Privacy Policy

1. ABOUT THIS POLICY

This Privacy Policy explains how AND Technology Group Pty Ltd, trading through Aussies After Dark ("AAD", "we", "us" or "our"), collects, holds, uses and discloses personal information.

Contact:

admin@aussiesafterdark.com

We recognise that privacy is particularly important in the context of an adult advertising platform and seek to limit collection and disclosure of personal information to what is reasonably required for operating, securing and administering AAD.

2. INFORMATION WE MAY COLLECT

Depending on how you use AAD, we may collect:

Account information

• email address;
• password hash;
• account role and status;
• login and account-security information;
• email-verification information.

Advertiser contact information

• private contact email;
• private contact telephone number;
• business name where applicable.

Identity-verification information

• verified given name or names;
• verified family name;
• date of birth;
• document country;
• document type;
• verification provider/session references;
• verification status and result information;
• verification dates and expiry;
• information required for manual administrative review where applicable.

AAD does not ordinarily store the identity-document images, selfies, liveness captures or document numbers collected through Didit's hosted verification process.

Legal contact information

• the legal first name, legal surname and date of birth of the person responsible for an advertiser account, provided at registration.

Photo verification information

• a photograph of the advertiser holding a unique code issued by AAD;
• photographs that clearly show the advertiser's face, which may be profile photographs or photographs provided for verification only;
• where an establishment chooses to submit a worker's photographs for photo verification, a photograph of that worker holding a unique code;
• review decisions, requests for further information and the advertiser's responses.

Account administration information

• verification deadline and reminder records;
• archive, suspension and reactivation records, including the reason and date.

Advertiser profile information

• public/display name;
• advertised age or age band;
• gender/category;
• descriptions and profile text;
• services;
• rates;
• availability;
• service locations and touring information;
• languages;
• characteristics selected by the advertiser;
• social-media and website links;
• contact methods;
• photographs and videos.

Some profile fields selected or supplied by an advertiser may reveal information that is sensitive or personal in nature. Advertisers should only provide information they are comfortable providing for the purpose indicated.

Establishment information

• business/establishment name;
• address and location information;
• website;
• opening hours;
• telephone number;
• ABN if supplied;
• worker/profile information, including photographs and advertising content, provided by the establishment (see Information about establishment workers).

Payments and advertising

• invoices;
• invoice line items;
• amounts and price snapshots;
• payment references;
• payment status;
• promotion/discount information;
• advertising entitlements;
• VIP Boost credits and promotional records.

AAD currently uses a manual PayID payment process. Payment transfers occur through the banking system rather than through AAD processing payment-card details.

Enquiries

Where a visitor uses an AAD contact form, we may collect:

• name;
• email address;
• message;
• information necessary to deliver and protect the enquiry service.

If you use AAD to send an enquiry to an advertiser, the name, email address, message and other information you deliberately include in that enquiry are provided to the advertiser so they can receive and respond to your enquiry.

Support and contact

• name;
• email address;
• category;
• message;
• account association where the sender is signed in;
• administrative handling information.

Reports and takedown requests

We may collect:

• report reason and details;
• optional reporter name and email;
• URLs;
• supporting information or evidence;
• declarations and signatures where applicable;
• administrative notes and resolution information.

Legal acceptance

• document accepted or acknowledged;
• document version;
• acceptance time;
• acceptance context;
• privacy-protective IP hash;
• record of the acceptance statement.

Media declarations

• media/submission association;
• declaration version;
• declaration time;
• privacy-protective IP hash;
• record of the declaration statement.

Account closure requests

• account;
• request time;
• optional reason;
• request status;
• administrative notes and resolution information.

Technical and security information

We may process:

• IP addresses transiently;
• privacy-protective hashes derived from IP information;
• browser/user-agent information;
• session identifiers;
• security and rate-limit information;
• audit information;
• approximate region information supplied by infrastructure providers.

3. IDENTITY VERIFICATION

AAD uses an external identity-verification provider, currently Didit (Didit Identity Spain, S.L., Barcelona, Spain), to verify advertiser identity and adulthood.

