Privacy Policy

1. Introduction

Kismetic is operated by Kismetic Draws (ABN 59 725 607 669), a sole trader business based in Queensland, Australia ("Kismetic", "we", "us"). This Privacy Policy explains how we collect, use, disclose and protect personal information when you use the Kismetic prize draw platform at kismetic.app.

This policy complies with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using Kismetic, you consent to the data practices described in this policy.

2. Information We Collect

Account Information:

• Name and email address
• Organisation name (if applicable)
• Password (stored only as a one-way hash, never in plain text)
• Account creation date and last login

Draw Participant Data:

• Standard draws: participant names, email addresses, states, entry counts and any other data you upload in a CSV file
• Kismet draws: when you connect your Stripe account through Stripe Connect, we receive records of your customers' purchases and refunds, including the customer's name, email address, billing state, product, amount, currency and date. We use these to work out each customer's entries and to show you Entrant Insights analytics
• A snapshot of the entrant list for each Kismet draw, taken when the draw runs
• This data is provided by you, or by Stripe on your instruction, and processed on your behalf to run draws

Important: Participant information reaches us from draw organisers, either as a CSV upload or from the organiser's own Stripe account. Organisers are responsible for making sure their participants have been told about, and where required have consented to, their information being shared with Kismetic for the draw. Kismetic processes this information on the organiser's behalf.

Participants Who Verify an Entry: If you use our results page to check your entry, we collect your email address to send you a one-time code. We store the code only in hashed form, and it expires after 10 minutes.

Technical Information:

• IP address and browser type (for security and authentication)
• Device information and operating system
• Usage data including pages visited and actions taken

3. How We Use Your Information

We use your personal information for the following purposes:

• Service Delivery: To create and manage your account, execute draws, and deliver our core raffle platform services
• Transactional Communications: To send essential service emails including draw confirmations, execution notifications, and account security alerts
• Draw Execution: To process participant data through our blockchain infrastructure and generate cryptographic proofs
• Customer Support: To respond to inquiries and provide technical assistance
• Security & Fraud Prevention: To protect against unauthorised access, abuse, and fraudulent activity
• Service Improvement: To analyse usage patterns and improve our platform (aggregated, non-identifying data only)

4. Data Storage & Security

Storage Location: Our database, which holds account and participant data, is hosted by Supabase in Australia. Some of our service providers process data outside Australia (see section 5).

No Personal Information on the Blockchain: Each draw is recorded on the Polygon blockchain, a public ledger that cannot be edited or deleted. We do not write names, email addresses, states or any other personal information to it. What we record is the draw ID, the number of winners, a Merkle root (a single hash of the whole entry list), the random number supplied by Chainlink VRF, and a hash of the final result. Personal information cannot be read back out of these hashes.

Winner Visibility: Winner details are shown to the draw organiser in their dashboard. Our public results pages do not show winners' names. Backup winners are only shown to the organiser, and only if the organiser chooses to reveal one. Organisers who announce winners publicly do so under their own promotion terms.

Wallet Addresses and Transaction Metadata: Kismetic does not require users or raffle participants to provide cryptocurrency wallet addresses. All blockchain interactions, including VRF requests and draw proofs, are executed using Kismetic-operated service wallets. As part of blockchain execution, transaction metadata such as transaction IDs and smart contract interaction details are written to the Polygon blockchain. This information is publicly visible but does not contain any personal information about users or participants.

Security Measures:

• Industry-standard encryption for data in transit (TLS/SSL) and at rest
• Password hashing (bcrypt) through Supabase Auth
• Security reviews of our code and database permissions, including automated testing
• Access controls and role-based permissions
• Monitoring and logging for suspicious activity

Data Breach Notification: In the event of an eligible data breach under the Privacy Act 1988 (Cth), we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) Scheme.

No method of sending or storing data over the internet is completely secure. We cannot guarantee security, but we take reasonable steps to protect your data.

5. Third-Party Services

We use the following service providers to run the platform:

• Supabase: Database and authentication (data stored in Australia)
• Vercel: Website hosting and the servers that run our application
• Stripe: Payments for credits and subscriptions, and, for Kismet draws, the organiser's purchase records shared with us through Stripe Connect
• Resend: Delivery of verification codes and other transactional emails
• Zoho Mail: Our support mailbox and contact form messages
• Cloudflare Turnstile: Spam protection on the contact form
• Chainlink VRF and the Polygon blockchain: Random number generation and the public draw record (no personal information is sent to either)

Overseas Disclosure: Our database is in Australia, but some of the providers above process data outside Australia, including in the United States. For example, Vercel's servers handle requests that contain personal information, Resend delivers emails, and Stripe processes payment data. We only share what each provider needs to do its job, and we take reasonable steps under Australian Privacy Principle 8 to make sure overseas recipients handle personal information consistently with the Australian Privacy Principles.

These third parties have contractual obligations to protect your data and use it only for providing services to Kismetic. We do not sell your personal information to third parties.

6. Marketing Communications

We do not send marketing emails. If that changes, we will only send them to people who have opted in, and every marketing email will include a way to unsubscribe.

We do send emails needed to provide the service, such as verification codes, password resets and payment receipts. You cannot opt out of these while you use Kismetic.

7. Your Rights

Under the Australian Privacy Act 1988 (Cth), you have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your account and associated personal data (subject to legal retention requirements)
• Portability: Request export of your data in a machine-readable format
• Restriction: Request restriction of processing in certain circumstances
• Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your data

To exercise these rights, contact us at support@kismetic.app. We will respond to requests within 30 days.

8. Data Retention

Account Data: Retained for as long as your account remains active. If you delete your account, personal information will be removed within 30 days (except where retention is required by law or technical limitations).

Draw Records: By default we keep records of executed draws, including the participant data needed to verify them, so that organisers and participants can check past results. An organiser or participant can ask us to delete participant data from a past draw. We will do so unless the law requires us to keep it, but that draw's entries can then no longer be verified.

Blockchain Records: Draw records on the Polygon blockchain cannot be altered or deleted. Because they contain only hashes and draw data, not personal information, deleting someone's details from our database does not leave their personal information on the blockchain. Deleting entrant data from a past draw does mean that entrant can no longer verify their entry for that draw.

9. Cookies & Tracking

We use essential cookies for authentication and session management. These cookies are necessary for the platform to function and cannot be disabled.

We do not use third-party advertising cookies or tracking pixels. We do not track your browsing activity across other websites.

10. Children's Privacy

Kismetic is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it immediately.

11. International Users

Kismetic is designed for Australian users and complies with Australian privacy laws. If you access our service from outside Australia, please be aware that:

• Your data will be transferred to and stored in Australia
• Australian privacy laws will apply to your personal information
• You may have different rights under your local privacy laws

12. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will:

• Notify you via email
• Update the "Last Updated" date at the top of this page
• Provide prominent notice on our website

Your continued use of Kismetic after changes are posted constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your personal information, please contact us:

If you have concerns about how we have handled your personal information and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.