Privacy Policy

Last updated: CONFIRM: publication date

OneTap Payments Pty Ltd (“OneTap”, “we”, “us”) provides group checkout technology to Australian merchants. A merchant sells the goods, tickets or services; OneTap helps an organiser divide an order among participants and coordinates their payments through the merchant's payment provider. This policy explains how we handle personal information about organisers, invited participants, payers and merchant representatives when they use OneTap checkout, a payment invitation, our merchant services or our support channels. The merchant's own privacy policy also applies to its sale and its handling of customer information.

Information we receive and where it comes from

From the merchant: order or booking details, the merchant's identity, products or services, prices, taxes, order identifiers, deadlines and information needed to deliver or manage the purchase. For merchant representatives, we may receive a name, business contact details, role, account identifiers and support correspondence.

From an organiser or another invitation source: an organiser may provide their name and contact details, choose each person's share, and supply another person's name or email address or phone number so an invitation can be sent. If invitation details come from the merchant or another person, we identify that source in the invitation. An invited person may give us their own name and contact details when opening or paying for a share. If someone gives us another person's details, we use them for the group purchase and its invitations, reminders or status messages—not as evidence that the person agreed to marketing. CONFIRM: exactly which invitee contact fields and sources are used at launch and who sends each message.

From each payer and the payment provider: a payer provides the payment information requested at checkout. CONFIRM: payment form architecture, including whether provider-hosted or provider-controlled fields are used, whether OneTap servers receive raw card details or reusable payment tokens, and which billing fields are collected. The draft launch assumption is that Stripe, as the first intended payment provider, handles card details through the merchant's Stripe account or an authorised integration. OneTap expects to receive payment references, authorisation and capture status, amounts, payment method information and billing details that the verified integration makes available. We seek only billing details needed for a defined payment, tax, fraud, receipt or fulfilment purpose; a full billing address should not be required merely to create a broad customer record.

From the checkout and our systems: we may receive the page or invitation used to reach checkout, browser and device information, IP address, timestamps, error information and activity needed to run and protect the service. We also record support requests and the steps taken to address them. These records may be personal information even when they use a group, device or payment reference instead of a name.

Guest shoppers do not need a separate OneTap shopper account. Declining information required for a payment, invitation or fulfilment may mean we cannot complete that step. We will identify optional information and choices separately.

Why we use information

We use the information to create and display a group checkout; calculate and track shares; send purchase invitations, reminders and status updates; request payment authorisations and captures; confirm, cancel or help resolve an order; handle refunds and disputes; provide merchant reports and support; detect errors, duplicate requests and suspected misuse; and meet applicable record-keeping and legal obligations. We may use limited operational data to measure checkout completion, failures and support needs in aggregate. CONFIRM: actual refund, integrity-check and reporting workflows before publication. We do not use shoppers' checkout contact details to send OneTap promotions for this launch.

Some merchants may wish to send their own promotions. A purchase, an invitation or acceptance of checkout terms does not enrol anyone in merchant marketing. If a merchant offers an optional marketing choice in OneTap checkout, it must be separate from the purchase, identify that merchant and the proposed channel, be unticked until the recipient chooses it, and support the required records and unsubscribe process. CONFIRM: whether this choice is implemented and which merchant fields, if any, OneTap passes for it. The merchant is responsible for its own promotions and privacy practices; requests to stop its marketing should be directed to that merchant or the unsubscribe method in its message.

Who receives information

We share information with the merchant for the order that merchant sells: the order and group status, amounts, and the participant contact or fulfilment details reasonably needed to deliver the purchase, manage a change or dispute, and provide support. CONFIRM: the exact merchant payload, whether the merchant receives every participant's contact or billing details, and whether other participants can see those details. A merchant may separately receive payer billing information through its Stripe account, depending on its payment setup. We cannot offer an opt-out from disclosures essential to process and fulfil an order; an optional marketing choice is separate.

On the draft launch assumption that Stripe is the payment provider, Stripe processes payments for the merchant through its Stripe account or an authorised integration. CONFIRM: actual PSP, merchant account and payment routing. We also give information needed to service providers that operate hosting, messaging, booking or support functions for us or the merchant. CONFIRM: actual launch providers and the fields sent to each; do not infer them from an example integration. We may disclose information to advisers or authorities when reasonably required for a legal obligation, claim, investigation or protection of the service. CONFIRM: merchant access is confined to its own orders across dashboard, API and shared links.

Overseas access and storage

People working on OneTap may access information from Australia and India. CONFIRM: whether India-based people act within OneTap Payments Pty Ltd or through another entity, and what information they can access. Providers may store, process or access information outside Australia; Australian hosting for one part of a service does not determine every provider's location. CONFIRM: actual hosting and processing locations, likely overseas recipient countries where practicable, and provider arrangements before publication.

Keeping information and protecting it

We keep order and payment support information while needed for fulfilment, refunds, disputes and legal claims; merchant and support correspondence while needed for the relationship or a live issue; and company financial records for the periods applicable to those records. Unpaid invitations and operational logs need shorter, defined periods. We remove or de-identify personal information when it is no longer needed, subject to applicable legal requirements and live disputes. CONFIRM: approved periods, deletion triggers, backups and any legal holds; no general seven-year period applies to all shopper data.

We take steps appropriate to the information and systems involved to protect it from loss, misuse and unauthorised access or disclosure. CONFIRM: actual access, provider, encryption, logging and incident measures before describing any specific safeguard. If you think a OneTap invitation or payment has been misused, contact us promptly.

Access, correction and privacy concerns

You can ask us what personal information we hold about you, request access or correction, or ask us to delete information we no longer need. Write to hello@onetap.au or call 0423 512 185. Please describe the relevant order or contact detail so we can find the record; we may need to verify your identity before disclosing or changing it. We will explain if we cannot meet a request because another person is involved, an order or dispute remains open, or a legal obligation requires retention. Contact the merchant for information it holds independently of OneTap or Stripe.

You can also use those details to make a privacy complaint. Tell us what happened and how we can contact you; we will investigate and respond, and explain any action taken or why we cannot take it. CONFIRM: complaint owner, postal address and handling timeframe. If you are dissatisfied, you may be able to complain to the Office of the Australian Information Commissioner where it has jurisdiction; see oaic.gov.au.

Changes and contact

We will update this policy when our handling practices change and show the new date above. Material new uses, such as a future consumer card or OneTap shopper promotions, require their own assessment and updated notice before launch.

OneTap Payments Pty Ltd
CONFIRM: ACN, ABN status and business/postal address
Email: hello@onetap.au
Phone: 0423 512 185