The advertiser completes the verification process through Didit's hosted service. Didit captures images of an identity document, a selfie and a short liveness capture, compares the face with the document photograph, checks that a real person is present, and records technical information such as IP address and device data to help prevent fraud.

AAD receives information necessary to determine the result and administer the verification process.

AAD's current system is designed not to persist Didit identity-document images, selfies, liveness captures, face-comparison or liveness results, document numbers, nationality, place of birth, address, device or IP information, raw technical data or raw webhook payloads.

AAD gives Didit an internal account reference so that repeat attempts by the same advertiser are recognised as one person. Didit may use facial information to detect the same face or document being used in different verifications performed for AAD.

AAD may also use limited verified identity information to help detect whether the same verified identity is being used across multiple advertiser accounts. Where possible, this comparison is performed using a protected derived identifier rather than storing additional copies of the underlying identity information.

Identity Verification Data Storage and Retention

Aussies After Dark uses an independent, third-party identity verification provider to verify the identity and age of advertisers.

Identity documents, photographs, facial verification information and other information collected during the verification process are submitted directly to and processed through Didit's external verification service. Aussies After Dark does not ordinarily receive or store copies of these documents or biometric images.

Didit manages the storage, security, processing and retention of verification information within its systems, in accordance with its applicable privacy notices, contractual arrangements and legal obligations. Didit processes information in the European Union by default and may process it in other countries with appropriate safeguards.

For information about how Didit collects, uses, stores, retains and deletes verification information, please refer to its official privacy notice:

https://didit.me/terms/verification-privacy-notice

Aussies After Dark retains only the limited verification information required to administer advertiser accounts, maintain verification records and comply with applicable legal obligations, as described in this Privacy Policy. Aussies After Dark remains responsible for its own collection, use and disclosure of personal information, including its engagement of the verification provider and its use of the verification results it receives.

Before verification begins, the advertiser is asked to consent to the provider collecting and processing their identity document and facial information, including biometric information, for identity and age verification. AAD records that consent together with the provider and the version of this Privacy Policy that applied.

Use of Artificial Intelligence in Identity Verification

Our third-party identity verification providers may use artificial intelligence, automated systems and biometric matching technologies to assist with identity verification, age verification, document authenticity checks, fraud prevention and related security processes.

These technologies may be used to assess identification documents, compare facial images and identify potentially fraudulent verification attempts. The use and handling of information by each provider is governed by its applicable privacy notices and legal obligations.

Separately from performing a verification, Didit's Verification Privacy Notice states that, where the law permits, Didit may use anonymised or pseudonymised verification-related data for service testing, quality assurance, fraud-model training and validation and security improvement, unless its customer opts out. Aussies After Dark has not opted out of this use at the date of this version. More information, including how to object, is in Didit's Verification Privacy Notice.

Didit processes verification information on AAD's behalf, and may also process limited information as an independent controller for security, abuse prevention, legal compliance, audit and legal claims.

Didit may independently collect and retain information under its own terms and privacy practices. Advertisers should review information presented by Didit when beginning verification.

After a verification decision, AAD automatically retrieves from Didit the verified legal name, date of birth, document country and document type, and keeps them privately. AAD does not receive or keep copies of identity documents for this purpose.

AAD compares the verified legal name and date of birth with the legal contact details provided at registration, and uses the result, together with the protected derived identifier described above, to help detect duplicate, shared or fraudulent accounts and attempts to avoid a permanent ban. A difference is reviewed by a person and is not approved automatically.

Only authorised AAD administrators can see the registered and verified legal details, for verification, fraud-prevention and administration purposes, and their access to these details is recorded. These details are not shown publicly or to other advertisers.

Where identity verification information is held

Identity documents, selfies, liveness captures and face-comparison results are held by Didit in its systems, under its privacy notice and retention arrangements. Authorised AAD administrators may view them through Didit's administration portal where this is reasonably needed to review a verification, prevent fraud or administer an account. AAD does not download or store copies of them in its own systems.

AAD stores directly only the limited verification results and details described above: the verified legal name, date of birth, document country and document type, provider references, status and decision information, the result of the 18-or-over check, and the protected derived identifier.

