Tribe Retail Privacy Policy

1About this Privacy Policy

This Privacy Policy explains how personal information is collected, used, disclosed, stored and handled in connection with the Tribe Retail app, as part of the Retail MVP for a selected set of users. The app may be publicly available to download, but participation and feature access are limited to selected or invited users. It applies to selected participating retailers, their authorised representatives and staff users, and people who contact us about the app. Business information is covered by this policy where it identifies an individual, including a sole trader.

In this policy, we, us and our mean Intelligence 81 Pty Ltd ACN 700 219 843 (App Owner), which owns and operates the Tribe platform, and, where relevant to a property service you use, the applicable landlord and managing agent. For Mason & Main, Merrylands, these are Merrylands BTR Investment Co Pty Ltd ACN 660 300 872 (Landlord) and Nation Management Pty Ltd ABN 41 668 109 037 (Managing Agent). Each handles information for its role. Where another property provider participates, its identity and relevant collection notice will be made available before information is shared with it.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2Personal information we collect

Account and contact information: names, email addresses, mobile numbers, staff user names, roles and account preferences.

Business information: business name, ABN, business contact details, authorised representative details and information used to verify the business or enable payment features.

Payments and program records: bank details for retailer fees and reimbursements, invoices, amounts, dates and payment status, offer content and redemption records. Full card and payment credentials are held by the payment provider, Stripe, rather than Tribe.

Customer information: the first name and offer code needed to verify an offer redemption. Where in-app purchasing is enabled, relevant order details and payment confirmation may also be provided to fulfil a purchase. We do not give retailers customers’ contact details for independent marketing.

Communications: messages, support requests, complaints, feedback and conversations with Sarah, the AI Assistant.

Device and usage information: technical information generated when you use the app, such as device type, operating system, app version, IP address, app activity and error logs. The information collected depends on your device and the features you use.

3Sensitive information and government identifiers

We do not intend to collect sensitive information, such as health information or information about racial or ethnic origin. Do not include sensitive information in offer content, messages or AI conversations. If a business verification process requires personal identity information, we will explain the information required and obtain any consent required by law before collection.

We do not adopt government identifiers, such as passport or driver licence numbers, as our own identifiers. We use or disclose them only as permitted by the APPs, including for authorised identity verification or as required by law.

4How we collect information

We collect information directly from you when you register, use features, contact us or interact with the AI Assistant. We also collect device and usage information automatically through the app and supporting service technologies.

We receive information from the App Owner, Landlord and Managing Agent to administer the MVP; from payment and business verification providers to verify business details and process fees; and through offer and transaction activity to administer redemptions and reimbursements.

If we receive unsolicited personal information that we could not lawfully have collected under the APPs, we destroy or de-identify it where lawful and reasonable.

5Why we collect use and disclose information

We use information to create and manage retailer and staff accounts, verify business details, list and administer offers, track redemptions, process fees and reimbursements, provide reports and administer retailer participation in the MVP.

We also use information to provide the AI Assistant and service messages, respond to requests and complaints, secure the app, detect fraud or misuse, evaluate and improve the app and MVP, undertake de-identified or aggregated analysis, comply with legal obligations and resolve disputes. Marketing is handled as described in section 10.

We collect only information reasonably necessary for our functions and activities. You may make general enquiries anonymously or using a pseudonym where practicable. You do not have to provide personal information, but we may be unable to create your account or provide a feature that requires it. Participation in the app is voluntary and does not change your retail lease.

6Who we share information with

We share information between the App Owner, Landlord and Managing Agent for the purposes described in this policy, and with providers that support the app. These include Amazon Web Services (AWS, Sydney region), Stripe, Google as provider of the Gemini large language model, and other providers supporting app communications and technical operations. Intelligence 81 Pty Ltd is responsible for the app’s technology operations and uses these service providers to deliver the relevant features.

Payment and business verification providers receive information needed to verify details and process payments. Retailer branding and offer content you choose to publish are displayed to users; private staff and account information is not offer content.

Information may also be disclosed to professional advisers, insurers and auditors, and to courts, tribunals, regulators and law enforcement where required or authorised by law. We do not sell personal information.

7Customer and staff information

If you add staff users or submit information about staff or customers, provide the relevant collection notice and ensure you have any consent and authority required by applicable privacy law. Only submit information needed for the relevant purpose.

Use customer information supplied for a redemption or purchase only to verify and honour the offer or fulfil that purchase. Do not use it for independent marketing without the customer’s separate consent. Retailers are responsible for their own information handling and privacy obligations.

