Legal

Privacy Policy

Version 2.0. Effective 1 August 2026. Replaces all earlier versions.

This policy explains what personal information Nu Pare Pty Ltd collects, why we collect it, who we give it to, how long we keep it, and what you can require us to do with it.

1. Who we are

This platform is operated by Nu Pare Pty Ltd (ACN 698 123 545), trading as NuPARE, ABN 28 698 123 545, a company incorporated in Australia. In this policy, we, us, our and NuPARE mean Nu Pare Pty Ltd, and you means any person whose personal information we hold.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we handle personal information in accordance with them. Where other laws apply to you, section 23 explains what changes.

2. What this policy covers

This policy applies to the NuPARE mobile applications, nupare.com.au, the brand portal, our email and messaging, and any other service that links to it. It applies to members, visitors, brand and partner contacts, creators, applicants and anyone who writes to us.

It does not apply to a brand's own website, a payment provider's own site, or any other third party you deal with through a link from our platform. Those organisations have their own policies and we do not control them.

Personal information has the meaning given in the Privacy Act: information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form.

3. Information you give us

We collect the following directly from you.

Account and profile

• Name, email address, password (stored only as a cryptographic hash), and where you provide them, a username, date of birth, mobile number, profile photograph and biography.
• Your sizing, fit preferences, favoured brands, style preferences and any other preference you set.
• Delivery and billing addresses.

Transactions

• What you order, list, buy, sell, rent, save, plan or return, and when.
• Payment method type, the last four digits and expiry of a card, and the result of a payment. We never see or store a full card number. Section 15 explains how this works.
• Where you sell, rent or are paid by us: the payout details our payment provider needs, and any tax information we are required to collect.

Content you create

• Wardrobe items, photographs, outfits, plans, listings and their descriptions.
• Posts, comments, edits, circle contributions, reviews and reports.
• Messages you send through the platform, and messages you send to us.

If you represent a brand, partner or creator

• Your name, role, work email and phone number, and the business details you provide, including ABN, entity name and banking details for payouts.
• The contents of your application and our correspondence with you.

Support and safety

• The contents of a support ticket, dispute, claim or report, including anything you attach to it.
• Identity or ownership evidence where you ask us to intervene in a dispute or where we need to verify a high-value item.

You do not have to identify yourself to browse our public website. You cannot use an account, transact or list without providing the information above, because we cannot deliver those services without it.

4. Information we collect automatically

• Device and connection. Device model, operating system and version, app version, language, time zone, screen characteristics, IP address, and a device or installation identifier.
• Usage. Screens viewed, items viewed and saved, searches, taps, session length, referring page, and the paths you take through the app. We use this to understand what works and what does not. The screen and tap record is kept for 30 days and then deleted automatically.
• Diagnostics. Crash reports, error logs, performance timings and the state of the app when something failed.
• Approximate location. Derived from your IP address, for currency, delivery estimates, fraud checks and legal compliance. We collect precise device location only if you grant that permission, and only for the feature you granted it for. You can withdraw it at any time in your device settings.
• Notification tokens. A push token issued by Apple or Google so we can send the notifications you have enabled.

5. Information from other sources

We also receive personal information from:

• Partner brands and retailers, about an order you placed, its status, and any return or exchange.
• Payment and identity providers, about whether a payment succeeded, whether a card was declined, the outcome of a fraud or verification check, and any chargeback.
• Logistics and delivery providers, about the movement of a parcel.
• Social platforms, if you choose to sign in with them or connect an account, limited to what that platform tells us and what you approve.
• Analytics and attribution providers, about how you reached us.
• Other members, where they report you, name you, review a transaction with you, or send you something.
• Publicly available sources, where we are checking a business or verifying a claim.

If we receive personal information about you that we did not ask for and could not have collected ourselves, we will destroy or de-identify it as soon as practicable, unless a law requires us to keep it.

6. Your wardrobe, photographs and receipts

The wardrobe is central to the platform, so it deserves its own section rather than a line in a list.

Photographs

When you photograph a garment we store the image and derive information from it: the category, colour, likely brand, pattern and condition. We use that to fill in the item for you, to suggest outfits, to estimate a resale value and to help you list it. Your photographs are private to your account unless you publish them.

We do not use your wardrobe photographs to train models on behalf of any third party, and we do not license them to anyone. Where we use a third-party model to analyse an image, we send only what is necessary for that analysis and we require that provider not to retain it for their own training.

Receipt forwarding

If you use the wardrobe inbox, you forward a retailer's confirmation email to a NuPARE address and we read it to file the item. When you do this we necessarily process the whole email, including the sender, the order number, the price you paid and anything else the retailer put in it. We extract the item details, keep the parsed result, and retain the source email only as long as needed to confirm the parse was correct and to fix it if it was not. Do not forward an email that contains something you would rather we did not hold.

