Unibuz

Legal & Policies

Last updated: 12 October 2026

1. Introduction and Scope

This Privacy Policy explains how Unibuz Pty Ltd (ACN 605 773 555, ABN 57 605 773 555) ("Unibuz", "we", "us", "our") collects, holds, uses and discloses personal information in connection with the Platform. It is intended to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Who We Are

Unibuz Pty Ltd, trading as Unibuz, is an Australian proprietary limited company. Registered office: PO BOX 822, South Yarra VIC 3141, Australia. Contact for privacy matters: privacy@unibuz.com.au.

3. Personal Information We Collect

CategoryWhat it includes
Identity & profileEmail, given/preferred name, surname, profile picture, degree, campus, faculty, gender, pronouns, country/state, university start year, account type, preferred language, interests, favourite song, date of birth
AAF SSO attributesUniversity entity ID, email, given name, family name, preferred username, picture - received via SAML/OIDC callback from your university's identity provider
Authentication dataAuth provider used, hashed password (Supabase-managed), OTP codes (transient), WebAuthn/passkey credentials (staff only)
User contentPosts, comments, direct messages, media, marketplace listings, event listings, reactions, mentions, saved items
Social graphFriends, friend requests (incl. optional message text), blocked users, community ("Tribe") membership and roles
Device & push notificationsPush tokens, device ID and name, platform, app/OS version, notification preferences
PaymentsEvent price/line items, buyer/seller/event identifiers, Stripe Connect account status, transaction status/amounts/fees, refund details. We never see or store card numbers, CVVs, or full card numbers.
Security & login signalsIP address, approximate location (city/country) via Supabase's built-in GeoIP, user agent, login history, risk indicators, anomaly flags
Content moderation signalsModeration status/reason/score and sentiment/language detection for public content
Support & contactInformation provided when contacting support, reporting content, or submitting a copyright/privacy/safety request

We do not collect: raw card numbers, CVVs or full card numbers; your real-time device location; your contacts or address book; or microphone or camera streams.

4. How We Collect Your Information

  • Directly from you (account creation, profile, posts, messages, listings, events, payments, support contact)
  • From your university, via AAF SSO
  • Automatically (IP, approximate location, device/app info, push tokens) as part of operating and securing the Platform
  • Age verification, via a third party verification provider

5. Why We Collect, Use and Disclose Your Information

  • Create and administer your Account, verify eligibility/student status
  • Provide Platform features (messaging, communities, marketplace, events, ticketing)
  • Process payments and payouts
  • Detect, investigate and prevent fraud, abuse, security incidents, breaches of these Terms
  • Moderate public content for safety and Community Guidelines compliance
  • Send service communications, security alerts and (opt-out) other notifications
  • Respond to support requests, reports and complaints
  • Comply with legal obligations

6. Content Moderation and Automated Processing

Public content (posts, comments, listings, events, profile text/images) is reviewed by Google Gemini, which assigns moderation status/reason/score and sentiment/language. This informs approval, flagging, or removal. We also generate profile-similarity embeddings via OpenAI from your profile text. User content submitted to these third-party AI providers is not used to train their general or external AI models.

Before submission, we make a good-faith, pattern-based effort to screen content for common personal information and prompt removal - not a guarantee, and it does not extract/screen text embedded in images.

6A. Automated Decision-Making - Advance Disclosure

We use a computer program (Google Gemini) to help make, or substantially assist in making, decisions about your Content and Account - including whether a post, comment, listing or event is approved, flagged for human review, or removed, and whether your Account is warned, restricted, suspended or banned. These decisions use the content you submit, your account and moderation history, and automatically generated moderation/sentiment scores.

These decisions can significantly affect your ability to use the Platform. Human review remains part of our process, particularly for safety-critical matters, and you may request a review of a moderation or enforcement decision - see Part H (AI and Moderation Notice).

