Privacy Policy

This policy explains what personal information IQUAPOT Proprietary Limited (“IQUAPOT”, “we”, “us”) collects, why we collect it, who we share it with and the choices you have. We have written it in plain English. Where a word has a particular meaning, we explain it the first time we use it.

“Personal information” means information about a person who is identified or who can reasonably be identified. Some countries call it “personal data”. We use the two terms to mean the same thing.

1. Who we are and how to contact us

IQUAPOT Proprietary Limited (ACN 702 803 352, ABN 52 702 803 352), trading as IQUAPOT, provides the IQUAPOT website and app. Our registered office is 29 Direction Drive, Tarneit VIC 3029, Australia, and we are based in Melbourne, Victoria, Australia.

We decide how and why your personal information is used. European and UK law call that being the “controller”.

Privacy contact. Email contact@iquapot.com and put “Privacy” in the subject line.

Our representative in the European Union (Article 27 of the GDPR): none

Our representative in the United Kingdom (Article 27 of the UK GDPR): none

2. What this policy covers

This policy applies to:

• this website, iquapot.com;
• any email you send us, and our replies; and
• the IQUAPOT app for iPhone and Android.

The app has not been released yet. The parts of this policy about accounts, pots, splits and expenses describe how the app will handle personal information, and they apply from the day the app launches (late 2026 – early 2027). Until then, this website collects nothing about you by itself (see section 4.2), and the only personal information we hold is what you send us by email.

This policy does not cover services run by other organisations, such as your bank, your payment app, the App Store, Google Play or the social networks we link to. They have their own privacy policies.

3. The short version

• We collect only what we need to run this website and, from launch, the app. The website has no sign-up form and no mailing list.
• We never hold or move your money. IQUAPOT keeps a record of what your group has chipped in and spent. Payments happen outside the app, in your own bank or payment app.
• The people in your pot can see what you add to it. That is the point of a shared pot.
• We do not sell your personal information, and we do not share it for advertising that follows you across other sites and apps.
• You are in control. You can see, correct, export or delete your information at any time.

4. The information we collect

4.1 Information you give us

On this website: nothing. The website has no form, no account and no mailing list. If you email us, we keep what you send (see below).

When you create an account in the app:

• your name;
• your email address, or your phone number if you sign in by phone;
• a scrambled (“hashed”) version of your password, if you use one. We never see or store the password itself;
• if you sign in with Google, the basic profile details Google passes to us, such as your name and email address; and
• a profile picture or avatar, if you add one.

If you turn on Face ID, Touch ID or fingerprint sign-in, the check happens on your phone. Your face and fingerprint data never leave your device and we never receive them.

When you use pots and splits:

• the names of your pots and groups;
• amounts, currencies and descriptions of what was chipped in, spent and owed;
• receipts, proof-of-payment files and other files you attach;
• comments; and
• who was in the group and who shared what.

When you invite people. If you choose to invite someone from your contacts, the app asks for your permission first and uses only the contact you pick. We do not upload your address book in the background.

When you contact us or answer a survey. We keep what you send us, including your email address and anything you attach.

Please do not put sensitive information in pot names, descriptions, comments or attachments. That means things like health details, government ID numbers or full bank card numbers. IQUAPOT does not need them.

4.2 Information recorded automatically

On this website:

• our hosting provider’s servers record standard technical logs, such as IP address, browser type, the page requested and the time.

The website sets no cookies and stores nothing in your browser (see section 13).

In the app:

• the type of device, its operating system and the version of the app;
• identifiers such as an app installation ID;
• log and crash data, so we can find and fix faults;
• your approximate location, worked out from your IP address (country or city level only);
• usage events, such as which features are used; and
• a push token, which is what lets us send notifications to your device if you allow them.

We suggest your region and currency from your device’s time zone and language settings. We do not ask for location permission and we do not collect your precise location.

4.3 Information from other people and organisations

• Members of your groups. Someone may add your name and contact detail to a pot in order to invite you, and may record what you chipped in or owe.
• The App Store and Google Play. If you buy a subscription, the store tells us its status (for example, active or cancelled). We never receive your card details.

4.4 Do you have to give us this information?

You need to give a name and an email address or phone number to have an account in the app. Everything marked optional is up to you. If you leave it out, the service still works.

