buy or sell, and basic device and usage data. We don't sell your data. We share it only with the service providers we need to operate the Service, with Event Organizers (for the limited purpose of checking you in at their Event), and where the law requires it. You have a right to access, correct and (in most cases) delete your information. We comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, for Users in Brazil, with the LGPD.

This Privacy Policy describes how Nyvo — the business name under which Alick Ceglys Buscariolli (ABN 25 545 382 512) operates as a sole trader in New South Wales, Australia (we, us, our) — collects, uses, discloses and otherwise handles Personal Information when you use the Service. Capitalised terms have the meanings given in our Definitions.

This Policy should be read together with our Terms of Service, Acceptable Use Policy, and (if you are an Organizer) the Organizer Agreement.

---

1. Who we are and how to contact us

Nyvo is the business name under which Alick Ceglys Buscariolli carries on business as a sole trader, with ABN 25 545 382 512 and address for notices at NSW 2049, Australia. We are an "APP entity" under the Privacy Act and, in relation to Users resident in Brazil, the "controller" (controlador) under the LGPD.

You can contact us about privacy matters in any of the following ways:

• Email: hello@nyvo.com.au
• DPO / Encarregado (LGPD): hello@nyvo.com.au (the same mailbox is monitored by our designated privacy contact)
• Post: Privacy Officer, Nyvo, NSW 2049, Australia

---

2. The information we collect

We collect Personal Information from you directly when you sign up and use the Service, and from third parties who help us operate the Service (such as Firebase, Stripe and our image moderation provider). The table below lists, by category, what we collect.

2.1 Account and profile

2.2 Your Content

We collect and store the Content you create on the Service, including:

• posts (text, images and polls), the audience scope you choose, mentions you make, and the moderation status of the post;
• comments on posts, businesses and articles, including mentions you make;
• reactions (like, love, haha, wow, sad, angry) and poll votes;
• event listings you create as an Organizer (title, description, location, latitude/longitude, city, time zone, start/end times, cover image, ticket price and currency);
• RSVPs and Ticket purchases (see section 2.3);
• business directory listings you create (name, category, description, address, latitude/longitude, contact methods, opening hours, photos);
• housing and job listings you create;
• articles you author (if you are a community leader);
• reports you file about other Content or other Users;
• bookmarks you save; and
• your English‑tips learning activity: the English level you choose, your current practice streak, your last practice date and your total days practised. We do not store your individual quiz answers — quiz performance is counted only as anonymous per‑question totals that are never linked to you.

We also automatically capture link previews when you paste a URL (title, description, image) so we can render them in the feed.

2.3 Events and Tickets

For Tickets, we collect and store:

• the Event the Ticket is for and the User who bought it;
• the Stripe payment intent ID, amount paid, Platform Fee, the QR code and the Ticket's status (PAID, REFUNDED, CHECKED_IN);
• the time the Ticket was issued and (where relevant) checked in.

We do not see or store your card number, CVC or full card details. Stripe collects and processes payment card information directly under PCI DSS.

2.4 Information shared with Organizers

When you check in to an Event, the Organizer sees the name and profile picture of the Ticket holder on their check‑in screen. No other Personal Information about you is automatically disclosed to the Organizer through the Service. If you choose to interact with an Organizer outside the Service (for example, to ask a question by email), any further information you share is between you and the Organizer.

2.5 Device, app and usage information

2.6 Communications

• Transactional emails are sent through Resend (for example, sign‑up verification, ticket purchase confirmations, refund notices).
• Marketing emails (such as the weekly digest) are only sent if you have opted in via weeklyDigestOptIn. You can opt out at any time from your profile settings or by clicking "unsubscribe" in the email.
• Push notifications are sent through Firebase Cloud Messaging. You can disable categories from your notification preferences in the app.

2.7 Cookies and similar technologies (web)

Our website uses a small number of cookies and equivalent technologies:

• Strictly necessary cookies (always on): session cookies, your locale preference, and a cookie that remembers your consent choices.
• Analytics cookies (consent‑gated): if you accept, Firebase Analytics may set cookies operated by Google to measure how the site is used.

We do not currently use marketing or advertising cookies. Our consent banner gives you a clear "Reject all" option and a "Manage preferences" link. Your choice is stored and can be changed any time from the footer link "Cookie preferences".