Connected mailboxes

Instead of forwarding each email by hand you can connect a Google or Microsoft mailbox. If you do, NuPARE searches that mailbox for order confirmations and opens only the messages that match. The search is limited to a period you choose, to messages carrying order confirmation wording, and to fifty messages a run. We do not browse your mail and we do not open messages that fall outside that search.

What we access. From a matching message we read the sender, the subject, the date and the message text. Nothing else in the mailbox is read. We do not send mail, delete mail, or change anything in your account, and the permission we ask for does not allow us to.

What we do with it. The message text is used to work out which garments you bought, with the brand, size and price, so they can be filed into your wardrobe. To read the text we pass it to an AI model run by Amazon Web Services in Australia. That provider does not use it to train their models and does not keep it afterwards. We do not use it to train models of our own.

What we keep. We keep the garments we extracted and a short note of which email each one came from, so you can see why an item appeared and correct it. We do not keep a copy of the message. We keep the connection itself, which is the access token your provider issues us, for as long as the mailbox stays connected.

Who else sees it. Nobody. We do not sell it, we do not share it with advertisers or data brokers, and we do not transfer it to anyone for their own purposes. The only third party it reaches is the AI provider described above, acting for us and under contract.

How it is protected. Access tokens are held encrypted and are readable only by the service that uses them. Access to production data is restricted to the people who operate the platform and is logged.

Disconnecting and deleting. You can disconnect a mailbox at any time in the app. Disconnecting deletes the access token immediately and we can no longer read anything. Garments already filed stay in your wardrobe because they are yours, and you can delete any of them, or your whole account, whenever you like. You can also withdraw our access from your Google account directly at myaccount.google.com/permissions.

NuPARE's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Resale valuations

Where we show an estimated resale value we derive it from real comparable listings and completed sales. It is an estimate. It is not an offer, not advice, and not a guarantee of what an item will fetch.

7. Sensitive and biometric information

We do not seek sensitive information as defined in the Privacy Act, which includes health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation and criminal record. Please do not send it to us. If you include it in a profile, a post or a support ticket, you consent to us handling it for the purpose you provided it, and we will otherwise treat it as sensitive.

Some features may analyse an image of you, for example to show how a garment might look. Where a feature would create biometric information or a biometric template, we will tell you before it runs, we will ask for your express consent, that consent will be genuinely optional, and you can withdraw it at any time. We do not use facial recognition to identify members.

8. Why we collect and use it

We use personal information only for these purposes.

• To run your account, authenticate you, keep you signed in and let you recover access.
• To complete transactions, including taking payment, passing an order to a brand or seller, arranging delivery, handling returns, releasing funds and paying out.
• To operate the wardrobe, including filing items, suggesting outfits, planning, and estimating resale value.
• To run the marketplace, including listings, offers, escrow, authentication, rental and buy-back.
• To personalise what you see, as described in section 9.
• To support you, answer questions and resolve disputes.
• To keep the platform safe, including detecting and preventing fraud, counterfeits, spam, abuse, account takeover and breaches of our Terms, and moderating content.
• To communicate with you, including service messages and, where you have not opted out, marketing. See section 10.
• To improve the platform, through analytics, testing and research, using aggregated or de-identified data wherever it will do the job.
• To meet legal obligations, including tax, consumer, anti-money-laundering, record-keeping and law enforcement obligations.
• To establish, exercise or defend a legal claim.

If we ever want to use your information for a purpose that is not on this list and not reasonably expected from it, we will tell you first and, where required, get your consent.

9. Personalisation and automated decisions

We use automated processing to order your feed, suggest items, build outfits, estimate resale values, decide what notification to send and score transactions for fraud risk. These decisions are based on what you have viewed, saved, bought, owned and told us, and on patterns across the platform.

You can turn off personalisation in your account settings. Everything still works. Recommendations stop being based on your wardrobe and become less useful to you.

Automated fraud and safety scoring cannot be turned off, because it protects other members as well as you. It never makes a final decision on its own where the consequence is significant. If we restrict, suspend or reverse something on your account, a person reviews it, we will tell you why, and you can ask us to look again by emailing support@nupare.com.au.

10. Marketing and communications

Service messages are part of the product. Order confirmations, delivery updates, payout notices, security alerts, disputes and changes to these documents will be sent to you while you hold an account, and you cannot opt out of them without closing the account.

Marketing messages are separate. We send them by email, push notification or SMS only where you have consented, or where consent is inferred under the Spam Act 2003 (Cth) because of an existing relationship. Every marketing message carries a working unsubscribe, we act on an unsubscribe within 5 business days, and unsubscribing from marketing never affects your account or your ability to transact.

You can also control push notifications by category in the app, and switch them off entirely in your device settings.

