1. Who we are
Sunshower Labs (ABN 35 680 029 477) ("Sunshower Labs," "we," "us," or "our") operates the Seek Halal application and website (the "Service"). We are the data controller responsible for the personal information described in this Policy.
This Policy explains what personal information we collect, why we collect it, the legal grounds on which we rely, how long we keep it, who we share it with, and the rights available to you. It should be read alongside our Terms of Service and Community Guidelines.
If you have any questions about this Policy or wish to exercise any of your rights, contact us at privacy@seekhalal.app.
2. Information we collect
2.1. Account information. When you create an account, we collect your email address and, depending on your chosen sign-in method, your name and profile picture as provided by Google or Apple. If you register using email and password, we collect the email address and password you provide. Passwords are stored in encrypted form and are never visible to us.
2.2. Profile information. We collect the display name you choose, and we calculate a trust score and badge tier based on your contribution history.
2.3. Content you submit. We collect the content you choose to submit, including restaurant verifications, evidence category selections, ratings, comments, photographs, suggested edits, saved restaurants, and reports you make about other users' content.
2.4. Location information. With your permission, we access your device's location to show nearby restaurants and calculate distances. If location permission is not granted, we may use your IP address to estimate your approximate location instead. IP-based estimation is approximate, typically accurate only to a city or region. If you choose to enable notifications about new nearby restaurants, we also store a location and radius you select for this purpose. On the website, your current location is retained in your browser and used for no more than 12 hours, so that it need not be determined again on each visit (see Section 11). Your location is also used to determine the country in which you are located, solely for the purpose of displaying distances in kilometres or miles. The country itself is not stored; only the resulting unit of measurement is retained, as described in Section 11.
2.5. Technical information. We collect limited technical information necessary to operate and secure the Service, including your IP address, device type, and application version.
3. Why we process your information, and our legal basis
Where the General Data Protection Regulation (GDPR) or UK GDPR applies to you, we rely on the following legal bases:
- Creating and managing your account - performance of a contract
- Displaying your contributions to other users, as an inherent function of the Service - performance of a contract
- Sending transactional emails such as account confirmation and password reset - performance of a contract
- Accessing device location to show nearby restaurants - your consent
- Storing a location and radius you select, to notify you about newly added restaurants nearby, where you have enabled this feature - your consent
- Estimating approximate location from IP address where device location is unavailable - our legitimate interest in providing core location-based functionality
- Retaining your sign-in, settings, and current search on your device, as described in Section 11 - our legitimate interest in providing the Service you have requested
- Moderating content and enforcing our Terms of Service and Community Guidelines - our legitimate interest in maintaining the integrity and safety of the Service
- Notifying you when a moderator removes or restricts your content - our legitimate interest in transparent moderation
- Responding to your enquiries - our legitimate interest in supporting our users
- Complying with legal obligations and responding to lawful requests - compliance with a legal obligation
Where we rely on consent, you may withdraw it at any time. Withdrawing consent for device location does not affect the lawfulness of processing carried out before withdrawal, and you may continue using the Service without granting location access.
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and have concluded they are not. You may object to processing on this basis, as described in Section 8.
4. How we share your information
4.1. Other users. Your display name, badge tier, and the verifications, reviews, comments, and photographs you submit are visible to other users as an inherent part of how the Service operates. Your email address is never shown to other users.
4.2. Service providers. We share information with providers who process it on our behalf under contract, and who are not permitted to use it for their own purposes:
- Supabase - database, authentication, and file storage
- Google - maps, place search, and sign-in
- Apple - sign-in, where used
- Resend - delivery of transactional email
- Cloudflare - domain name services and email routing
- Vercel - hosting of the website
4.3. Public location services. To estimate your approximate location and to search for places, the Service also uses two publicly available services. These services operate under their own terms and privacy policies, and not under contract with us:
- geojs.io - where device location is unavailable, your device contacts geojs.io directly to estimate an approximate location from your IP address
- OpenStreetMap Nominatim - where you search for a place by name on the website, or your browser provides your location, our server sends the search text or coordinates to Nominatim in order to identify matching places or your country. As these requests are made by our server, your IP address is not disclosed to Nominatim.
4.4. Legal requirements. We may disclose information where required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Sunshower Labs, our users, or others.
4.5. No sale of personal information. We do not sell your personal information, and we do not use it for advertising or profiling.
5. International transfers
We are based in Australia. Your information is stored and processed on servers located in South Korea (database, authentication, and file storage) and Japan (email delivery).
For users in the European Economic Area or the United Kingdom: both South Korea and Japan are covered by adequacy decisions of the European Commission, and Australia, South Korea, and Japan are covered by equivalent United Kingdom adequacy regulations. This means these countries are recognised as providing an adequate level of data protection, and no additional transfer safeguards are required for transfers to them.