2.8 Audit and security logs

We keep an internal AuditLog that records administrative and moderation actions on the Service (for example, when content is approved or rejected, when an Account is auto‑suspended, when an upload is removed by image moderation). These logs may identify the actor, the target and the action taken. They are used for safety, abuse investigation and accountability.

2.9 Information about people you mention or report

Where you mention or report another User, we process Personal Information about them as part of the normal operation of the Service (for example, to deliver a mention notification or to triage a report).

2.10 Direct messages

When you send a direct message to another User, we collect and store the message so we can deliver it and keep a record for safety and moderation:

• the text you write, any photo you attach, and any link preview generated from a URL in the message;
• who sent it, who received it, the conversation it belongs to, and the times it was sent, delivered and read;
• whether a message was deleted or reported, and whether you have muted or blocked the other person.

Direct messages are private between you and the other participant. They are not end‑to‑end encrypted: we store them in our database, encrypted in transit (TLS) and at rest, so they can be delivered across your devices and reviewed by our safety team only when a message or conversation is reported. Because they are not end‑to‑end encrypted, please do not share anything in a direct message that you would not want a moderator to be able to see if the conversation is reported.

Photos you send in a direct message are moderated by Google Cloud Vision SafeSearch in the same way as any other image you upload (see clause 4.5 of the Terms and the Acceptable Use Policy). If a URL appears in your message, we fetch a link preview (title, description and image) so we can render it, exactly as we do for posts.

So that new messages and read receipts appear without you having to refresh, we use a real‑time relay operated on Google Firebase. The relay only ever carries metadata — a signal that a conversation has changed, the participants' sign‑in identifiers, and read timestamps. The content of your messages (text, photos and link previews) is never written to the relay. It stays in our own database and is fetched over our authenticated API.

2.11 What we don't collect

We do not collect:

• credit‑card numbers, expiry dates or security codes (these go to Stripe);
• biometric information;
• government identifiers (Stripe may collect them for KYC on Organizers — see section 5);
• sensitive information as defined in section 6 of the Privacy Act, unless you choose to include it in a post (which we discourage).

---

3. How we use Personal Information

We use Personal Information for the following purposes. For each purpose we state the lawful basis under the Privacy Act and, where relevant, under Article 7 of the LGPD.

We do not engage in automated decision‑making with legal or significant effects on you, other than:

• automatic content removal when our profanity filter or Google Cloud Vision SafeSearch returns a positive result;
• automatic temporary suspension of an Account when the volume of substantiated reports against it exceeds the threshold described in the Acceptable Use Policy.

In both cases you can request a human review by contacting hello@nyvo.com.au (for content) or hello@nyvo.com.au (if a privacy concern is involved).

---

4. Who we share information with

4.1 Other Users

Some information is visible to other Users by design — your display name, profile picture, the Content you post and the audience scope you set for it. Your email, phone, date of birth, country of residence and Stripe account details are not shown to other Users.

4.2 Organizers (limited)

If you buy a Ticket, the Organizer can see your name and profile picture at the check‑in screen, and the fact that you have a valid (or refunded, or checked‑in) Ticket for their Event. The Organizer cannot see your email, date of birth, country of residence or other profile details through the Service.

4.3 Service providers (sub‑processors)

We use the following third parties to operate the Service. Each is bound by contract to handle Personal Information only as we instruct and consistent with applicable privacy laws.

We may add, change or remove sub‑processors. We will publish an up‑to‑date list at this page; for material changes we will give notice through the Service.

4.4 Law enforcement and legal process

We may disclose Personal Information where we reasonably believe it is necessary to:

• comply with a law, regulation, valid court order or lawful request from a regulator or law‑enforcement agency;
• enforce the Terms or investigate breaches of the Acceptable Use Policy;
• protect the safety of any person or the public;
• prevent or investigate fraud; or
• establish, exercise or defend legal claims.

Where we are permitted to, we will notify you before disclosing Personal Information in response to a request.

4.5 Corporate transactions

If Nyvo is involved in a merger, acquisition, financing, restructure, sale or insolvency, Personal Information may be transferred or disclosed as part of that transaction, subject to the recipient agreeing to obligations consistent with this Policy.

4.6 No sale of Personal Information

We do not sell Personal Information and we do not "share" Personal Information for cross‑context behavioural advertising.