Photographs that advertisers provide for AAD's own photo verification are collected and stored separately by AAD, as described under Photo verification.

4. PHOTO VERIFICATION

Photo verification by AAD is a manual comparison

All independent advertisers, including online-only and digital services advertisers, complete AAD's photo verification before their listing is published: a photograph of themselves holding a unique code, and at least two photographs that clearly show their face.

Authorised AAD staff compare these photographs by sight with the advertiser's profile photographs and with the identity verification information, which may include the identity document and photographs held by Didit and viewed through its administration portal, to confirm that the listing shows the verified advertiser. AAD does not use automated facial recognition or any other automated biometric matching for this comparison, and does not create or keep a biometric template from these photographs.

Photographs provided for photo verification are stored privately, separately from public media, and are accessible only to authorised AAD staff. Photographs provided for verification only are never published. A public version of a profile photograph may blur or conceal the face, while the private original is used for verification. Only the result (whether a listing's photos are verified, and the date) is shown publicly.

Before starting photo verification, an independent advertiser is asked to agree to it, and AAD records that agreement.

How this differs from identity verification

Identity verification is a separate check carried out by Didit, which uses automated methods, including biometric face comparison and liveness checks, as described under Identity verification. The document images, selfies, liveness captures and face-comparison results from that check remain with Didit; authorised AAD administrators may view them through Didit's administration portal, but AAD does not store copies of them or any biometric template. AAD's photo verification does not send photographs to Didit or to any other service for automated comparison.

5. INFORMATION ABOUT ESTABLISHMENT WORKERS

People advertised by an establishment do not have their own AAD accounts. The establishment provides their profile information, photographs and advertising content. The establishment's verified responsible person confirms that the establishment has checked each person's age and identity, has their permission to publish this information and, where it submits their photographs for photo verification, their permission to do so, and keeps records of these matters. AAD relies on those confirmations.

Photo verification is optional for people advertised by an establishment. Where an establishment submits a person's photographs, AAD handles them in the same way as an independent advertiser's photo verification photographs: a manual comparison by authorised staff, private storage and the same retention. A person advertised by an establishment is shown as photo verified only where their own verification has been approved.

A person who believes their photographs or information have been published without their permission may use AAD's profile report, takedown request or contact form. They may also contact AAD to ask for access to, or correction or removal of, information about them. AAD may take reasonable steps to assess the request and may contact the establishment.

6. WHY WE COLLECT AND USE INFORMATION

We may collect, hold, use and disclose information to:

• create and administer accounts;
• authenticate users;
• verify email addresses and telephone numbers;
• verify advertiser identity and age;
• confirm that listing photographs show the verified advertiser;
• compare verified identity details with registration details and detect duplicate, shared or fraudulent accounts;
• send verification reminders and account administration notices, and administer verification deadlines, account archiving and reactivation;
• publish and administer advertisements;
• moderate profiles and media;
• process advertising purchases and record payments;
• provide search, location and discovery features;
• facilitate visitor enquiries;
• operate availability and promotional features;
• prevent fraud, abuse and unauthorised access;
• investigate reports and safety concerns;
• process copyright and consent-related takedowns;
• communicate operational information;
• provide support;
• maintain audit and security records;
• understand platform usage using first-party analytics;
• enforce our agreements and policies;
• establish, exercise or defend legal claims;
• comply with applicable laws, court orders, regulatory requirements and lawful requests.

7. PUBLIC PROFILE INFORMATION

Information submitted for publication on an advertiser profile may be publicly accessible once the profile is approved and eligible for publication.

This may include the advertiser's display name, age or age band, services, rates, general location, availability, profile description, approved media, links and selected contact information.

Advertiser email addresses used for account administration are not publicly displayed merely because they are associated with an account.

Telephone numbers configured for public contact may be revealed to visitors through AAD's contact features.

Advertisers should not place information in a public profile that they do not want publicly disclosed.

8. LOCATION INFORMATION

AAD may use location information in several different ways.