Where our providers transfer data to other countries, they do so under their own approved transfer mechanisms, including Standard Contractual Clauses.
6. How long we keep your information
- Account information is retained for as long as your account remains active.
- Content you contribute - verifications, reviews, comments, photographs, and suggested edits - is retained for as long as it remains published on the Service.
- Technical information such as IP addresses and application logs is retained for up to 12 months.
- Moderation records, including reports and the outcomes of moderation decisions, are retained for as long as necessary to maintain the integrity of the Service.
- Cookies and information stored on your device are retained for the periods described in Section 11.
When you delete your account, we remove information that identifies you. Content you have contributed generally remains on the Service in anonymised form, because it forms part of the shared record other users rely on and removing it would degrade the accuracy of restaurant information for the community. Once anonymised, this content can no longer be linked back to you.
7. Security
We take reasonable technical and organisational measures to protect your information, including row-level access controls that restrict data to your own account and to authorised moderators, encrypted storage of credentials, and encrypted connections. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your rights
Subject to your location and applicable law, you have the following rights:
- Access - obtain confirmation of whether we process your information, and a copy of it
- Rectification - have inaccurate information corrected
- Erasure - request deletion of your personal information
- Restriction - request that we limit how we process your information
- Portability - receive the information you provided to us in a structured, commonly used, machine-readable format
- Objection - object to processing based on our legitimate interests
- Withdrawal of consent - withdraw consent at any time where processing is based on it
You can update your display name and profile details, and delete your account, directly within the Service. For any other request, contact us at privacy@seekhalal.app. We will respond within one month, and will tell you if we need longer.
Complaints. If you believe we have not handled your information properly, we would like the opportunity to address it first. You also have the right to lodge a complaint with a supervisory authority: in the EEA, your national data protection authority; in the United Kingdom, the Information Commissioner's Office; in Australia, the Office of the Australian Information Commissioner.
9. Children
The Service is not intended for children under the age of 13, and we do not knowingly collect personal information from them. In some countries, a higher minimum age applies to the use of online services without parental consent. If you are below the applicable age in your country, please do not use the Service. If you believe a child has provided us with personal information contrary to this section, contact us at privacy@seekhalal.app and we will take appropriate action.
10. Automated Decision-Making
We do not make decisions producing legal or similarly significant effects about you by automated means. Trust scores and badge tiers are calculated automatically from your contribution history, but affect only your standing within the Service and any moderation privileges it confers.
11. Cookies and local storage
The Service does not use analytics, advertising, or tracking technologies, and none of the information described in this section is used to track you across other websites or applications. We store a limited amount of information on your device only where it is necessary to provide the Service or to retain choices you have made.
11.1. On the website. We use the following cookies and browser storage:
- Sign-in session - maintains your signed-in status. Set when you sign in, and removed when you sign out or when it expires.
- distance_unit - records whether distances are displayed in kilometres or miles. Where this is set automatically based on the country in which you are located (see Section 2.4), it is deleted when you close your browser. Where you select the unit yourself, it is retained for one year.
- distance_unit_explicit - records that you have selected the distance unit yourself, so that it is not subsequently changed automatically. Set only if you make a selection. Retained for one year.
- sh_location - your current search location (coordinates and a place name), so that nearby results can be displayed immediately. Deleted when you close your browser, and disregarded after 12 hours.
- sh_search - your current name search and filter selections, so that they can be restored when you return to the home page. It contains no location information. Deleted when you close your browser, and disregarded after 12 hours.
- Theme - where you select a light or dark display mode, your selection is stored in your browser's local storage. Browser local storage does not expire, so your selection is retained until you change it or clear your browser data. If you make no selection, the website follows your device's display setting.
These cookies are read only by our website. The location and search cookies are sent to our server in order to display results, but they are not stored in our database or associated with your account.
11.2. In the app. The app does not use cookies. It stores the following information on your device:
- Sign-in session - maintains your signed-in status until you sign out
- A copy of your account details - such as your display name, email address, and badge tier, so that the app can open without reloading them. Removed when you sign out.
- Your settings - such as your default map view, search distance, distance unit, and notification preferences. Retained until you change them or uninstall the app.
The app does not store your device's location.
11.3. Your choices. As the information described in this section is necessary for the Service to function, or to retain choices you have made, we do not request your consent before storing it. You may delete cookies and site data through your browser settings, and may remove information stored by the app by signing out or uninstalling the app. Certain features, such as remaining signed in, will not function without this information. If we introduce any non-essential cookies or tracking technologies in future, we will update this Policy and, where required, obtain your consent beforehand.
12. Changes to this policy
We may update this Policy from time to time. The date of the current version is shown within the Service. Where changes are material, we will take reasonable steps to bring them to your attention. Continued use of the Service after a change takes effect constitutes acceptance of the revised Policy.
13. Contact
For any question or request relating to this Policy or your personal information, contact us at privacy@seekhalal.app.