Privacy Policy

Who is responsible for your information

Connect3 is operated by Data Science Student Society, ABN 46 794 110 629, of Data Science Student Society, Mailbox 12, Level 4, Building 168, University of Melbourne VIC 3010. We are the entity responsible for the personal information described here. Privacy questions and complaints go to support@mail.connect3.app.

Clubs that run events on Connect3 handle attendee information for their own events. For that information the club is responsible alongside us, and its own privacy practices apply as well as this policy.

What we collect

Account and profile. Your name, email address, university, degree and major, year of study, profile photo and anything else you choose to put on your profile. If you sign up with Google or another provider, we receive your name, email and profile image from them.

Club and membership records. Which clubs you belong to, membership status and expiry, and the membership pass we issue — including the pass added to Apple Wallet or Google Wallet if you add it.

Tickets and event registrations.Which events you register for, and the details collected at checkout: first and last name, email address, course, student ID, whether you are a member of the hosting club, plus any additional questions the club adds to its own form. If you are signed in and leave “Remember my answers” ticked, we also keep your course and student ID to fill in your next attendance form. Untick it at any checkout and we delete them.

Payment information.Card details are entered directly into Stripe’s payment form and are never sent to or stored by Connect3. We keep the payment identifier, amount, currency and status so we can reconcile a ticket to a payment.

Content and activity. Messages you send in chat, searches you run, events you view or save, and any images or files you upload.

Technical information. IP address, browser and device details, pages viewed, and a browser fingerprint identifier we generate to recognise a device across a session. We use analytics cookies through Google Analytics.

Information we get from Google

Signing in with Google. If you sign in with Google, Google shares your name, email address and profile photo with us. We use them to create your account and sign you in.

Google Sheets exports for clubs.A club can connect a Google account to export its event attendee lists to Google Sheets. We ask only for access to the files Connect3 creates in that account’s Google Drive. We cannot see any other file in it. We use this access to create one spreadsheet for each event, keep its attendee list up to date, and share it view-only with the club members who can already see that event’s attendees. We keep the connected account’s email address so the club can see which account is connected. We store the access token Google gives us encrypted.

Disconnecting.A club owner can disconnect Google from the club’s settings at any time. We then revoke our access at Google and delete the stored token. Spreadsheets already created stay in the club’s Drive, where the club controls them. You can also remove Connect3’s access from your Google Account’s security settings.

Connect3’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI models.

Why we collect it

• To run your account, sign you in and keep it secure.
• To show you events, clubs and people that are relevant to you, including search and recommendations.
• To sell and issue tickets, and to give the hosting club the attendee list it needs to run its event and check people in.
• To issue and verify membership passes, including member-only ticket pricing.
• To send you transactional messages — ticket confirmations, event reminders, account and security notices.
• To detect and prevent fraud, abuse and duplicate registrations.
• To understand how the platform is used so we can improve it.
• To meet our legal and record-keeping obligations.

We do not sell personal information, and we do not use it for third-party advertising.

Who else sees it

Clubs. When you register for an event, the hosting club receives the details you gave at checkout so it can run the event. When you join a club, that club sees your membership record and the profile details you have made visible.

Other users. Your profile, and the parts of it you choose to show, are visible to other people on the platform. Messages you send are visible to their recipients.

Service providers. We use a small number of providers to run the platform. Each only receives what it needs:

• Supabase — database, authentication and file storage.
• Stripe — payment processing, connected accounts and payouts to clubs.
• Vercel — application hosting, and bot detection on public forms.
• Resend — transactional email.
• OpenRouter — runs the AI models behind search, chat and recommendations. It passes the text you submit to those features to the company that serves the model, such as OpenAI, DeepSeek or Baidu.
• Google — sign-in with Google, and Google Sheets exports for clubs that connect a Google account.
• Google Analytics — usage analytics.
• Apple and Google — only if you add a membership pass to their wallet apps.

We also disclose information where the law requires it, where it is needed to investigate suspected fraud or a serious safety risk, or if the platform is transferred to another operator — in which case this policy travels with it.

Where it goes

Some of these providers store or process personal information outside Australia, principally in the United States. Text sent to some AI models is processed in China. Before disclosing information overseas we take reasonable steps to satisfy ourselves that the recipient handles it consistently with the Australian Privacy Principles, and our arrangements with them require it.

How long we keep it

We keep your account information for as long as your account exists. Ticket and payment records are kept for at least seven years, because financial records have to be. Content you delete is removed from the live platform and drops out of backups on their normal cycle. When you delete your account we delete or de-identify your personal information except where we are required to keep it.

Keeping it safe

Access to the database is controlled by row-level security policies so that a signed-in user can only read what they are entitled to. Data is encrypted in transit, secrets are held in a managed secret store, and administrative access is limited to the people who need it. No system is perfectly secure; if a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Your choices and your rights

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email support@mail.connect3.app and we will respond within 30 days.

• Most of your profile can be viewed and corrected directly in the app.
• You can delete your account from your account settings, which removes your profile and content.
• You can unsubscribe from non-transactional email from the link in the message. Ticket confirmations and security notices are not optional while you have an account.
• You can block analytics cookies in your browser. The platform still works without them.

You can deal with us anonymously or under a pseudonym when you are just browsing public event and club pages. Buying a ticket or holding an account is not something we can offer anonymously — the club needs to know who is coming.

Children

Connect3 is intended for university students and staff and is not directed at children under 13. If we learn we hold information about a child under 13, we will delete it.

Complaints

If you think we have mishandled your personal information, tell us at support@mail.connect3.app or through our contact form. We will acknowledge your complaint and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We update this policy as the platform changes. The date at the top is the date of the current version, and we will tell account holders before a change that materially affects them takes effect.