Advertiser locations

Advertisers may provide service areas, base locations, touring locations and other geographic information for advertising.

Near Me

If a visitor deliberately chooses the Near Me feature, their device may provide coordinates for the purpose of identifying a nearby area. AAD's current implementation does not store or log those coordinates.

Approximate visitor region

AAD may receive an approximate state or region from Cloudflare and use it to apply advertiser geographic-privacy settings. AAD's current implementation does not store that region merely for the state-hiding feature.

IP information

Raw IP information may be processed transiently for security, rate limiting, analytics and abuse prevention. AAD stores privacy-protective hashes rather than raw IP addresses in the relevant application records.

9. ANALYTICS

AAD currently uses first-party analytics rather than third-party advertising analytics.

Analytics may record events such as:

• listing impressions;
• profile views;
• telephone reveals;
• call, SMS or WhatsApp clicks;
• contact-form interactions;
• website and social-link clicks;
• video plays.

AAD uses privacy-protective identifiers and does not intentionally use these analytics to fingerprint individual visitors.

Raw analytics events are currently retained for up to approximately 400 days. Aggregated statistics may be retained for longer.

10. COOKIES

AAD currently uses first-party cookies including:

aad_session

Used for authenticated login sessions.

aad_age

Records an adult visitor's 18+ acknowledgement.

aad_v

Provides a random visitor-session identifier used for analytics deduplication.

These cookies currently use periods of up to approximately 30 days depending on their purpose and renewal.

Cloudflare and services such as Turnstile may also use cookies or similar technologies as part of infrastructure, security and bot-protection services.

AAD does not currently operate third-party advertising trackers.

11. WHO WE MAY DISCLOSE INFORMATION TO

AAD may disclose information where reasonably necessary to service providers involved in operating the platform.

These may include:

Didit

For identity and age verification, including document, liveness and face-comparison checks.

SendGrid

For transactional and operational email, including delivery of visitor enquiries.

Kudosity / TransmitSMS

For advertiser telephone verification.

Cloudflare

For website delivery, security, bot protection, content delivery, approximate region information and cache management.

Hosting and infrastructure providers

For hosting the application, database, files and associated infrastructure.

Browser push providers

For administrator notifications where enabled.

X

If AAD's social-promotion feature is enabled and an advertiser has separately opted in, approved promotional text and a selected watermarked image may be sent to X for publication.

Advertisers you contact

If you use an AAD enquiry form to contact an advertiser, the information you submit for that enquiry, including your name, email address and message, is disclosed to that advertiser for the purpose of receiving and responding to your enquiry.

Professional advisers, regulators and authorities

Information may also be disclosed where reasonably necessary to obtain professional advice, establish or defend legal rights, comply with law or respond to a valid legal or regulatory requirement.

12. OVERSEAS PROCESSING

Some third-party technology providers may process or store information outside Australia or through global infrastructure.

Because provider infrastructure and processing locations can change, we do not represent that all information remains in Australia.

Where Australian privacy law requires us to take particular steps in connection with an overseas disclosure, we will take the steps required by that law.

13. MEDIA STORAGE

Original advertiser media is held separately from public media in AAD's current architecture.

Original/master media is not given a public URL merely because it has been uploaded.

Approved public media may be copied to public storage and distributed through AAD's content-delivery infrastructure.

Public photographs are processed and watermarked.

AAD processes public photographs to remove ordinary embedded metadata. Supported uploaded video is also processed before publication to remove supported embedded metadata, including metadata that may contain device or location information.

Advertisers should nevertheless avoid deliberately including private location, device or other sensitive information in media they upload.

When a photograph is uploaded, AAD calculates a fingerprint of the image file so that duplicate uploads can be detected. The fingerprint describes the whole image, not a face or any facial features, and cannot be used to identify a person.

14. SECURITY

AAD uses administrative, technical and organisational measures intended to protect information appropriate to the nature of the service.

Current measures include password hashing, server-side access controls, hashed session tokens, separation of public and private media, rate limiting, audit logging, security headers and authenticated webhook processing.

No online service can guarantee absolute security.