11. When we disclose information

We do not sell personal information, and we do not disclose personal information for another organisation's own marketing. We disclose it only as follows.

• To a brand or seller, the information needed to fulfil your order: your name, delivery address, contact details, and what you ordered. They may not use it to market to you unless you separately agree with them.
• To another member, where you transact with them, the delivery details needed to complete it, and whatever you have chosen to make public.
• To service providers who work on our instructions and are contractually bound to protect it: cloud hosting, payments, identity and fraud checks, delivery, customer support tooling, email and messaging, analytics, moderation, authentication specialists, and professional advisers.
• To our professional advisers, including lawyers, accountants, auditors and insurers, where they need it to advise us.
• Where the law requires or authorises it, including to a court, a regulator, a law enforcement agency or the Australian Taxation Office. We assess each request, we do not hand over more than is asked for, and where we are permitted to tell you, we will.
• To protect people, where we reasonably believe disclosure is necessary to prevent a serious threat to a person's life, health or safety, or to public health or safety.
• In a corporate transaction, to a prospective purchaser or investor in connection with a sale, merger or restructure, under confidentiality, and to the buyer if it completes. Any buyer takes it subject to this policy.
• With your consent, for anything else.

12. Overseas disclosure

Our primary infrastructure is hosted in Australia, in Amazon Web Services' Sydney region. Some of the service providers in section 11 store or access personal information overseas, in particular in the United States, the European Union, the United Kingdom, Singapore and New Zealand.

Before we disclose personal information overseas we take steps that are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles, as APP 8 requires. In practice that means a written contract imposing obligations at least equivalent to the APPs, limits on the purposes for which the recipient may use the information, security requirements, and a requirement to notify us of any breach.

You can ask us for the current list of countries in which our providers hold personal information by emailing hello@nupare.com.au.

13. Cookies and similar technologies

We use four categories.

• Strictly necessary. Sign-in, session security, load balancing, fraud prevention and remembering your privacy choices. These cannot be switched off, because the site does not function without them.
• Functional. Remembering your preferences, region and recently viewed items.
• Analytics. Understanding how the site and app are used, so we can improve them.
• Advertising. Measuring campaigns and, where you allow it, showing you relevant advertising elsewhere.

We operate consent mode: analytics and advertising storage are denied by default until you choose otherwise. You can change your choice at any time, and you can also block or delete cookies in your browser, though strictly necessary cookies are required to stay signed in. On mobile, iOS App Tracking Transparency governs whether we may use your advertising identifier, and we honour that setting.

14. Analytics and advertising

We use Google Analytics 4 with IP anonymisation and consent mode. We may also use measurement tools provided by Meta, TikTok, Apple and Google to understand which campaigns work. These providers may set their own identifiers and may combine what they collect with information they already hold about you, under their own policies.

We do not upload your wardrobe contents, your purchase history or the contents of your messages to any advertising platform.

15. Payments and identity checks

Payments are processed by Stripe. Card details are captured by Stripe directly and are never transmitted to or stored on our systems. We receive only a token, the card type, the last four digits, the expiry and the outcome. Stripe handles that information as a separate controller under its own privacy policy and to the PCI DSS standard.

Where you sell, rent or are paid by us, our payment provider may be required to verify your identity and collect information to meet anti-money-laundering and counter-terrorism financing obligations. Where we are required to verify identity or ownership ourselves, we ask for the minimum evidence necessary, we record the outcome rather than the document wherever we can, and we destroy identity documents once the check is complete unless a law requires otherwise.

16. Public and shared information

Some things you do on NuPARE are visible to others: your public profile, anything you publish, listings you create, comments you leave, circles you join publicly and reviews you write. Treat anything you publish as permanently public, because other members may see, save or screenshot it before you change your mind.

Your wardrobe is private by default. An item becomes visible only when you publish it, list it, or add it to something you have shared.

Deleting a post removes it from the platform. It does not retrieve copies other people already made, and it does not remove it from backups until those backups expire on the cycle described in section 18.

17. How we keep it secure

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Those steps include encryption in transit and at rest, hashed passwords, access control on a need-to-know basis, multi-factor authentication for staff, network isolation, audit logging, point-in-time recovery of our databases, rate limiting, monitoring and alerting, independent security testing, and vendor review before we let a provider near member data.

No system is completely secure. You are responsible for keeping your password and your device secure, for not reusing a password you use elsewhere, and for telling us promptly if you think someone else has access to your account.

