Privacy Policy

1. Who We Are

Sunshower Labs (ABN 35 680 029 477) ("Sunshower Labs," "we," "us," or "our") operates the Seek Halal application and website (the "Service"). We are the data controller responsible for the personal information described in this Policy.

This Policy explains what personal information we collect, why we collect it, the legal grounds on which we rely, how long we keep it, who we share it with, and the rights available to you. It should be read alongside our Terms of Service and Community Guidelines.

If you have any questions about this Policy or wish to exercise any of your rights, contact us at privacy@seekhalal.app.

2. Information We Collect

2.1. Account information. When you create an account, we collect your email address and, depending on your chosen sign-in method, your name and profile picture as provided by Google or Apple. If you register using email and password, we collect the email address and password you provide. Passwords are stored in encrypted form and are never visible to us.

2.2. Profile information. We collect the display name you choose, and we calculate a trust score and badge tier based on your contribution history.

2.3. Content you submit. We collect the content you choose to submit, including restaurant verifications, evidence category selections, ratings, comments, photographs, suggested edits, saved restaurants, and reports you make about other users' content.

2.4. Location information. With your permission, we access your device's location to show nearby restaurants and calculate distances. If location permission is not granted, we may use your IP address to estimate your approximate location instead. IP-based estimation is approximate, typically accurate only to a city or region.

2.5. Technical information. We collect limited technical information necessary to operate and secure the Service, including your IP address, device type, and application version.

3. Why We Process Your Information, and Our Legal Basis

Where the General Data Protection Regulation (GDPR) or UK GDPR applies to you, we rely on the following legal bases:

• Creating and managing your account - performance of a contract
• Displaying your contributions to other users, as an inherent function of the Service - performance of a contract
• Sending transactional emails such as account confirmation and password reset - performance of a contract
• Accessing device location to show nearby restaurants - your consent
• Estimating approximate location from IP address where device location is unavailable - our legitimate interest in providing core location-based functionality
• Moderating content and enforcing our Terms of Service and Community Guidelines - our legitimate interest in maintaining the integrity and safety of the Service
• Notifying you when a moderator removes or restricts your content - our legitimate interest in transparent moderation
• Responding to your enquiries - our legitimate interest in supporting our users
• Complying with legal obligations and responding to lawful requests - compliance with a legal obligation

Where we rely on consent, you may withdraw it at any time. Withdrawing consent for device location does not affect the lawfulness of processing carried out before withdrawal, and you may continue using the Service without granting location access.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and have concluded they are not. You may object to processing on this basis, as described in Section 8.

4. How We Share Your Information

4.1. Other users. Your display name, badge tier, and the verifications, reviews, comments, and photographs you submit are visible to other users as an inherent part of how the Service operates. Your email address is never shown to other users.

4.2. Service providers. We share information with providers who process it on our behalf under contract, and who are not permitted to use it for their own purposes:

• Supabase - database, authentication, and file storage
• Google - maps, place search, and sign-in
• Apple - sign-in, where used
• Resend - delivery of transactional email
• Cloudflare - domain name services and email routing

4.3. Legal requirements. We may disclose information where required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Sunshower Labs, our users, or others.

4.4. No sale of personal information. We do not sell your personal information, and we do not use it for advertising or profiling.

5. International Transfers

We are based in Australia. Your information is stored and processed on servers located in South Korea (database, authentication, and file storage) and Japan (email delivery).

For users in the European Economic Area or the United Kingdom: both South Korea and Japan are covered by adequacy decisions of the European Commission, and Australia, South Korea, and Japan are covered by equivalent United Kingdom adequacy regulations. This means these countries are recognised as providing an adequate level of data protection, and no additional transfer safeguards are required for transfers to them.

Where our providers transfer data to other countries, they do so under their own approved transfer mechanisms, including Standard Contractual Clauses.

6. How Long We Keep Your Information

• Account information is retained for as long as your account remains active.
• Content you contribute - verifications, reviews, comments, photographs, and suggested edits - is retained for as long as it remains published on the Service.
• Technical information such as IP addresses and application logs is retained for up to 12 months.
• Moderation records, including reports and the outcomes of moderation decisions, are retained for as long as necessary to maintain the integrity of the Service.

When you delete your account, we remove information that identifies you. Content you have contributed generally remains on the Service in anonymised form, because it forms part of the shared record other users rely on and removing it would degrade the accuracy of restaurant information for the community. Once anonymised, this content can no longer be linked back to you.

7. Security

We take reasonable technical and organisational measures to protect your information, including row-level access controls that restrict data to your own account and to authorised moderators, encrypted storage of credentials, and encrypted connections. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Subject to your location and applicable law, you have the following rights:

• Access - obtain confirmation of whether we process your information, and a copy of it
• Rectification - have inaccurate information corrected
• Erasure - request deletion of your personal information
• Restriction - request that we limit how we process your information
• Portability - receive the information you provided to us in a structured, commonly used, machine-readable format
• Objection - object to processing based on our legitimate interests
• Withdrawal of consent - withdraw consent at any time where processing is based on it

You can update your display name and profile details, and delete your account, directly within the Service. For any other request, contact us at privacy@seekhalal.app. We will respond within one month, and will tell you if we need longer.

Complaints. If you believe we have not handled your information properly, we would like the opportunity to address it first. You also have the right to lodge a complaint with a supervisory authority: in the EEA, your national data protection authority; in the United Kingdom, the Information Commissioner's Office; in Australia, the Office of the Australian Information Commissioner.

9. Children

The Service is not intended for children under the age of 13, and we do not knowingly collect personal information from them. In some countries, a higher minimum age applies to the use of online services without parental consent. If you are below the applicable age in your country, please do not use the Service. If you believe a child has provided us with personal information contrary to this section, contact us at privacy@seekhalal.app and we will take appropriate action.

10. Automated Decision-Making

We do not make decisions producing legal or similarly significant effects about you by automated means. Trust scores and badge tiers are calculated automatically from your contribution history, but affect only your standing within the Service and any moderation privileges it confers.

11. Cookies and Tracking

The Service does not use cookies, analytics, or advertising tracking technologies. If this changes, we will update this Policy and, where required, obtain your consent before doing so.

12. Changes to This Policy

We may update this Policy from time to time. The date of the current version is shown within the Service. Where changes are material, we will take reasonable steps to bring them to your attention. Continued use of the Service after a change takes effect constitutes acceptance of the revised Policy.

13. Contact

For any question or request relating to this Policy or your personal information, contact us at privacy@seekhalal.app.