Privacy
Policy

1. About this Privacy Policy

This Privacy Policy explains how Allure ("Allure Underground", "we", "us" or "our") collects, holds, uses, discloses and protects your personal information when you apply for membership, use the Allure website at allureaus.com, use the Allure member portal, communicate with us or other members, or attend an Allure event (together, the "Allure Services").

Allure is based in Sydney, New South Wales. This Privacy Policy is written to comply with the Privacy Act 1988 (Cth) (the "Privacy Act"), the Australian Privacy Principles ("APPs") in Schedule 1 of the Privacy Act, the Spam Act 2003 (Cth), and the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

We comply with the APPs regardless of turnover. Some small businesses are currently exempt from the Privacy Act. Because Allure collects and holds a significant volume of sensitive information, we have chosen to handle all personal information in accordance with the Privacy Act and the APPs, and we treat ourselves as an "APP entity" for the purposes of this Privacy Policy.

By submitting an application for membership, by accessing the Allure Services, or by ticking the consent box on our application form, you confirm that you have read and understood this Privacy Policy.

We may amend this Privacy Policy from time to time (see section 18). The current version is always available at https://allureaus.com/privacy.html.

2. The information we collect

Almost everything we hold about you, you gave us directly — your application answers, your profile fields, and the photos you upload. We do not buy information about you from data brokers, and we do not build a picture of you from outside sources. The only things we collect without you entering them are the basic technical data every website receives (section 2.3) and the anonymous votes cast on your application during peer review (section 2.4).

2.1 Personal information

We collect the following categories of personal information, as defined in the Privacy Act, when you apply for or hold membership:

• Identity information: your legal first and last name, your chosen username, your date of birth, your gender, and photographs of your face and body submitted for verification. Where we need to verify your age or identity we may also collect a copy of a government-issued photo identification document.
• Contact information: your email address, mobile phone number, the city and state where you live, the cities you are willing to travel to for events, and (optionally) your Instagram, RedHotPie, X/Twitter or other social-media handles.
• Application content: your written answers to our application questions — including your reasons for applying, your experience with lifestyle events and communities, the types of events that interest you (which may include kink or fetish events), what you feel you bring to the community, how you heard about Allure, the name or code of any member who referred you, and anything else you choose to tell us — together with your typed signature and the date of your application.
• Membership and account data: your member ID and referral code, your membership tier, your account status, a one-way salted hash of your password (we never store your password itself), authentication tokens, your login and activity history, your IP address, and device and browser information.
• Member content: your profile fields and description, your avatar and profile photos, photos you upload to your galleries (which you may mark as public, members-only, or private), the members you grant access to a private gallery or photo, your forum posts and replies, your direct messages and any images you send in chat, your contact requests and couple-link requests, the "likes" you send and the matches they create in the discovery/dating feature, and any testimonial or review you submit.
• Event participation data: the events you RSVP to, any dietary or accessibility requirements you tell us about, and photos of you taken at events (including where another member or an Allure photographer tags you in an event gallery). Attendance, door check-in and ticket-purchase records will be collected when those features are introduced, and this section will be updated then.
• Payment information (when paid features are introduced): payment for paid events or paid membership tiers will be processed by a third-party payment processor. We do not intend to store full card numbers on Allure systems — only a transaction reference, the payment-method type, the card expiry, and the last four digits of the card.
• Communications with us: the content of your emails, support requests, member-services chats, and any report you submit under our Community Guidelines.

2.2 Sensitive information

Some of the information you provide is "sensitive information" under section 6(1) of the Privacy Act. For Allure this includes:

• your sexual orientation or sexuality;
• information about your relationship structure (for example single, partnered, married, or ethically non-monogamous / open);
• your kink, fetish or event-type preferences, where you choose to share them;
• health information that you voluntarily provide (for example in a profile field, an accessibility request, or a message to a host); and
• photographs that reveal, or allow inferences to be drawn about, any of the above.

