Privacy Policy

White Rabbit Tipping is operated by White Rabbit Data Services Pty Ltd (ABN to be confirmed), an Australian company. This policy governs the website located at whiterabbit.tips and all associated mobile and desktop applications (collectively, the "Platform").

If you have any questions about this policy or our privacy practices, you can contact our Privacy Officer at privacy@whiterabbitdataservices.com.

We collect information you provide directly and information generated through your use of the Platform.

Information you provide:

• Account registration details — your name, email address, username, and password.

• Profile information — display name, avatar, and any optional profile details you choose to add.

• Competition data — tips you submit, competitions you create or join, and messages you send to organisers.

• Payment information — if applicable, billing details processed securely through our payment provider. We do not store full card numbers.

• Communications — emails or messages you send to us for support or enquiries.

Information collected automatically:

• Usage data — pages visited, features used, and actions taken on the Platform.

• Device and browser information — IP address, browser type, operating system, and device identifiers.

• Cookies and similar technologies — session tokens required for login and basic platform functionality.

We do not collect sensitive information such as health data, financial account credentials, or government identifiers.

We use your information solely to operate and improve the Platform. Specifically:

• To create and manage your account and authenticate your identity.

• To enable core platform features — tipping, leaderboards, competitions, and results.

• To send transactional emails — account confirmations, competition invitations, round notifications, and results.

• To respond to your support enquiries and resolve technical issues.

• To detect and prevent fraud, abuse, and unauthorised access.

• To analyse usage patterns and improve platform performance and features.

• To comply with our legal obligations under Australian law.

We will only use your information for direct marketing purposes if you have explicitly opted in, and you may opt out at any time.

We do not sell, rent, or trade your personal information to any third party.

We may share limited information with:

• Service providers — trusted third-party vendors who assist us in operating the Platform, including Supabase (database infrastructure), Vercel (hosting), and Resend (transactional email). These providers are bound by data processing agreements and may only use your information to provide services to us.

• Other platform users — your display name, username, avatar, tips, and leaderboard rankings are visible to other users within competitions you participate in. This is core to the Platform's functionality.

• Competition organisers — if you request to join a private competition, your name and email address will be shared with the organiser to facilitate your invitation.

• Law enforcement or regulators — where required by law, court order, or to protect the rights and safety of our users or the public.

• Business transfers — in the event of a merger, acquisition, or sale of all or part of our business, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

We require all third parties to treat your personal information with the same level of protection as we do.

Your data is stored on servers located in the United States operated by Supabase, which maintains SOC 2 Type II certification and industry-standard security practices.

We implement reasonable technical and organisational measures to protect your information against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encrypted data transmission using TLS/HTTPS.

• Row-level security policies on our database.

• Hashed and salted password storage — we never store plain-text passwords.

• Access controls limiting which personnel can access production data.

No method of transmission over the internet or electronic storage is 100% secure. While we take data security seriously, we cannot guarantee absolute security. In the event of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

We use cookies and similar technologies solely to operate the Platform. These include:

• Authentication cookies — required to keep you logged in during a session.

• Preference cookies — to remember your settings and preferences.

We do not use advertising cookies, tracking pixels, or third-party analytics that identify you individually. You may disable cookies in your browser settings, but doing so will prevent you from logging in to the Platform.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Access — request a copy of the personal information we hold about you.

• Correction — request that we correct inaccurate or incomplete information.

• Deletion — request that we delete your account and associated personal information. We will action deletion requests within 30 days, except where retention is required by law.

• Opt out of marketing — unsubscribe from any marketing communications at any time using the unsubscribe link in any email or by contacting us directly.

• Complaints — lodge a complaint with us or directly with the OAIC at oaic.gov.au.

To exercise any of these rights, contact us at privacy@whiterabbitdataservices.com. We will respond to all requests within 30 days.

We retain your personal information for as long as your account is active or as needed to provide you with the Platform's services.

If you delete your account:

• Your profile, tips, and competition data will be anonymised or deleted within 30 days.

• Aggregated, non-identifiable data (such as anonymised leaderboard statistics) may be retained indefinitely for platform analytics.

• We may retain certain records for up to 7 years where required by Australian tax or financial law.

The Platform is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a person under 18 without parental consent, we will delete that information promptly.

If you believe a minor has registered on our Platform, please contact us at privacy@whiterabbitdataservices.com.

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, where the changes are material, notify you by email or via a notice on the Platform.

Your continued use of the Platform after any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or complaints about this Privacy Policy or our handling of your personal information, please contact our Privacy Officer:

White Rabbit Data Services Pty Ltd

Privacy Officer

Email: privacy@whiterabbitdataservices.com

Website: whiterabbit.tips

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner:

Website: oaic.gov.au

Phone: 1300 363 992