Privacy Policy

At Ourfit, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose and protect your personal information when you use our platform. We comply with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). This Policy forms part of, and should be read with, our Renter and Lender Terms and Conditions.

We collect personal information only where it is reasonably necessary for our functions and activities as a clothing-rental marketplace - for example, to set up accounts, run bookings, take payments, verify identity and prevent fraud.

Where it is lawful and practicable, you may deal with us anonymously or by using a pseudonym. In practice, most of Ourfit's core functions - creating an account, taking payments, verifying identity and arranging rentals between users - require us to identify you, so anonymous use is limited.

---

1. Information we collect

Information you provide:

• Account information (name, email, phone number, password)
• Profile information (photo, bio, location)
• Identity verification documents (driver's licence, passport)
• Payment information (processed securely by Stripe)
• Listing details (item descriptions, photos, pricing)
• Messages and communications with other users
• Wardrobe and demand signals: items you tell us you own, want or request (including any size, colour, notes or product links you provide), together with your general area (suburb and postcode level, never your street address), so we can match what people want with what is available nearby
• The area you tell us you are based in when you first set up your account (a suburb or town, not a street address), so we can show you what is nearby
• Delivery and pickup addresses, and - where you save one - a coordinate we derive from that address so we can measure distance and work out what can reach you. Your street address is never shown publicly (see "How we share your information")
• What a booking is for, where you choose to tell us (for example "wedding" or "race day"), which helps us show the right pieces and tells lenders what people are looking for
• Your contact preferences: whether you want marketing emails, and whether you want texts from us (see "How we use your information")
• Sizing details and body measurements you choose to add (usual sizes, height, bust, waist and hips) so we can suggest pieces that fit. When you rate how a piece fit you, we keep a snapshot of these with that rating. They are private by default; if you turn off anonymity on a fit rating, your height and usual size are shown alongside your photos of that piece
• Photos you upload to virtual try-on (where offered), used only to generate the try-on image for you
• Business details for lenders and business accounts (legal name, ABN and GST registration status), which we may verify against the Australian Business Register
• Support requests, business applications, reports and feedback

Information collected automatically:

• Device information (browser type, operating system, device ID)
• Usage data (pages visited, features used, search queries and filters, items viewed and saved, profiles followed)
• Session replay (a recording of how you interact with pages in the app - taps, scrolling and navigation - captured by our analytics provider to help us find bugs and improve the product; typed input is masked by default)
• How you arrived at Ourfit (for example, a referral link, a lender's link, or a campaign link), so we can credit the right person or business
• What you were doing when you joined (for example, the item or lender you were looking at, or the action that prompted you to sign up), so we can tailor your first experience
• Checkouts you start but don't finish, so we can send you a reminder
• Approximate location from your IP address
• Your device's location, only if you ask for it and your browser or phone grants permission - for example when you tap to find lenders near you. We use it to sort what you see by distance for that search; we do not store it as your location or track you in the background, and declining the prompt costs you nothing but the sort
• Cookies and similar tracking technologies

Identity documents (sensitive information). Where identity verification is required, the verification is carried out by our provider (Stripe Identity). Your document and selfie are uploaded to and stored by that provider under its own security controls. We do not copy them into Ourfit's own systems or database.

We can, however, view and download them from our provider's dashboard, and information we control is information we hold. Access is restricted to authorised Ourfit staff and is used only where genuinely necessary: investigating suspected fraud or impersonation, resolving a contested damage or non-return claim, or responding to a lawful request. We never give your document or its contents to another user - including a lender seeking to pursue a renter. Where your identity has to be disclosed, it is to police, insurers or through legal process.

What flows back into Ourfit's own records is narrow: when a verification succeeds we store your legal name (given names and family name) and your date of birth, along with the outcome and the date it was confirmed. Nothing else from the document - not its number, nor any other field printed on it - is stored on our systems.

Because a verified document is stronger evidence than a form somebody filled in, these details become the authoritative record on your account: where the name or date of birth you entered differs from the document, we update your account to match the document. Given names are stored as a first name and, where the document shows more, a middle name.

Your display name and username are yours to choose, and verifying never overwrites ones you have already set. If you have not set them yet, we create them from your name so your profile is not blank: your display name becomes your first name and last initial (for example, "Alex M."), and your username is drawn from your name. You can change either at any time.

We retain identity-verification records only for as long as needed for the purpose collected and to meet legal, fraud-prevention and dispute-resolution obligations, after which they are deleted or de-identified. We collect this sensitive information with your consent and only where reasonably necessary. We do not adopt government identifiers (such as a driver's licence or passport number) as our own identifier for you.