5. Why we use it, and the legal basis

Where we rely on legitimate interests, we have weighed our reasons against your rights and concluded that the use is fair and expected. You can object at any time (see section 11).

Where we rely on consent, you can withdraw it at any time. It will not affect anything we did before you withdrew it.

We use personal information only for the purpose we collected it for, or for a closely related purpose you would reasonably expect, unless the law allows or requires otherwise.

6. What other people in your pot can see

When you are a member of a pot or a split, the other members can see:

• your name and your avatar;
• what you have chipped in, what you owe or are owed, and the expenses recorded;
• the receipts and proof-of-payment files attached to the pot; and
• comments.

Proof-of-payment files are supplied by members. We do not check them.

[PLACEHOLDER: who can add, edit and delete entries in a pot (the admin only, or any member), to be confirmed with the app developer]

Anyone who has a pot’s invite link or its 8-character code can ask to join it, so share them only with the people you mean to invite. The admin of a pot can remove a member, and members can report one another to us.

If you leave a pot or delete your account, the records of that pot stay visible to the remaining members, because the record belongs to the whole group and they still need it to settle up. We remove your identifying details from those records: your name, avatar and contact details are replaced with a neutral label.

7. Who we share it with

We share personal information only with:

The companies that process information for us may use it only to provide their service to us, under a written contract, and must keep it secure.

We do not sell personal information. We do not share it for cross-context behavioural advertising or for targeted advertising. We do not let advertisers or data brokers have it.

8. Sending information to other countries

IQUAPOT Proprietary Limited is an Australian company. Information is stored in Singapore, and some of the providers in section 7 handle it in the United States and in other countries. The privacy laws of those countries may be different from yours.

When we send personal information to another country we protect it by:

• for information from the European Economic Area, using the European Commission’s standard contractual clauses, or relying on a decision that the destination country’s protection is adequate;
• for information from the United Kingdom, using the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses, or relying on UK adequacy regulations;
• for information we hold under Australian law, taking reasonable steps to make sure the recipient handles it in line with the Australian Privacy Principles (Australian Privacy Principle 8); and
• in every case, a written contract that requires the recipient to protect the information and use it only on our instructions.

You can ask us for a copy of the safeguards that apply to your information. Email contact@iquapot.com.

9. How long we keep it

[PLACEHOLDER: confirm whether an unsubscribed email address is kept on a suppression list so it is not emailed again, and for how long]

We may keep information for longer if we need it for a legal claim, or if the law requires it. When the time is up we delete the information or remove what identifies you.

10. How we protect it

We protect personal information by:

• encrypting it while it travels between your device and our systems;
• limiting access to the people who need it to do their job, and giving each of them only the access they need;
• choosing providers that commit by contract to protecting it; and
• reviewing how we collect, store and handle it.

[PLACEHOLDER: confirm encryption at rest, and name any provider security certifications only if they are true and current]

You can help by using a strong password that you do not use anywhere else, and by telling us straight away at contact@iquapot.com if you think someone else has used your account.

If there is a data breach. If personal information we hold is lost, or is accessed or disclosed without authorisation, and that is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. Where European or UK law applies, we will notify the relevant regulator within 72 hours of becoming aware of a reportable breach, and tell you without undue delay if the risk to you is high. We will do the same wherever another country’s law requires it.

11. Your rights, and how to use them

Depending on where you live, you have some or all of these rights. We give them to everyone where we reasonably can.

• Access. Ask for a copy of the personal information we hold about you.
• Correction. Ask us to fix information that is wrong or out of date.
• Deletion. Ask us to delete your information. See also our account and data deletion page.
• Portability. Ask for your information in a common, machine-readable format.
• Objection. Object to a use we base on legitimate interests, and to direct marketing at any time.
• Restriction. Ask us to pause a use while a question about it is settled.
• Withdrawing consent. Where we rely on your consent, withdraw it at any time.
• Opting out of marketing. Use the unsubscribe link in any email, or email us.
• Opting out of sale, sharing and targeted advertising. We do not do any of these, so there is nothing to opt out of. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out.
• No penalty. We will not treat you differently, charge you more or give you a poorer service because you used a right.
• Appeal. If we refuse a request, you can ask us to look again. Email us with “Privacy appeal” in the subject line. We will answer in writing and tell you how to complain to a regulator if you are still not satisfied.

