Privacy Policy

Last updated 20 October 2026

Who we are

Marfet is run by Marfet. This policy explains what we collect, why, and the choices you have. Contact: support@marfet-co-au.com.

What we collect

• Account: email address, password (stored encrypted, we can't read it), username, name.
• Profile: photo, bio, website, private-account setting.
• What you share: posts, photos, captions, comments, likes, saves, who you follow and block, and who can see each post.
• Messages: your direct messages and who you chat with.
• Reports you make and moderation decisions about your content.
• Activity: when you use features (for example posting, liking, watching videos), used for your feed, safety and simple statistics.
• Business Pages: when you view a Page, tap its Call, WhatsApp, Directions, Email or Website buttons, look at its services, or see its posts, we record that it happened.
• If you run a Page: the business details you add (category, location, opening hours, services and prices, goals, who your customers are).
• If you verify a business Page: its ABN or ACN and the details the Australian Business Register publishes for it (name, trading names, status, state and postcode, GST registration), and the business email you confirm with a code. These are used to protect customers from fake businesses; the email isn’t shown on the Page unless you add it as a contact.
• Offers near me (optional): if you set your area, we store a rough area (rounded to about 1 km) and the distance you chose, never your exact location, and we don’t track where you go. We also record which offers you were sent, opened, booked or marked “Not useful”, and which businesses you stopped offers from.
• Shopping centres (optional): the up to 3 centres you tell us you usually go to, and whether you want offers from shops there. We only use what you choose; we don’t track where you go.
• Spot bookings: the phone number you give when you book (saved privately so you don’t have to type it again; you can change or remove it in Offers near me), and whether you confirmed it with a texted code, whether you arrived, didn’t show up, cancelled late or said you were running late, and reports you make about offers.
• If you run a Page and tap “Use my current location”, the shop’s location is saved and shown through the Directions button.
• Today’s deals: which kinds of deals you want and how often, the items you hold (the shop sees your name and what you’re holding, so it can keep it for you), and whether you collected them. If you run a Page: the deals you post. Photos you use to fill in a deal are read once by the AI to list the items and are not kept.
• Your settings: which notifications you get, who can message you, and light or dark mode. If you run a Page: its settings, such as holiday mode, automatic replies, booking rules and which contact details customers see.
• Phone alerts (optional): if you allow notifications, a push token for your phone (an ID that lets us send alerts to it), its type and name, your time zone (for quiet hours and the evening summary) and a record of alerts sent for 30 days. Signing out on a phone removes its token.
• Technical: IP address and device/browser type, kept in short-lived server logs.
• Website business form: if you fill in the "I'm interested" form on our website, we keep your business name, your name, email, phone (if given), suburb, shopping centre and message so we can contact you about Marfet. Only Marfet admins can see it. We delete it after about two years if we haven't been in touch (spam after 30 days), or sooner if you ask.

We do not use advertising trackers, sell your data, or track you across other apps and websites.

How we use it

• To run Marfet: show your posts to the right people, deliver messages and notifications.
• Safety: automatic checks of posts, comments, messages and photos for harmful content, plus review by our moderators when needed.
• Recommendations: your "For you" feed is built from the topics of posts you like, comment on, save and write.
• To send account emails such as confirming your email or resetting your password.
• Business statistics: Page owners see counts only (for example "23 people tapped WhatsApp this week"). They never see who viewed or contacted them.
• AI business assistants: help Page owners with summaries, tips and post ideas, using the Page's own details and its counts. They never read your personal messages. Messages customers send to a business Page may be answered by that business's AI receptionist, or used to suggest replies to its team. Automatic replies are labelled "Automatic reply".
• Spot offers: if you follow a business, recently visited its Page, or switched on “Offers near me” and are within its distance, you may get a notification about its free times (at most 2 a day). You can switch this off, or stop offers from a single business, at any time.
• Shopping centres: to show you free spots and offers from shops at your centres and, if you switched it on, to let those shops notify you. Businesses only see totals (for example “30% of our visitors shop at this centre”), shown only when at least 5 people are counted, never who.
• Fair bookings: if a business marks you as a no-show, or you cancel later than the business’s cancellation notice (usually an hour), it counts towards a limit. Too many in 60 days pauses spot bookings for 30 days. You’re told when a business marks a no-show, so you can reply if it’s a mistake.
• Deals: if you follow a shop, chose its shopping centre, or switched on “Offers near me” and are within its distance, you may get its deals, only for the kinds you chose and up to your daily number (or one evening summary). Holds you don’t collect count like a missed booking. Shops see counts only, plus who is holding their items.
• Personalised offers and ads: only if you switch on "Personalised ads and offers" in Edit profile (off by default). You can switch it off at any time.
• To understand overall use (for example number of new accounts per day) and fix problems.

Services that process your data for us

• Supabase: hosts our database, sign-in and photo storage.
• OpenAI: checks text and photos for harmful content and turns post text into topic data for recommendations. Under OpenAI's API terms this data is not used to train their models.
• Anthropic (Claude): may give a second opinion on borderline content, and helps our admins see overall statistics. Not used to train models.
• Expo: hosts the Marfet website, builds the app and delivers phone alerts (through Apple and Google). Alerts contain the notification text and, for messages, the start of the message.
• Our email provider: delivers account emails.
• Australian Business Register (ABN Lookup): we look up the ABN you give when verifying a business Page.
• Our SMS provider: delivers the one-time codes we text to confirm phone numbers. It only receives the number and the code.
• OpenStreetMap: the list of shopping centres comes from OpenStreetMap (© OpenStreetMap contributors). We don’t send them any of your data.

These providers only use your data to provide their service to us. Some are in other countries (such as the United States); they protect it with standard contractual safeguards.

Who can see what

Your username, name, photo, bio and follower counts are public. Each post is seen only by the audience you pick. Messages are seen only by the people in the chat, our automatic safety checks, and moderators if a message is reported or flagged. Messages you send to a business Page are seen by everyone who manages that Page. Our admin tools never show private messages. When you book a time from a spot offer, that business sees your name and the phone number you gave, for that booking only, and gets a message about your booking. The number is removed from the booking 30 days after the appointment. Businesses never see your area or who received their offer, only how many people it reached and opened it.

How long we keep it

We keep your data while your account exists. When you delete something it is removed from the app straight away. When you delete your account, your profile, posts, photos, comments, likes, follows, messages and recommendation data are permanently deleted. We keep only a record that an account was deleted (with no personal details). Copies in our hosting provider's backups are erased automatically when those backups expire.

Your choices and rights

• See and edit your profile at any time; make your account private.
• Choose which notifications you get, phone alerts and quiet hours, who can message you (everyone, people you follow, or nobody) and light or dark mode in Profile → Settings. You can also turn alerts off in your phone’s settings.
• Switch "Personalised ads and offers" on or off in Edit profile.
• Choose who sees each post, and edit or delete posts.
• Block or report anyone.
• Delete your account in the app: Profile → Edit profile → Delete account. If you can't sign in, email support@marfet-co-au.com from your account's email address and we will delete it.
• Depending on where you live (for example the EU, UK or California) you may also have the right to get a copy of your data, correct it, or object to how we use it. Email support@marfet-co-au.com and we will reply within 30 days.

Children

Marfet is not for children under 13. If we learn that a child under 13 has an account, we will delete it.

Security

Data is sent over encrypted connections, each person can only reach their own private data, and private photos are only shared through short-lived links. No system is perfectly secure, so please use a strong password.

Changes

We will post any changes here and tell you in the app if they are important.