7. Third Parties We Share Your Information With

ServicePurpose / data sharedLocation
Supabase (hosted on AWS)Database, auth, storage, GeoIP for login signalsSydney, Australia
Australian Access Federation (AAF)University SSO - we receive attributes, send nothing backAustralia
StripePayment processing, seller (Connect) onboarding/KYCGlobal
Google GeminiContent moderation + sentiment/language detection (public content only)Google Cloud infrastructure
OpenAIProfile-similarity embeddings from profile textUnited States
Google Translate (consumer endpoint)On-demand translation of other users' text - see Section 8United States
SentryError tracking incl. session replayUnited States
Expo / APNs / FCMPush notification deliveryGlobal
AWS SESTransactional emailSydney, Australia
ConnectIDAge verificationAustralia
Google CloudEncrypted database backups, deleted after no more than 35 daysGoogle Cloud infrastructure

We do not sell personal information, and do not share it with third parties for their own marketing.

8. Overseas Disclosure

Several third parties above are overseas (principally US-based: OpenAI, Sentry, Google Gemini/Translate). We take reasonable steps to ensure APP-consistent handling, including relying on each provider's contractual commitments where applicable.

9. Direct Marketing

Service-related communications are not optional. Other communications will have a clear opt-out, and sensitive information will never be used for direct marketing.

10. Cookies and Similar Technology

Unibuz uses cookies and similar technologies to: maintain sessions and authentication; enhance security and prevent fraud; analyse engagement and performance; and support marketing cookies if enabled. By using Unibuz, you consent to the use of cookies. You may disable cookies via browser settings, but some functionality may be impaired. Unibuz’s up to date Cookie Policy can be found here: Cookie Policy · Unibuz

11. Data Quality, Security and Retention

Reasonable steps are taken to keep personal information accurate and secure. Database/auth/storage hosted in Sydney, Australia. Significant account and security events are logged in a form that cannot be altered, and the log is kept after content or profile deletion, for security and accountability. Server, security and access logs are deleted 12 months after they are recorded.

Data typeRetention
Profile and user contentSoft-deleted immediately on request; permanently deleted via our deletion process
Push notification tokensRemoved after repeated delivery failures
OTP codesExpire shortly after issue
Payment recordsRetained for the period required by our tax, financial and corporations law recordkeeping obligations
Sentry dataPer Sentry's own retention settings
Server, security and access logs (login history, IP address, device and security signals)Deleted 12 months after they are recorded
Encrypted backupsDeleted on a rolling cycle, so personal information deleted from our live systems is removed from all backups within 35 days

12. Access, Correction and Deletion

You can access and correct most profile information in-app. You may request access, correction, deletion, or Account closure via in-app settings, Part J (Data Deletion and Account Closure Policy), Part K (Account Deletion Request), or privacy@unibuz.com.au.

13. Sensitive Information

We do not currently collect health information or other sensitive information. If this changes - including if the wellbeing feature described in Part I is activated - we will update this Policy and seek consent first, per APP 3.

14. Wellbeing Feature

No wellbeing data is currently generated or shared with any institution. We will obtain your consent before before any sharing with a university counselling service.

15. Children and Age Eligibility

Eligibility, including the minimum age, is set out in Part A, clause 3. Where you sign in through AAF, that process is also a signal of verified university enrolment.

16. Data Breach Notification

If we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the OAIC in accordance with the Notifiable Data Breaches scheme.

17. Complaints

Contact privacy@unibuz.com.au first. If unsatisfied, you may complain to the OAIC at oaic.gov.au.

18. International Users

The Platform is designed for students enrolled at Australian Approved Institutions and is designed to be used and accessed in Australia. Information is primarily handled in Australia even if accessed from overseas.

19. Changes to This Policy

We may update this Policy from time to time; material changes will be notified via the Platform, website or email where practicable.

20. Contact Us

Unibuz Pty Ltd (ACN 605 773 555, ABN 57 605 773 555) - PO BOX 822, South Yarra VIC 3141, Australia

Privacy requests: privacy@unibuz.com.au

21. Your Legal Rights

Nothing in this Policy limits any right you may have under Australian privacy laws, or any other right you may have that cannot lawfully be excluded or limited.