2. How we use your information

We use your information to: create and manage your account; facilitate rentals between users; process payments and payouts; verify identity and prevent fraud; keep the legal name and date of birth on your account accurate by correcting them from a verified identity document; provide customer support; send transactional messages (booking confirmations, reminders); send marketing communications (with your consent - you can opt out at any time using the unsubscribe link in any marketing email, by replying STOP to any text, or in your notification settings); remind you about a booking you started but didn't finish (a single reminder, which you can unsubscribe from); improve and personalise our services; analyse usage and platform performance; use artificial-intelligence tools to standardise catalogue data (brand, item, colour and size) from listing text and photos and, where you choose to use it, to generate a virtual try-on image; show aggregated, de-identified demand information to lenders and businesses on the platform (for example, how many people in an area are looking for a style or size - never in a way that identifies you); report to the Australian Taxation Office where the law requires it (section 3); and comply with other legal obligations.

Texts and emails. We keep two kinds of message apart. Messages about your bookings and your account - a request accepted, an item posted, a return due - are part of the service, sent by email, SMS and in-app notification. News from Ourfit is separate: signing up includes texts from us about launches and what's new, which is stated on the screen where you create your account, and marketing emails are only sent to people who ask for them. You can change what you receive at any time in your notification settings, unsubscribe from any marketing email, or reply STOP to any text. Replying STOP switches off every text we send you, including booking updates, so if you only want the marketing to stop, use your notification settings instead. START turns texts back on.

Automated decisions. We use automated systems to rank and personalise what you see (for example, ordering the feed by the sizes and brands you've told us about) and to flag possible fraud or misuse for our team to look at. We also use automated tools to read listing photos and text so items are catalogued consistently - that describes an item, not you. Decisions that materially affect you - such as suspending an account, deciding a contested claim, or charging a card for a large damage claim - are made by a person, and you can ask us to review any automated outcome by contacting us (section 12).

3. How we share your information

We do not sell your personal information. We may share it:

• With other users: when you make or receive a booking, we share what the other party needs to complete it - your first and last name (for renters, the name confirmed by identity verification, which is why it must be your real one), profile photo, delivery or return address, contact details and whether you have verified your identity. Lenders who lend show their suburb and postcode publicly, never their street address. On the explore map, a lender is drawn at an approximate point within their suburb rather than at their address, the map will not zoom in far enough to imply a building, and the precise coordinate we hold for a lender is used only to work out distances - it is never sent to the browser. Reviews are public and attributed to your profile; fit ratings can be anonymous. If you join Ourfit from a lender's shared link, you follow that lender automatically and they can see you as a follower. If an approved damage, late-return or non-return charge can't be recovered from a renter's card and isn't settled, we may give the affected lender the renter's name, contact details, delivery address and verification status so they can pursue the balance; we never share identity documents or their contents with other users.
• With service providers: trusted third parties for payment processing (Stripe), email/SMS delivery, analytics and hosting - accessing only what they need.
• For legal reasons: when required by law, to respond to legal process, or to protect the rights, property or safety of Ourfit, our users or others.
• Tax reporting: Ourfit is an electronic distribution platform under Australia's Sharing Economy Reporting Regime. We are required to report to the Australian Taxation Office, twice a year, the identity details (name, date of birth, address, ABN and bank account identifiers) and transaction totals of lenders who earn on the platform.
• Aggregated insights: we may create and share aggregated, de-identified insights derived from platform activity (for example, demand for styles or sizes, fit feedback patterns, or how items perform over repeated wear) with partners such as fashion brands. These insights are statistical only, are always drawn from minimum group sizes, and never identify you or your account.
• Business transfers: if Ourfit is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction.

Storefronts. Some lenders run their own branded website powered by Ourfit (an "Ourfit Storefront"). When you use one, Ourfit operates the underlying service and this Policy applies in full: the lender sees the same booking information they would see on the marketplace, and cookies and analytics work the same way as on ourfit.app.

4. Cookies and tracking

We use cookies and similar technologies for:

• Essential cookies: keeping you logged in and remembering preferences.
• Attribution cookies: first-party cookies that remember how you arrived at Ourfit (for example, a referral link, a lender's link, or a campaign link) so we can credit the right person or business.
• Analytics: PostHog and Google Analytics 4 to measure how visitors find and use the platform. PostHog also records session replays (see section 1). You can opt out of Google Analytics via the opt-out browser add-on (tools.google.com/dlpage/gaoptout), and you can ask us to exclude your account from analytics and session replay at any time by contacting us (section 12).
• Advertising: the Meta (Facebook/Instagram) Pixel to measure the performance of our campaigns and to reach people likely to be interested in Ourfit. You can manage how Meta uses this data in your Meta ad preferences (facebook.com/adpreferences).
• Payment cookies: set by Stripe on checkout pages to process payments and prevent fraud.

