Privacy Policy

Who is responsible for your information

Connect3 is operated by [TODO: registered legal entity name], ABN [TODO: ABN], of Data Science Student Society, Mailbox 12, Level 4, Building 168, University of Melbourne VIC 3010. We are the entity responsible for the personal information described here. Privacy questions and complaints go to support@mail.connect3.app.

Clubs that run events on Connect3 handle attendee information for their own events. For that information the club is responsible alongside us, and its own privacy practices apply as well as this policy.

What we collect

Account and profile. Your name, email address, university, degree and major, year of study, profile photo and anything else you choose to put on your profile. If you sign up with Google or another provider, we receive your name, email and profile image from them.

Club and membership records. Which clubs you belong to, membership status and expiry, and the membership pass we issue — including the pass added to Apple Wallet or Google Wallet if you add it.

Tickets and event registrations. Which events you register for, and the details collected at checkout: first and last name, email address, student ID, course, whether you are a member of the hosting club, plus any additional questions the club adds to its own form.

Payment information.Card details are entered directly into Stripe’s payment form and are never sent to or stored by Connect3. We keep the payment identifier, amount, currency and status so we can reconcile a ticket to a payment.

Content and activity. Messages you send in chat, searches you run, events you view or save, quiz answers, and any documents you upload — for example a résumé, if you use the feature that fills in your profile from one.

Technical information. IP address, browser and device details, pages viewed, and a browser fingerprint identifier we generate to recognise a device across a session. We use analytics cookies through Google Analytics.

Why we collect it

• To run your account, sign you in and keep it secure.
• To show you events, clubs and people that are relevant to you, including search and recommendations.
• To sell and issue tickets, and to give the hosting club the attendee list it needs to run its event and check people in.
• To issue and verify membership passes, including member-only ticket pricing.
• To send you transactional messages — ticket confirmations, event reminders, account and security notices.
• To detect and prevent fraud, abuse and duplicate registrations.
• To understand how the platform is used so we can improve it.
• To meet our legal and record-keeping obligations.

We do not sell personal information, and we do not use it for third-party advertising.

Who else sees it

Clubs. When you register for an event, the hosting club receives the details you gave at checkout so it can run the event. When you join a club, that club sees your membership record and the profile details you have made visible.

Other users. Your profile, and the parts of it you choose to show, are visible to other people on the platform. Messages you send are visible to their recipients.

Service providers. We use a small number of providers to run the platform. Each only receives what it needs:

• Supabase — database, authentication and file storage.
• Stripe — payment processing, connected accounts and payouts to clubs.
• Vercel — application hosting, and bot detection on public forms.
• Resend — transactional email.
• OpenAI — powers search, recommendations and the features that read a résumé or generate a match; the text you submit to those features is sent for processing and is not used to train their models.
• Google Analytics — usage analytics.
• Apple and Google — only if you add a membership pass to their wallet apps.

We also disclose information where the law requires it, where it is needed to investigate suspected fraud or a serious safety risk, or if the platform is transferred to another operator — in which case this policy travels with it.

Where it goes

Some of these providers store or process personal information outside Australia, principally in the United States. Before disclosing information overseas we take reasonable steps to satisfy ourselves that the recipient handles it consistently with the Australian Privacy Principles, and our arrangements with them require it.

How long we keep it

We keep your account information for as long as your account exists. Ticket and payment records are kept for at least seven years, because financial records have to be. Content you delete is removed from the live platform and drops out of backups on their normal cycle. When you delete your account we delete or de-identify your personal information except where we are required to keep it.

Keeping it safe

Access to the database is controlled by row-level security policies so that a signed-in user can only read what they are entitled to. Data is encrypted in transit, secrets are held in a managed secret store, and administrative access is limited to the people who need it. No system is perfectly secure; if a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Your choices and your rights

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email support@mail.connect3.app and we will respond within 30 days.

• Most of your profile can be viewed and corrected directly in the app.
• You can delete your account from your account settings, which removes your profile and content.
• You can unsubscribe from non-transactional email from the link in the message. Ticket confirmations and security notices are not optional while you have an account.
• You can block analytics cookies in your browser. The platform still works without them.

You can deal with us anonymously or under a pseudonym when you are just browsing public event and club pages. Buying a ticket or holding an account is not something we can offer anonymously — the club needs to know who is coming.

Children

Connect3 is intended for university students and staff and is not directed at children under 13. If we learn we hold information about a child under 13, we will delete it.

Complaints

If you think we have mishandled your personal information, tell us at support@mail.connect3.app or through our contact form. We will acknowledge your complaint and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We update this policy as the platform changes. The date at the top is the date of the current version, and we will tell account holders before a change that materially affects them takes effect.