EFFECTIVE DATE: 13/9/2026
OPERATOR: Toby Lopata
BUSINESS ADDRESS: Melbourne, Victoria, Australia
CONTACT: hello@bidlet.app
1. ABOUT THIS PRIVACY POLICY
Toby Lopata (referred to in this Privacy Policy as Bidlet, we, us or our) respects your privacy and is committed to protecting personal information.
This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you use the Bidlet website, application, marketplace, creator tools, auctions, profiles, community features, checkout, delivery-confirmation tools and related services (together, the Platform).
Bidlet is designed to provide a safe and supportive marketplace where children and young creators can showcase and sell artwork. Because children may use the Platform, we take parental involvement, child safety and responsible handling of personal information seriously.
By using the Platform, you acknowledge that you have read this Privacy Policy. Where required by law, we will obtain consent before collecting or using personal information.
2. WHO THIS PRIVACY POLICY APPLIES TO
This Privacy Policy applies to visitors, account holders, buyers, creators, parents, guardians and other people who interact with Bidlet or provide information to us.
If you use the Platform on behalf of a child, you confirm that you are the child’s parent, legal guardian or authorised adult, or that you otherwise have authority to provide the information and consent required by law.
The Platform may be accessed from different countries. Privacy rights and legal requirements may vary depending on where you live. We will handle personal information in accordance with applicable privacy and data-protection laws.
3. PERSONAL INFORMATION WE COLLECT
The information we collect depends on how you use the Platform.
ACCOUNT AND CONTACT INFORMATION
We may collect your name, username, display name, email address, phone number, password-related information, profile information and communications with Bidlet.
PARENT AND GUARDIAN INFORMATION
Where a child uses the Platform, we may collect a parent’s or guardian’s name, email address, contact information, relationship to the child, consent records, signature, verification information and communications with Bidlet.
AGE AND IDENTITY INFORMATION
We may collect date of birth, age range, identity-verification information and information needed to determine whether parental consent or other approval is required. Creator onboarding may require a creator’s date of birth and parent or guardian sign-off.
PROFILE AND COMMUNITY INFORMATION
If you create a profile or use community features, we may collect your username, display name, profile photograph, biography, artwork-related information, posts, comments, messages, reports, reviews, ratings and other information that you choose to submit.
ARTWORK AND LISTING INFORMATION
If you submit or list artwork, we may collect photographs, videos, titles, descriptions, categories, dimensions, condition, pricing, auction information, availability, creator information and other listing details.
PURCHASE, ORDER AND AUCTION INFORMATION
We may collect order details, items purchased, bid information, auction participation, watchlist activity, cart and wishlist activity, delivery details, return requests, delivery confirmations, QR-scan confirmations, refund information and communications about a transaction.
PAYMENT AND PAYOUT INFORMATION
Payment and payout information may include billing details, transaction references, payout status, bank-account details, BSB information, account-holder name, payment-provider identifiers and information needed for fraud prevention or financial verification.
Bidlet aims not to store complete payment-card details directly. Payments and payouts may be processed by third-party providers such as Stripe, PayPal or another provider displayed on the Platform. Those providers may collect and process information under their own privacy policies and terms.
DELIVERY INFORMATION
For an order or payout, we may collect delivery address, recipient name, contact details, shipping information, tracking information, carrier information, packaging details and delivery-confirmation data.
DEVICE AND USAGE INFORMATION
When you access the Platform, we may collect IP address, approximate location derived from IP address, browser type, device type, operating system, language, referring pages, pages viewed, clicks, searches, access times, error information, log information and other technical data.
COOKIES AND SIMILAR TECHNOLOGIES
We may use cookies, local storage, pixels, tags and similar technologies to keep the Platform functioning, remember preferences, maintain security, understand usage and improve the user experience. More information is available in the Bidlet Cookies Policy.
INFORMATION YOU PROVIDE TO SUPPORT
When you contact us, we may collect the information you provide, including your name, email address, account information, order or listing reference, issue description, attachments and any information needed to respond to your request.