15. RETENTION

AAD retains information for periods reasonably connected with the purpose for which it was collected, legitimate operational and safety requirements, dispute resolution and applicable legal obligations.

Current system-specific retention includes:

• rejected identity records: generally 90 days after the relevant decision;
• certain legacy verification documents: generally 90 days after the decision;
• photographs taken for a photo verification (holding a code): generally 90 days after the decision on that verification;
• photographs provided for verification only: kept while the account is active, generally deleted 90 days after an account is archived, and deleted when the advertiser removes them or the account is closed;
• SMS verification attempts: generally around 24 hours;
• rate-limit records: generally around one day;
• raw analytics events: generally up to approximately 400 days.

Some records, including invoices, payment records, audit records, reports, takedown records and aggregated operational records, may need to be retained for longer periods for accounting, legal, fraud-prevention, safety, dispute or enforcement purposes.

Most Australian business records are commonly required to be retained for at least five years, with some records subject to longer requirements.

AAD will review retention arrangements and, where applicable, take reasonable steps to destroy or de-identify personal information when it is no longer reasonably required and is not required to be retained by law.

Verified legal identity details (legal name, date of birth, document country and type) and the legal contact details provided at registration are kept while the account exists, including while it is archived, so that duplicate accounts and attempts to avoid a permanent ban can be recognised. Rejected identity records are handled as described above. These details are deleted when the account is closed, subject to the records AAD must keep as described in this Policy.

16. ACCOUNT CLOSURE

Advertisers may request closure of their account through the account-closure facility in their AAD account or by contacting:

admin@aussiesafterdark.com

Account closure does not necessarily result in the immediate deletion of every record.

AAD may retain or de-identify information where reasonably required for accounting, legal obligations, fraud prevention, safety, disputes, enforcement, record keeping or the establishment, exercise or defence of legal claims.

Public advertising associated with a closed account will be dealt with as part of the closure process.

Account archiving

AAD may archive an advertiser account, for example when mandatory verification is not completed within the required period or where an administrator decides it is necessary. An archived account cannot be used and its listings are not public. Archiving is not deletion: the account records are kept so that the account can be reactivated if appropriate and so that AAD can meet its record-keeping obligations. The retention arrangements above continue to apply while an account is archived, and an archived account may also be closed on request.

17. ACCESS AND CORRECTION

You may request access to personal information AAD holds about you, or request correction of inaccurate information, by contacting:

admin@aussiesafterdark.com

We may need to verify your identity before providing access or making certain changes.

There may be circumstances in which access or correction may be refused or limited as permitted by law. Where required, we will explain the reason.

Advertisers can directly update many profile details through their account.

Verified legal identity information is deliberately restricted and cannot simply be edited as ordinary profile information.

18. PRIVACY COMPLAINTS

If you believe AAD has mishandled your personal information, contact:

admin@aussiesafterdark.com

Please provide enough information for us to understand and investigate the issue.

We will review the complaint and respond within a reasonable period.

Where applicable, you may also have the right to complain to the Office of the Australian Information Commissioner.

19. REPORTERS AND TAKEDOWN REQUESTERS

Information supplied in a safety report or takedown request is used to assess and manage the report.

AAD does not ordinarily disclose reporter or takedown-requester contact details to the advertiser who is the subject of the report.

Information may nevertheless be disclosed where required by law or reasonably necessary for legal proceedings or regulatory processes.

20. SOCIAL PROMOTION

Advertiser participation in AAD social promotion is optional and requires separate consent.

Where enabled and approved, AAD may publish selected profile information and an approved watermarked photograph through an official AAD social account.

Withdrawing consent stops future AAD social promotions under the current system but may not automatically remove posts already published on an external platform.

21. CHILDREN

AAD is an adults-only service.

AAD does not knowingly permit people under 18 to create advertiser accounts or advertise.

Content involving or presented as involving a person under 18 is prohibited.

22. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes to AAD, our information practices, service providers or applicable law.

The current version and effective date will be displayed on AAD.

23. CONTACT

Privacy questions, access or correction requests, account-closure requests and privacy complaints may be sent to:

admin@aussiesafterdark.com