Privacy Policy | Not So Sushi

Not So Sushi Mobile Application

Last Updated: January 2026

---
1. INTRODUCTION

Not So Sushi ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect,
use, disclose, and safeguard your personal information when you use our mobile application, in accordance with the
Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

---
2. INFORMATION WE COLLECT

2.1 Information You Provide:
- Name
- Email address
- Mobile phone number
- Account credentials (password stored in securely hashed form only)

2.2 Information Generated Through Use:
- Order history and preferences
- Loyalty program activity
- App usage data and analytics
- Device information (device type, operating system)
- Push notification tokens (if notifications are enabled)

2.3 Payment Information:
Payment card details are collected and processed directly by Square, Inc., our payment processor. We do not store full
credit card numbers, CVV codes, or card expiration dates on our servers. We may receive limited transaction
information such as the last four digits of cards for reference purposes.

2.4 Information We Do NOT Collect:
- Location/GPS data
- Contacts or address book
- Photos or camera access
- Biometric data (Face ID/Touch ID is processed on-device only and never transmitted to us)

---
3. HOW WE USE YOUR INFORMATION

We use your personal information to:
- Create and manage your account
- Process and fulfill your orders
- Process payments (via Square)
- Communicate about orders and account matters
- Operate our loyalty rewards program
- Send promotional communications (with your consent)
- Improve our products and services
- Detect and prevent fraud
- Comply with legal obligations

---
4. LEGAL BASIS FOR PROCESSING

We process your personal information based on:
- Contract: To fulfill orders and provide services you request
- Consent: For marketing communications and optional features
- Legitimate Interests: To improve services and prevent fraud
- Legal Obligation: To comply with applicable laws

---
5. DISCLOSURE OF INFORMATION

5.1 Service Providers:
We may share information with trusted third-party service providers who assist us in operating the app, including:
- Square, Inc. – Payment processing and order management
- Supabase – Secure database hosting
- OneSignal – Push notification delivery
- Expo – App updates and distribution

5.2 Legal Requirements:
We may disclose information if required by law, court order, or government request, or if we believe disclosure is
necessary to protect our rights, your safety, or the safety of others.

5.3 Business Transfers:
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that
transaction. We will notify you of any such change.

---
6. DATA STORAGE & SECURITY

6.1 Storage Location:
Your data is primarily stored in Australia using Supabase's Australian data centres. Some service providers may
process data in other jurisdictions with appropriate safeguards in place.

6.2 Security Measures:
We implement reasonable technical and organisational measures to protect your information, including:
- Encryption in transit (TLS/SSL)
- Encryption at rest
- Secure password hashing (bcrypt)
- Access controls and authentication
- Regular security assessments

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee
absolute security.

---
7. DATA RETENTION

We retain your personal information for as long as your account is active, plus a reasonable period thereafter to
comply with legal obligations, resolve disputes, and enforce agreements.

Order history may be retained for up to 7 years for tax and legal compliance purposes.

Upon account deletion request, we will delete or anonymise your personal information within a reasonable timeframe,
except where retention is required by law.

---
8. YOUR RIGHTS

Under the Privacy Act 1988 (Cth), you have the right to:
- Access: Request access to personal information we hold about you
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your account and associated data
- Opt-Out: Opt out of marketing communications at any time
- Complaint: Lodge a complaint with us or the Office of the Australian Information Commissioner (OAIC)

To exercise these rights, please contact us using the details in Section 12.

---
9. MARKETING & COMMUNICATIONS

9.1 Transactional Communications:
We will send you service-related communications (order confirmations, account notices) which are necessary for the
operation of your account. These are not marketing messages.

9.2 Marketing Communications:
With your consent, we may send promotional offers via email, SMS/text message, or push notifications.

9.3 Opt-Out:
You may opt out of marketing communications at any time by:
- Clicking "unsubscribe" in marketing emails
- Replying "STOP" to SMS messages
- Disabling push notifications in your device settings
- Contacting us directly

---
10. PUSH NOTIFICATIONS

Push notifications require your device permission. You can enable or disable them at any time through your device
settings.

We may send push notifications for:
- Order updates and status changes
- Promotional offers and deals
- Account and security alerts
- Loyalty program updates

Push notifications are delivered via OneSignal. Your device token is shared with OneSignal solely for notification
delivery purposes.

---
11. CHILDREN'S PRIVACY

This app is not intended for children under 13 years of age. We do not knowingly collect personal information from
children under 13.

If you believe we have collected information from a child under 13, please contact us immediately and we will take
steps to delete such information.

---
12. CONTACT US

For privacy inquiries, data requests, or complaints:

Not So Sushi
Collingwood, Victoria, Australia

You can also contact us through the "Contact Us" feature in the app.

For unresolved privacy complaints, you may contact the Office of the Australian Information Commissioner (OAIC) at
http://www.oaic.gov.au.

---
13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes will be notified through the app or via email.
The "Last Updated" date at the top of this policy indicates when it was last revised.

Your continued use of the app after changes are posted constitutes your acceptance of the updated policy.

SUSHI YOU'LL TALK ABOUT LATER