How to ask. Email contact@iquapot.com, or use the controls in the app where they exist. Tell us which right you want to use and the email address or phone number on your account.

Checking it is you. We confirm a request by emailing the address on your account and asking you to reply. We ask for more only if we cannot be sure otherwise, and we use it only to check your identity. Someone you have authorised in writing can ask on your behalf.

How long it takes. We answer within 30 days. In California, we answer within 45 days. If a request is complex we may need more time, and we will tell you why before the first deadline passes.

Cost. Using your rights is free. We may charge a reasonable fee, or decline, only if a request is clearly unfounded or excessive, and we will explain why.

If you are not happy with our answer, you can complain to a privacy regulator. We would like the chance to put things right first. The regulators are:

• Australia: the Office of the Australian Information Commissioner, oaic.gov.au
• United Kingdom: the Information Commissioner’s Office, ico.org.uk
• European Economic Area: the data protection authority of the country where you live or work, or where you think the problem happened
• New Zealand: the Office of the Privacy Commissioner, privacy.org.nz
• Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca

12. Marketing emails

We do not collect email addresses on this website and we do not run a mailing list before launch. From launch, if you ask for news and updates in the app, the consent box starts unticked and you can change your mind at any time.

Every marketing email we send:

• says clearly that it is from IQUAPOT;
• gives our company name and a postal address; and
• has an unsubscribe link that works straight away and costs nothing.

You can also unsubscribe by emailing contact@iquapot.com. We do not buy or rent mailing lists.

Messages we still send. Even if you unsubscribe from news, we send messages that are needed to run your account, such as sign-in codes, security alerts, receipts and notices about changes to our terms or this policy. Sign-in codes sent by text message are service messages, not marketing.

13. Cookies and similar technology

This website does not use cookies for advertising or tracking, and it stores nothing in your browser. Our Cookie Policy has the detail.

14. Children

IQUAPOT is not for anyone under 18, and we do not knowingly collect personal information from anyone under that age. If we learn that we have, we will delete it and close the account. If you think a child has given us personal information, email contact@iquapot.com.

15. Automated decisions

We do not use personal information to make decisions that have a legal or similarly significant effect on you without a person involved, and we do not build advertising profiles.

Some features work automatically. Settle-up calculates who should pay whom from the amounts your group entered. Bill Scan reads a photographed receipt and fills in the bill for you to check. You can correct the result of either.

[PLACEHOLDER: confirm whether Bill Scan or any other feature uses a third-party machine-learning service, and add it to section 7 if so]

16. Links to other services

Our website and app link to services we do not control, including social networks, the App Store, Google Play and the bank or payment apps you use to settle up. When you follow a link, that service’s own privacy policy applies. We are not responsible for what those services do with your information.

17. Your country

17.1 European Economic Area and United Kingdom

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR and the Data Protection Act 2018 apply.

• IQUAPOT Proprietary Limited is the controller. Our representatives are named in section 1.
• The legal basis for each use is in section 5.
• You have every right in section 11: access, rectification, erasure, restriction, portability, objection and the right to withdraw consent.
• You have the right not to be subject to a decision based only on automated processing that has a legal or similarly significant effect on you. We make no such decisions (section 15).
• Transfers outside the EEA or the UK are protected as described in section 8.
• What you must provide, and what is optional, is in section 4.4.
• You can complain to the data protection authority where you live or work. In the UK that is the Information Commissioner’s Office.

17.2 United States

This section applies to residents of US states with consumer privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act. Some of these laws apply only to businesses above a certain size. [PLACEHOLDER: lawyer to confirm whether any threshold is met.] We give these rights to everyone regardless.

In the last 12 months we have collected, and disclosed to our service providers for the business purposes in section 5, these categories of personal information:

• We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the last 12 months, including the information of anyone under 16.
• We do not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects.
• We use sensitive personal information only to provide the service, and not to infer characteristics about you.
• You have the right to know, to access, to correct, to delete and to obtain a portable copy of your information, and the right not to be discriminated against for using those rights.
• Do Not Sell or Share My Personal Information. We do not sell or share it, so no opt-out is needed. We treat a Global Privacy Control signal from your browser as a valid opt-out request all the same.
• An authorised agent can make a request for you with your written permission.
• If we refuse a request you can appeal (section 11). If the appeal is refused, you can contact your state’s attorney general.
• California’s “Shine the Light” law: we do not disclose personal information to others for their own direct marketing.
• Children: we do not knowingly collect personal information from anyone under 13, or from anyone under 18.