Express consent (APP 3.3). We will only collect sensitive information about you with your express consent, unless an exception in the Privacy Act applies. By ticking the sensitive-information consent box on our application form, and by choosing to complete these fields in your member profile, you give Allure your express consent to collect, hold, use and disclose that sensitive information for the purposes set out in section 4.

Withdrawing consent. You may withdraw your consent at any time by editing or clearing the relevant fields in your profile, or by contacting our Privacy Officer (section 19). Withdrawing consent does not affect anything we did with the information before you withdrew it. Some features (for example the discovery/dating feature) cannot operate without certain sensitive information, so withdrawing consent may mean you can no longer use them.

2.3 Information we collect automatically

When you use the Allure Services we automatically collect your IP address and an approximate location derived from it, device identifiers, operating system, browser type and version, referring URL, and the pages and features you use; cookie and local-storage values used to keep you signed in and to remember your settings (see the Cookies section); and service-performance data such as page-load times and error logs. We do not currently use third-party analytics, advertising or session-replay tools. If that changes we will update this Privacy Policy and, where required, seek your consent.

2.4 Information from third parties

We may receive information about you from existing members who refer you; from members who take part in the peer review of your application (we record their votes without recording which member cast which vote); from our payment processor (confirming that a transaction succeeded or failed, when paid features are introduced); from our email-delivery provider (delivery, bounce and complaint notices); and from event venues, security contractors and event partners (for example a report of an incident at an event).

2.5 Information about other people

If you give us information about another person — for example your partner in a couple application, an emergency contact, or a person you name in a report — you must be entitled to give us that information, and you should make sure the person knows about this Privacy Policy and how to contact us.

3. How we collect personal information

We collect personal information directly from you wherever practicable, including when you submit an application; create or edit your profile; upload photographs; RSVP to an event; send a direct message, chat image, contact request, couple request, "like", forum post or testimonial; contact us; submit a report under our Community Guidelines; or take part in a survey. Ticket purchase and door check-in will be additional collection points when those features are introduced.

If you do not provide the information requested on the application form, we will not be able to assess your application.

4. Why we collect, hold, use and disclose your information

We collect, hold, use and disclose your personal information for these purposes:

• Application and verification — to assess your application, verify your age and identity, run our peer-review process, and decide whether to offer you membership.
• Operating your membership — to create and manage your account, authenticate you when you sign in, show your profile to other members according to your visibility settings, and operate the profile, gallery, forum, messaging, contact-request, couple-link, discovery/dating and event features.
• Events — to manage RSVPs, send you event details (the venue is generally disclosed only to confirmed attendees, shortly before the event), and operate the event safely. Ticket sales and door check-in will be added to this purpose when those features are introduced.
• Safety and integrity — to enforce our Terms of Membership and Use, Community Guidelines and Event Terms; to investigate reports and suspected breaches (which may include reviewing profile content, messages or images where reasonably necessary for an investigation); to prevent fraud, impersonation and abuse; and to respond to allegations of unsafe or non-consensual behaviour.
• Communications — to send you membership-relevant messages such as application updates, event invitations, security alerts, conduct notices and (when introduced) payment confirmations.
• Marketing — with your consent, to send you newsletters and information about upcoming Allure events. You can opt out at any time. We never sell your information or disclose it to third parties for their own marketing.
• Improving the Allure Services — to understand how members use the platform and to improve its features, content, safety and reliability, using de-identified or aggregated data wherever we can.
• Legal and regulatory — to comply with our legal obligations, respond to valid requests from courts, law enforcement and regulators, and establish, exercise or defend legal claims.
• Business changes — if we sell, merge or restructure our business, your information may be disclosed to the buyer or successor, subject to confidentiality and to privacy protections no less protective than this Privacy Policy.

We will not use or disclose your personal information for a purpose that is not set out above, or that you would not reasonably expect, unless you have consented or the Privacy Act permits it.