INFORMATION FROM OTHER SOURCES
We may receive information from parents or guardians, payment providers, delivery providers, authentication services, fraud-prevention providers, moderation tools, analytics providers, other users, public sources and organisations that help us verify information or protect users.
4. HOW WE USE PERSONAL INFORMATION
We may use personal information to:
- create, maintain and secure accounts;
- verify identity, age, parental authority and creator eligibility;
- obtain, record and manage parental consent;
- display profiles, artwork and listings as requested by users;
- operate the marketplace, shop, cart, wishlist, orders and auction features;
- process purchases, bids, payments, refunds and creator payouts;
- manage delivery, packaging, tracking and delivery confirmation;
- administer returns, complaints, disputes, chargebacks and investigations;
- communicate about accounts, orders, bids, listings, payouts, safety and support;
- detect, prevent and investigate fraud, abuse, manipulation, security incidents and other misuse;
- moderate Content and help protect children and other users;
- respond to reports involving inappropriate Content, bullying, exploitation, threats or other safety concerns;
- provide customer service and resolve technical problems;
- personalise and improve the Platform and user experience;
- understand usage, performance and marketplace activity;
- send service notices, policy updates and other important communications;
- send marketing communications where permitted and where required consent has been obtained;
- comply with legal obligations, court orders, regulatory requirements and lawful requests;
- establish, exercise or defend legal claims; and
- protect the rights, safety, property and security of Bidlet, users and other people.
We will not use personal information for a purpose that is incompatible with this Privacy Policy unless permitted or required by law or we obtain appropriate consent.
5. CHILDREN’S PRIVACY AND PARENTAL CONSENT
Bidlet is designed for children, families and young creators. We aim to collect only the information reasonably needed to provide the relevant Platform feature, keep users safe, complete transactions and meet legal obligations.
Children under 13 may use Bidlet only with verified parental consent. A parent or guardian may be required to review and accept applicable terms, verify their relationship to the child, approve transactions, sign creator onboarding documents or contact Bidlet about the child’s information.
Where applicable law requires a different age threshold or consent process, Bidlet will apply the legally required standard.
We do not knowingly sell children’s personal information. We do not knowingly use children’s personal information for targeted advertising without the consent or authorisation required by applicable law.
Parents and guardians may contact us to:
- ask what personal information we hold about their child;
- request access to or a copy of the child’s personal information;
- request correction of inaccurate information;
- withdraw consent where withdrawal is legally available;
- request deletion of the child’s account or personal information; or
- ask us to stop further collection or use of the child’s information where required by law.
We may need to verify the requester’s identity and parental authority before fulfilling a request. Some information may be retained where required for legal compliance, safety, fraud prevention, financial records, dispute resolution or completed transactions.
If we learn that we collected personal information from a child without the consent required by law, we will take reasonable steps to delete it or obtain the required consent, subject to legal and safety requirements.
6. HOW WE DISCLOSE PERSONAL INFORMATION
We may disclose personal information to the following categories of recipients:
SERVICE PROVIDERS
We may use hosting providers, cloud-storage providers, software providers, customer-support tools, analytics providers, moderation services, security providers, communications providers and technical contractors that process information for Bidlet.
PAYMENT AND PAYOUT PROVIDERS
We may disclose information to payment processors, payout providers, banks, fraud-prevention providers and financial institutions to process transactions, verify accounts, manage chargebacks and pay creators.
DELIVERY AND LOGISTICS PROVIDERS
We may disclose necessary information to postal services, couriers, carriers, fulfilment providers and delivery partners to deliver artwork, provide tracking and investigate delivery issues.
PARENTS AND GUARDIANS
Where appropriate and legally permitted, we may disclose a child’s account, safety, consent, transaction or support information to the child’s parent or guardian.
BUYERS AND CREATORS
The Platform may display information that a user chooses or is required to make public, such as a username, display name, profile information, artwork, listing details, auction information or creator information. We will not intentionally display a child’s unnecessary private contact, financial, school or home-address information.