18. How long we keep it

We keep personal information only as long as we need it for the purposes in section 8, or as long as a law requires. Our current periods are:

• Account and profile: while your account is open, then 90 days after closure to allow recovery and to resolve anything outstanding.
• Transaction and financial records: 7 years from the end of the financial year in which the transaction occurred, as required by the Corporations Act 2001 (Cth) and Australian tax law.
• Wardrobe items and photographs: until you delete them or close your account, then removed within 90 days.
• Forwarded receipt emails: 30 days after parsing, then deleted. The parsed item stays with your wardrobe.
• Support tickets and disputes: 3 years after resolution.
• Trust and safety records, including reports, moderation decisions and evidence of fraud or counterfeit: up to 7 years, because a shorter period would let a banned account return under a new name.
• Identity verification outcomes: 7 years where an anti-money-laundering obligation applies, otherwise the outcome only.
• Marketing consents and unsubscribes: for as long as we send marketing, plus 2 years, so we can prove we honoured your choice.
• Server and security logs: 12 months.
• Backups: rolling, and fully expired within 35 days.

When a period ends we delete the information or de-identify it irreversibly. Where deletion is not technically possible immediately, we isolate it and delete it on the next cycle.

19. Your rights and choices

You may ask us to do any of the following.

• Access. Give you a copy of the personal information we hold about you.
• Correct. Fix anything inaccurate, out of date, incomplete, irrelevant or misleading. Most of it you can correct yourself in the app.
• Delete. Close your account and delete your information, subject to what we must keep under section 18.
• Export. Give you your wardrobe, content and transaction history in a portable, machine-readable format.
• Stop marketing. Remove you from all marketing, immediately and permanently.
• Turn off personalisation. As described in section 9.
• Withdraw a consent you previously gave, which takes effect from when you withdraw it.
• Deal with us anonymously or under a pseudonym, where it is lawful and practicable. For browsing, it is. For transacting, it is not, because we cannot deliver an order to a pseudonym.

Email hello@nupare.com.au with Privacy in the subject line. We will acknowledge within 5 business days and respond within 30 days. There is no charge for making a request and no charge for a correction. If a request is unusually large or repetitive we may charge a reasonable cost-based fee for access, and we will tell you what it is before we do any work.

We may need to verify your identity before we act, so that someone else cannot obtain or delete your information. If we refuse a request in whole or in part, we will tell you in writing, explain why, and tell you how to complain.

20. Children and young people

NuPARE is not for children. You must be at least 16 to hold an account, and at least 18 to sell, rent, receive a payout, hold a paid membership or enter a contract with a brand through us.

We do not knowingly collect personal information from a person under 16. If we learn that we have, we will delete it and close the account. If you believe a child has given us information, email hello@nupare.com.au and we will act promptly.

Where a member is between 16 and 18, we do not send them personalised advertising and we apply the most protective default settings available.

21. Data breaches

We maintain a data breach response plan. If we suspect a breach we contain it, assess it within 30 days, and if it is likely to result in serious harm we notify the affected individuals and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Our notice will tell you what happened, what information was involved, what we have done, and what you should do. We will not delay a notification in order to finish investigating, and we will not describe a breach as smaller than it is.

22. Complaints

If you think we have mishandled your personal information or breached the Australian Privacy Principles, tell us first. Email hello@nupare.com.au with Privacy complaint in the subject line and set out what happened. We will acknowledge within 5 business days, investigate, and give you a written response within 30 days.

If you are not satisfied with our response, or we do not respond in time, you can take the matter to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5218, Sydney NSW 2001. You do not need our permission and it costs you nothing.

23. If you are outside Australia

We are an Australian business and our services are directed at Australia. If you use NuPARE from elsewhere, you do so on your own initiative and you are responsible for local law.

Where the EU or UK General Data Protection Regulation applies to our handling of your information, the following also applies.

Our lawful bases are:

• performance of a contract, for running your account and completing transactions;
• legitimate interests, for security, fraud prevention, service improvement and direct marketing to existing customers;
• consent, for optional analytics, advertising cookies and any biometric feature; and
• legal obligation, for tax, accounting and law enforcement.

You have the rights of access, rectification, erasure, restriction, portability and objection, including an absolute right to object to direct marketing, and the right to lodge a complaint with your local supervisory authority. Where we rely on consent you may withdraw it at any time without affecting processing already carried out. Transfers out of the EEA or UK are made under Standard Contractual Clauses or an adequacy decision.

If you are a resident of California, we do not sell or share your personal information as those terms are defined in the CCPA, and we do not use it for cross-context behavioural advertising without your consent.

24. Changes to this policy

We may update this policy as the platform changes or the law changes. The current version is always at this address, with its version number and effective date at the top.

If a change materially affects how we handle your personal information, we will tell you before it takes effect, by email or in the app, and give you at least 30 days' notice. Continuing to use NuPARE after that date means you accept the updated policy. If you do not accept it, you can close your account, and section 18 governs what happens to your information.

25. How to contact us

For anything in this policy, email hello@nupare.com.au with Privacy in the subject line. For account and order matters, support@nupare.com.au will be faster. The contact page lists every route.

Read this with our Terms of Use, which govern your use of NuPARE.