5. Who we disclose your information to

We never sell your personal information, and we never share it with anyone for their own marketing. We disclose it only in the ways set out below:

• Other Allure members — but only the profile fields you have chosen to make visible, and only to the members you have chosen. Your verification photos are never shown to other members in their ordinary form. If your application is referred to peer review, an anonymised version of your application (without your full name or contact details) and your verification photos may be shown to randomly selected verified members for the sole purpose of voting on your application. There is no fixed number of reviewers — it depends on how many verified members are available, up to ten. Reviewers are not told who you are; you are not told who reviewed you.
• Service providers who operate the platform for us — Supabase Inc. (database, authentication and file storage hosting); Netlify Inc. (website and serverless-function hosting); Resend (our email-delivery provider); and our payment processor (for paid features, once introduced). Each is bound by contract to use your personal information only to provide services to us and to protect it with reasonable security safeguards.
• Event venues, and licensed security and crowd-control contractors engaged for an event — to the extent necessary to run that event safely (typically a guest list, and any dietary, accessibility or safety information relevant to the event or to an incident).
• Emergency services and medical personnel — where reasonably necessary to respond to a medical emergency or serious safety incident.
• Courts, law enforcement and regulators — where we are compelled by valid Australian legal process, or where we reasonably believe disclosure is necessary to prevent or lessen a serious threat to the life, health or safety of any person, or to report conduct we reasonably believe to be unlawful (including image-based abuse or the sexual exploitation of a minor).
• Our professional advisers — lawyers, accountants, auditors and insurers, under duties of confidentiality.
• A buyer or successor of our business, as described in section 4.

6. Cross-border disclosure (APP 8)

Some of our service providers store or process personal information outside Australia:

• Supabase Inc. hosts your account data, profile content and uploaded photos. Allure's Supabase primary database is located in Oceania (Sydney).
• Netlify Inc. is based in the United States and serves the website from a global content-delivery network.
• Our email-delivery provider (Resend) is based in the United States.
• Our payment processor, once selected, may be located in the United States, the United Kingdom, the European Union or elsewhere — we will name it and its location here before any paid feature launches.

Where we disclose personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs, principally through contractual data-protection obligations. Where you have expressly consented to a cross-border disclosure after being informed that APP 8.1 would not then apply, we are not required to take those steps in respect of that disclosure — but we will continue to require contractual privacy protections from our providers regardless.

7. How long we keep your information (retention)

We keep your personal information only for as long as we need it for the purposes in this Privacy Policy, or for as long as the law requires. Our retention rules are:

We may retain information beyond the periods above where we are required to keep it by law, where we need it to establish or defend a legal claim, where there is an unresolved complaint, investigation or dispute, or where retention is necessary to protect the safety of members or the public.

8. Security

We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include encryption in transit (TLS); encryption at rest for stored files, including verification and gallery photos; one-way salted hashing of passwords; row-level security and role-based access controls on our database; serving private photos only through short-lived signed links after an access check; audit logging of administrative actions; rate-limiting and abuse controls on sign-in and sensitive actions; regular security reviews and prompt patching; and contractual security obligations on our service providers. We do not currently require multi-factor authentication on member or staff accounts; if that is introduced, this section will be updated.

No system is completely secure. If you believe your account has been accessed by someone else, or that your information has been compromised, contact us immediately at allure@allureaus.com.

8.1 Notifiable Data Breaches

If we become aware of unauthorised access to, unauthorised disclosure of, or loss of personal information that is likely to result in serious harm to any affected individual, we will contain and assess the breach and, where the Notifiable Data Breaches scheme requires, notify the affected individuals and the Office of the Australian Information Commissioner ("OAIC") as soon as practicable.