SAFETY, FRAUD AND LEGAL RECIPIENTS
We may disclose information to regulators, courts, law-enforcement agencies, child-safety organisations, professional advisers, insurers or other parties where reasonably necessary to comply with law, investigate suspected misconduct, protect a person from harm, prevent fraud or protect Bidlet’s legal rights.
BUSINESS TRANSFERS
If Bidlet is involved in a merger, acquisition, investment, restructure, financing, sale of assets or transfer of the Platform, personal information may be disclosed to advisers, counterparties and a successor operator, subject to applicable law and appropriate protections.
We do not sell or rent personal information. We may disclose aggregated, statistical or de-identified information that does not reasonably identify an individual.
7. PUBLIC INFORMATION AND USER CONTENT
Some information submitted to the Platform may be visible to other users or the public. This may include a display name, username, creator profile, biography, artwork photographs, listing details, prices, auction status, reviews, ratings and community Content.
Do not publish a child’s home address, school, personal phone number, private email address, financial information, government identifier, exact location, password or other sensitive information in a profile, listing, comment, message or other public area.
By submitting Content to the Platform, you understand that it may be stored, displayed, reproduced, formatted, moderated, promoted and made available as necessary to operate and promote Bidlet, subject to applicable law and the permissions associated with the relevant feature.
8. LEGAL BASES AND CONSENT
Depending on the law that applies, we may process personal information because:
- you have provided consent;
- processing is necessary to provide the Platform or perform a transaction;
- processing is necessary to comply with a legal obligation;
- processing is necessary to protect a person’s safety or vital interests;
- processing is necessary for fraud prevention, security or legitimate business interests; or
- processing is otherwise permitted by law.
Where we rely on consent, you may withdraw consent by contacting us or using an available account or marketing preference tool. Withdrawal does not affect processing that occurred before withdrawal and may mean that Bidlet cannot continue providing a feature.
9. MARKETING COMMUNICATIONS
We may send service communications that are necessary for your account, transactions, safety, security, returns, payouts or material policy changes. You cannot opt out of communications that are necessary to provide the Platform or meet legal obligations.
Where permitted, we may send information about Bidlet, artwork, features, events or promotions. You can unsubscribe from marketing emails by using the unsubscribe link or contacting us at hello@bidlet.app.
We will not use a child’s personal information for marketing in a way that is prohibited by applicable law.
10. COOKIES AND ANALYTICS
Bidlet may use essential cookies and similar technologies to provide login, security, cart, checkout, preferences and other core functions.
We may also use optional analytics or performance technologies to understand how the Platform is used, diagnose problems, improve features and measure performance. Where required, we will request consent before using non-essential technologies.
You may be able to control cookies through your browser settings or a cookie-preference tool. Blocking or deleting cookies may affect Platform functionality.
For further information, review the Bidlet Cookies Policy.
11. DATA SECURITY
We use reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration and disclosure. These safeguards may include encryption in transit, access controls, authentication, logging, monitoring, backups, secure hosting and role-based access.
No website, application, storage system or transmission method is completely secure. We cannot guarantee absolute security. You should use a strong password, avoid sharing login details, use trusted devices and notify us promptly about suspected account compromise or a safety concern.
12. INTERNATIONAL DATA TRANSFERS
Bidlet and its service providers may store or process personal information in Australia or other countries. Those countries may have privacy laws that differ from the laws in your location.
Where personal information is transferred internationally, we will take steps required by applicable law to protect it. Third-party providers may also apply their own safeguards and contractual obligations.
13. DATA RETENTION
We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Platform, maintain account and transaction records, meet legal and tax obligations, resolve disputes, prevent fraud, protect safety, enforce agreements and maintain secure backups.
Retention periods vary depending on the type and sensitivity of information, the purpose for which it was collected, whether an account remains active, whether a transaction or dispute is open and whether law requires a longer period.
When personal information is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it. Deleted information may remain in encrypted backups for a limited period and may be retained where needed for legal, safety, fraud-prevention or dispute purposes.