8AI and automated outcomes

Sarah is an automated AI Assistant, not a person. It helps users find information, navigate the app and receive reminders. It can make mistakes and provides general information only. Please do not share passwords, card numbers or bank login details in chat.

Sarah does not decide your participation, offers or fees. Those outcomes are decided by the Operator or predefined business rules.

AI conversations are processed by Google Gemini in the United States. We retain conversations only for as long as reasonably necessary to provide the AI feature, address support queries and protect the service. Google handles information under the terms and privacy arrangements applicable to the Gemini service used by us. Please avoid entering sensitive information that is not required for your query. Contact us under section 15 for information about AI data handling or to request human review of an automated outcome.

9Device permissions and app technologies

We use device and app activity information to operate the service, understand usage, diagnose errors and protect security. Service providers supporting these functions may process information necessary for that purpose.

Notifications may be used for account updates and offer administration.

Where a feature requests a device permission, we explain its purpose before the operating system prompt. You can change permissions in device settings; denying permission may prevent the corresponding feature from working. Permission for notifications does not by itself constitute consent to marketing.

10Marketing and service communications

We send marketing only if you agree to receive it. You can change preferences in app settings or use the unsubscribe method in a marketing message. Marketing choices are separate from acceptance of terms and device permissions.

We may continue to send necessary service messages about your account, offers, fees, transactions and MVP participation.

We do not provide customers’ contact details to retailers for their own marketing.

11Overseas access and disclosure

App data is hosted in Australia by AWS in the Sydney region in an account held by Intelligence 81 Pty Ltd.

The app backend and its data are hosted by Amazon Web Services in the Sydney region, Australia. Intelligence 81 Pty Ltd is responsible for the app’s technology operations. The AI Assistant uses Google Gemini, hosted in the United States, so information submitted to or accessed by the AI Assistant may be processed in the United States. Australian backend hosting does not mean that AI processing occurs in Australia.

Where information is disclosed overseas, we take reasonable steps to ensure recipients handle it consistently with the APPs.

12Security and retention

We store personal information electronically and take reasonable technical and organisational steps to protect it against misuse, interference, loss, unauthorised access, modification and disclosure. We restrict access to people and service providers who need it for their functions and review safeguards in light of the information handled and relevant risks.

We keep information only while needed for the purposes in this policy or as required by law, then securely destroy or de-identify it. Payment and accounting records are retained for seven years for tax and accounting purposes.

We retain account and contact information while needed to provide your account and services, and after closure only where needed to meet legal obligations, resolve disputes, prevent fraud or complete outstanding transactions. Business verification, fee and reimbursement records are retained only for account administration, reconciliation or applicable legal obligations.

AI conversations, offer and redemption records, and device and usage information are kept only for as long as reasonably necessary for their stated purposes. We review retention needs and take reasonable steps to destroy or de-identify personal information when it is no longer needed, unless retention is required by law or a court or tribunal order. Backup copies are subject to the same protection and retention principles.

13Deleting your account and information

You can request deletion of your account and associated personal information by emailing privacy@tribeapp.com.au. Please identify the app and the email address associated with your account. Do not send identity documents with your initial request. We may reasonably verify your identity to protect your information and will explain any further steps or records that must be retained.

Account deletion includes deletion of associated personal information that is no longer required. Disabling an account is not a substitute for deletion. Records necessary for regulatory compliance, security, fraud prevention or resolving outstanding transactions may be retained only for the relevant purpose and period described in section 12.

Deleting a staff account does not end the retailer’s lease or eliminate records lawfully required for the retailer’s outstanding fees, transactions and reimbursements. Account deletion and ending retailer participation are separate actions.

14Access and correction

You may request access to, or correction of, personal information we hold by contacting the Privacy Officer. You can update most account details in the app. We respond within a reasonable period, usually within 30 days. If we refuse a request, we provide reasons and explain how to complain, unless the law permits otherwise.

15Complaints human review and data breaches

Contact the Privacy Officer if you have a privacy complaint or want human review of an automated outcome. We acknowledge complaints promptly and aim to respond within 30 days. If more time is needed, we will explain why.

If you are dissatisfied with our response, or have not received a response within a reasonable period, you may complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints or phone 1300 363 992.

We assess suspected data breaches and notify affected individuals and the OAIC when required under the Notifiable Data Breaches scheme, including where an eligible breach is likely to result in serious harm.

16Contact and policy updates

Privacy Officer, Tribe Email: privacy@tribeapp.com.au Phone: 1800 169 100 Post: Level 2, 66 Wentworth Avenue, Surry Hills NSW 2010

We publish the current policy in the app. We notify you in the app about significant changes. Where a new use requires consent, we obtain that consent separately. A copy of this policy is available on request.