You can control cookies through your browser settings; disabling essential cookies will affect core functionality (login, checkout). Australian law does not currently require a consent banner for analytics cookies, so in our launch market these run by default and you can ask us to exclude your account at any time (section 12). Where the law does require consent for non-essential cookies, we will seek it - through a consent prompt - before those cookies are set.

5. Data security

We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, and to destroy or de-identify it when it is no longer needed. These steps include: encryption in transit and at rest; secure payment processing through Stripe (PCI-DSS compliant); regular security assessments; and access controls and authentication. No method of transmission over the internet is 100% secure, so we cannot guarantee absolute security.

Notifiable data breaches. If we have reasonable grounds to believe an eligible data breach has occurred involving your personal information, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

6. Data retention

We retain your personal information for as long as your account is active or as needed to provide services. We may retain certain information after account closure for legal and regulatory compliance, dispute resolution, fraud prevention, and enforcing our terms and policies. We take reasonable steps to keep the personal information we hold accurate, complete and up to date; you can help by keeping your account details current.

7. Your rights

Under the Privacy Act 1988, you have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion (subject to legal requirements); opt out of marketing communications; and lodge a complaint with the OAIC. To exercise these rights, contact us at the email below. We may first need to confirm your identity, and some information may be subject to legal retention requirements. We will respond within a reasonable period (usually within 30 days); if we decline a request (for example, to correct or delete), we will explain why and how you can complain.

8. Third-party services

We share personal information with trusted service providers only so we can run Ourfit. Each is bound by its own privacy policy and, where applicable, a data processing agreement with us. They fall into these categories:

• Payment and identity: our payment processor (currently Stripe) handles payments, lender payouts and identity verification, including card and bank details and, where you verify your identity, your identity document and selfie.
• Communications: providers that deliver our SMS (currently Twilio - phone verification, booking notifications and, with your consent, marketing messages) and our email (currently Resend).
• Analytics and product improvement: PostHog (product analytics and session replay) and Google Analytics. These tools receive usage data linked to an internal account identifier - not your name or email address - so we can understand behaviour at an individual level and improve the product. Our error-monitoring provider (currently Sentry) receives technical error reports with personal details scrubbed.
• Advertising: Meta, which receives limited usage signals from the Meta Pixel for campaign measurement and retargeting (see Cookies and tracking above).
• Delivery providers: where Ourfit Direct is used, the delivery provider receives the names, addresses, phone numbers and delivery instructions needed for collection and drop-off, and sends tracking events back to us.
• Artificial intelligence and image processing: AI providers (currently Anthropic) receive listing text and photos so we can standardise catalogue data. A virtual try-on provider (currently TheNewBlack) receives the photo you upload and the garment photo, only when you use that feature.
• Maps and addresses: Google, for address autocomplete and for turning a suburb or address into a map coordinate. What you type into an address field is sent to Google to return suggestions, and the suburb we geocode is sent to place you on the map. Map imagery and tiles are served by MapTiler, which means your browser's requests for the part of the map you are looking at go to that provider.
• Security and verification: bot-protection on sign-up and forms (currently Cloudflare Turnstile), which analyses browser signals; and the Australian Business Register, which we query to verify a lender's ABN.
• Internal operations tooling: our team receives alerts about support requests, business applications, reports and bookings through our internal messaging tools (currently Slack).
• Hosting, infrastructure and storage: cloud hosting, infrastructure and object-storage providers that run our website, app and API and store uploaded media (such as listing photos).

Some of these providers are located overseas (see International transfers below). We may add or change providers from time to time; material changes will be reflected in an updated version of this Policy.

9. International transfers

Ourfit is an Australian business, based in Sydney, NSW, and we manage your personal information from Australia. Some of our service providers are located overseas (including in the United States). Before disclosing your personal information overseas, we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, except where an exception under APP 8.1 applies - for example, where you have consented to the disclosure or it is required or authorised by law. We remain accountable for overseas disclosures as required by the Privacy Act 1988 (Cth).

10. Children's privacy

Ourfit is not intended for users under 18. We do not knowingly collect personal information from children. If you believe we have, contact us immediately.

11. Changes to this Policy

We may update this Policy from time to time. Where changes are material, we will take reasonable steps to notify you (for example, by email or an in-platform notice) before they take effect. Continued use after changes take effect constitutes acceptance of the updated Policy.

12. Contact us

If you have questions, want to access or correct your information, or wish to make a privacy complaint:

Ourfit Technologies Pty Ltd (ACN 701 948 487, ABN 47 701 948 487) Sydney, NSW, Australia Email: legal@ourfit.app

We will acknowledge your complaint and respond within a reasonable period (usually within 30 days). If you are not satisfied with how we handle it, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.