14. YOUR PRIVACY RIGHTS
Depending on where you live, you may have the right to:
- request access to personal information we hold about you;
- request correction of inaccurate, incomplete or outdated information;
- request deletion of personal information;
- request restriction of certain processing;
- object to certain uses of personal information;
- withdraw consent where processing is based on consent;
- request a portable copy of certain information;
- opt out of marketing communications;
- opt out of certain targeted advertising or profiling where applicable; and
- complain to a relevant privacy regulator.
To exercise a right, contact hello@bidlet.app. We may request information needed to verify your identity and protect personal information from unauthorised disclosure. We will respond within the period required by applicable law.
Some requests may be refused or limited where permitted by law, including where disclosure would affect another person’s privacy, compromise safety or security, prejudice an investigation, affect legal claims or conflict with a legal obligation.
15. AUSTRALIAN PRIVACY RIGHTS
If Australian privacy law applies, Bidlet will handle personal information consistently with applicable requirements, including the Australian Privacy Principles where they apply.
You may request access to or correction of personal information and may contact Bidlet with a privacy complaint. We will investigate and respond to complaints within a reasonable period.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner through its website at www.oaic.gov.au.
16. UNITED STATES CHILD PRIVACY
If the Platform is used by a child in the United States, Bidlet may apply additional safeguards required by the Children’s Online Privacy Protection Act and other applicable laws.
Those safeguards may include obtaining verifiable parental consent, providing parents with access and deletion rights, limiting collection to information reasonably necessary for the relevant activity, and obtaining additional consent before certain uses or disclosures.
17. THIRD-PARTY SERVICES
The Platform may contain links to or integrations with third-party services, including payment, banking, delivery, authentication, analytics, communication, social-media and other services.
This Privacy Policy does not govern the privacy practices of third parties. Review the relevant third party’s privacy policy before providing information or using its service. Bidlet is not responsible for the privacy or security practices of third parties that it does not control.
18. ACCOUNT DELETION
You may request account deletion by contacting hello@bidlet.app. Parents and guardians may request deletion of a child’s account subject to verification.
Before deleting an account, Bidlet may need to complete or preserve records relating to open orders, returns, refunds, chargebacks, payouts, tax, safety reports, fraud investigations, intellectual-property complaints or legal obligations.
Deleting an account may not remove Content that has already been lawfully shared by other users, included in completed transactions, preserved in backups or retained for legal, safety or fraud-prevention purposes.
19. DATA BREACHES AND SAFETY INCIDENTS
If Bidlet becomes aware of a data breach or security incident that requires notification under applicable law, we will take the steps required by law. These steps may include investigating the incident, containing the risk, notifying regulators or affected individuals, and providing safety recommendations.
If you believe that an account, child’s information or safety has been compromised, contact hello@bidlet.app immediately and include the relevant account, listing or order details without sending unnecessary sensitive information.
20. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes to the Platform, law, technology, providers or our privacy practices.
If a change is material, we will provide notice using a reasonable method, such as an updated notice on the Platform, an email, an in-app notification or a parent or guardian communication where appropriate.
The updated version will state its effective date. Your continued use of the Platform after the effective date means that the updated Privacy Policy applies to future use, subject to any consent or notice requirements imposed by law.
21. CONTACT US
For privacy questions, access requests, correction requests, deletion requests, parental-consent matters, child-safety concerns or complaints, contact:
Bidlet
Operator: Toby Lopata
Melbourne, Victoria, Australia
Email: hello@bidlet.app
Website: www.bidlet.app
When contacting us about a child, please identify your relationship to the child and provide only the information needed for us to verify and respond to your request.
END OF PRIVACY POLICY
This Privacy Policy should be reviewed by an Australian privacy lawyer before publication, particularly for the correct legal entity, Australian Privacy Act coverage, child-consent procedures, international transfers, payment providers, analytics tools, retention periods, marketing practices and any United States or other overseas users.