---

5. Cross‑border transfers (APP 8 and LGPD)

Most of our service providers are based in or process data in the United States, the European Union or other jurisdictions outside Australia. Where Personal Information is transferred outside Australia, we take reasonable steps to ensure that the recipient handles it in a way consistent with the Australian Privacy Principles, including by relying on contractual protections (such as Stripe's, Google's, Resend's and Sentry's data processing addenda).

For Users resident in Brazil, international transfers rely on ANPD‑recognised mechanisms (such as standard contractual clauses or transfers to jurisdictions with an adequate level of protection), or are made with your specific consent or on another legal basis allowed by Articles 33–36 of the LGPD.

---

6. How long we keep information (retention)

We retain Personal Information only as long as we need it. The table below sets out our default retention periods. Where a longer period is required by law (for example, for tax records), the longer period applies.

When you delete your Account, we set deletedAt and start the deletion process. Some Content (for example, comments left on a public discussion thread) may be retained but anonymised so that it no longer identifies you, in order to preserve the integrity of community conversations.

---

7. Your rights

You have the following rights in relation to your Personal Information.

7.1 Rights under the Australian Privacy Principles

• Access (APP 12): you can request a copy of the Personal Information we hold about you.
• Correction (APP 13): you can ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

7.2 Rights under the LGPD (for Users resident in Brazil)

Under Article 18 of the LGPD, you have the right to:

• confirm the existence of processing;
• access your data;
• correct incomplete, inaccurate or outdated data;
• anonymise, block or delete unnecessary, excessive or non‑compliant data;
• request portability to another service provider;
• be informed about public and private entities with which we have shared your data;
• be informed about the possibility and consequences of refusing consent;
• revoke any consent you have given; and
• request a review of decisions made solely by automated processing.

7.3 How to exercise your rights

You can:

• update most profile fields yourself from your profile settings in the Nyvo app;
• close your Account from your profile settings or by emailing hello@nyvo.com.au;
• for everything else, email hello@nyvo.com.au.

We will respond:

• within 30 days for requests under the Privacy Act (the maximum period under APP 12.4 / 13.3); and
• within 15 days for requests under the LGPD (LGPD Art. 19, §1).

We may need to verify your identity before acting on a request. There is no fee for most requests, but we may charge a reasonable cost‑recovery fee for large or repeat access requests.

7.4 If you are not satisfied

If you are not satisfied with how we have handled your Personal Information, please contact us first at hello@nyvo.com.au so we have an opportunity to resolve the issue. You also have the right to complain to:

• the Office of the Australian Information Commissioner (OAIC) — see https://www.oaic.gov.au; or
• (for Users resident in Brazil) the Autoridade Nacional de Proteção de Dados (ANPD) — see https://www.gov.br/anpd.

---

8. Security and data breach notification

We take reasonable steps to protect Personal Information from misuse, interference, loss and unauthorised access, modification or disclosure, including:

• TLS encryption in transit;
• encryption at rest provided by our hosting and storage providers;
• access controls limiting who in the Nyvo team can access user data, with audit logging;
• payment data isolation (card data goes directly to Stripe; we never see it);
• automated content moderation pipelines to reduce exposure to harmful Content; and
• rate limiting and other anti‑abuse measures.

If we suffer a data breach that is an "eligible data breach" under Part IIIC of the Privacy Act, we will notify affected individuals and the OAIC as soon as practicable and within the timeframes required by the Notifiable Data Breaches scheme.

For Users resident in Brazil, we will notify the ANPD and affected individuals of any security incident likely to cause relevant risk or damage, within the timeframes contemplated by Article 48 of the LGPD.

---

9. Children's privacy

The Service is intended for Users aged 18 or older (see clause 2 of the Terms). We do not knowingly collect Personal Information from children under 18. If you believe a child has provided Personal Information to us, please contact hello@nyvo.com.au and we will take steps to delete it.

---

10. Changes to this Policy

We may update this Privacy Policy from time to time. For material changes, we will give you at least 30 days' notice through the Service before they take effect. The "version" and "last_updated" fields at the top of this page tell you which version is in force, and the change log at the bottom summarises significant changes.

---

11. Contact

For any privacy question, request or complaint:

• Email: hello@nyvo.com.au
• Post: Privacy Officer, Nyvo, NSW 2049, Australia

For the Encarregado / DPO contact required under LGPD Article 41: hello@nyvo.com.au.

---

Change log