9. Your rights and choices

Under the Privacy Act, and APPs 12 and 13, you may access the personal information we hold about you (most of it is visible in your member profile); correct information that is inaccurate, out of date, incomplete, irrelevant or misleading; delete your account and associated personal information from your profile in the member portal, or by contacting us (subject to the retention rules in section 7); withdraw consent to our handling of your sensitive information, or to direct marketing; and complain about how we have handled your personal information (see section 10). A portable copy of your data (JSON or CSV) is not yet available as a self-serve export — ask our Privacy Officer if you need one.

We will respond to an access or correction request within a reasonable time, and in any case within 30 days. There is no fee to make a request, though we may charge a reasonable cost-recovery fee for giving access in a particular form. If we refuse access or correction we will tell you why and how to complain.

10. Complaints

If you think we have breached the Privacy Act or this Privacy Policy, please contact our Privacy Officer first (section 19). We will acknowledge your complaint within 5 business days and aim to give you a substantive response within 30 days.

If you are not satisfied with our response, you can complain to the OAIC — website oaic.gov.au/privacy/privacy-complaints, phone 1300 363 992, post GPO Box 5288, Sydney NSW 2001.

11. Cookies and similar technologies

We use cookies, local storage and similar technologies to operate the Allure Services:

• Strictly necessary — to keep you signed in, hold your security context, and protect against cross-site request forgery. The site will not work without these.
• Functional — to remember preferences such as your theme, whether you have passed the age check for this session, and whether you have dismissed a notice.

We do not currently use analytics or advertising cookies, and we do not share data with advertising networks. You can block or delete cookies in your browser settings, but if you block strictly necessary cookies you will not be able to sign in.

12. Direct marketing and the Spam Act

We do not currently send marketing emails. If we start, we will only send them where you have consented, every marketing message will include an unsubscribe link, and we will handle consent and unsubscribe requests in accordance with the Spam Act 2003 (Cth). Membership-relevant messages — application updates, security alerts, conduct notices and event logistics for an event you have RSVP'd to — are not marketing and will continue for as long as you hold an account.

13. The age of members

The Allure Services are strictly for adults 18 years and over. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us personal information, contact our Privacy Officer and we will delete it and close any associated account.

14. Anonymity and pseudonymity

You can browse the public pages of allureaus.com without identifying yourself. Membership, however, requires identity and age verification, so it is not practicable for us to deal with members anonymously or under an unverified pseudonym. Within the community you are identified to other members by your username, not by your legal name, unless you choose to share more.

15. Third-party links

The Allure Services may link to third-party websites (for example a venue's site or a social-media profile). We are not responsible for the privacy practices of those sites. Please read their privacy policies before providing them with personal information.

16. Automated decision-making

We do not currently use computer programs to make, or substantially to make, decisions about membership applications. Every application is assessed by Allure administrators and, where referred, by a panel of randomly selected verified members.

If we introduce automated decision-making that could significantly affect your rights or interests, we will update this Privacy Policy to disclose the kinds of personal information used and the kinds of decisions made, in accordance with APP 1.7, which takes effect on 11 December 2026.

17. Your privacy and the conduct of other members

Australian law now recognises a statutory cause of action for serious invasions of privacy, and criminal offences apply to the non-consensual recording, distribution or threatened distribution of intimate images (including digitally created or altered images). Our Community Guidelines prohibit this conduct absolutely. If another member misuses your personal information or images, tell us at allure@allureaus.com — we will act under our Community Guidelines, and we can help you contact the eSafety Commissioner (esafety.gov.au) or the police.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available at https://allureaus.com/privacy.html. If a change is material we will post a notice in the member portal and, where the change materially reduces your privacy protections, email active members before it takes effect. Your continued use of the Allure Services after a change takes effect means you accept the updated Privacy Policy.

19. Contact our Privacy Officer

For any privacy question, access request, correction request or complaint, contact our Privacy Officer:

Allure — Privacy Officer
Email: allure@allureaus.com

20. Definitions

Terms in this Privacy Policy that are defined in the Privacy Act (including personal information, sensitive information, APP entity, collect, disclose and consent) have the meaning given in that Act.