17.3 Australia

We handle personal information under the Privacy Act 1988 and the Australian Privacy Principles.

• You can browse this website without telling us who you are.
• You can ask for access to the personal information we hold about you and ask us to correct it (section 11).
• We are likely to disclose personal information to recipients in the United States and in the other countries named in section 7.
• We send marketing emails only with your consent, identify ourselves in each one and include an unsubscribe link, as the Spam Act 2003 requires.
• We follow the Notifiable Data Breaches scheme (section 10).
• Complaints. Email contact@iquapot.com first. We will acknowledge your complaint and respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

17.4 Canada, including Quebec

We handle personal information under the Personal Information Protection and Electronic Documents Act and the provincial laws that apply.

• We are accountable for the personal information we hold, including information we pass to providers for processing.
• We collect, use and disclose personal information with your knowledge and consent, except where the law allows otherwise. You can withdraw consent, subject to legal or contractual limits.
• Your information is processed outside Canada, including outside Quebec, in the countries named in section 7. It may be accessible to the courts and authorities of those countries.
• The person responsible for the protection of personal information is: [PLACEHOLDER: name and title of the person responsible for the protection of personal information, as Quebec’s Law 25 requires]. Contact them at contact@iquapot.com.
• You can ask for access to your information and for it to be corrected, and you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
• We send commercial electronic messages only with your express consent, identify ourselves in each one and include an unsubscribe mechanism, as Canada’s anti-spam law requires.
• [PLACEHOLDER: decision on whether IQUAPOT is actively marketed in Quebec and, if so, the French-language version of this policy]

17.5 New Zealand

We handle personal information under the Privacy Act 2020 and its Information Privacy Principles.

• You can ask for access to your information and for it to be corrected.
• If a privacy breach causes, or is likely to cause, serious harm, we will notify you and the Privacy Commissioner.
• We send commercial emails only with your consent and with an unsubscribe link, as the Unsolicited Electronic Messages Act 2007 requires.
• You can complain to the Office of the Privacy Commissioner at privacy.org.nz.

17.6 India

Where the Digital Personal Data Protection Act 2023 and its Rules apply, as they come into force:

• this policy is our notice of the personal data we process and why;
• we process personal data with your consent or for the other uses the Act allows, and you can withdraw consent as easily as you gave it;
• you can ask for a summary of the personal data we process, and for it to be corrected, completed, updated or erased;
• you can nominate another person to use your rights if you die or lose capacity;
• IQUAPOT is not for anyone under 18, so we do not process children’s data; and
• grievances: email contact@iquapot.com. [PLACEHOLDER: name and contact of the grievance officer, if one is required.] If we do not resolve your grievance, you can complain to the Data Protection Board of India.

17.7 Everywhere else

If you live somewhere with its own privacy law, including Brazil (the LGPD), Singapore (the PDPA), Japan (the APPI) and South Africa (POPIA), we honour the rights that law gives you. One contact covers all of them: email contact@iquapot.com and tell us where you live and what you would like us to do. That address also reaches the person who handles data protection matters for us, including requests under Brazil’s LGPD.

If you are not satisfied with our answer, you can complain to your national authority, for example Brazil’s Autoridade Nacional de Proteção de Dados, Singapore’s Personal Data Protection Commission, Japan’s Personal Information Protection Commission or South Africa’s Information Regulator.

18. Changes to this policy

We may update this policy as the service or the law changes. The version and dates at the top of the page show which one you are reading, and earlier versions stay available in our archive.

If a change is material, meaning it affects what we collect, why we use it or who we share it with, we will tell you by email or by a notice in the app at least 14 days before it takes effect. If a change needs your consent, we will ask for it.

19. Contact and version history

Email contact@iquapot.com. Post: IQUAPOT Proprietary Limited, 29 Direction Drive, Tarneit VIC 3029, Australia.