Privacy Policy

• Full name and contact details
• Organisation name and type
• Email address and phone number
• Payment information (processed securely by our online payment provider; we do not store card details)
• Fundraiser content including campaign descriptions, images, and prize details

• Full name
• Email address
• Phone number
• Square selections and purchase history

• Browser type and device information
• IP address (used for general location and analytics purposes; Google states it does not log or store individual IP addresses for Google Analytics 4)
• Pages visited and time spent on the Platform
• Referral source
• General geographic location (country and city level, derived from IP address)

The Platform includes an AI-powered chat assistant called Mariposa. When you use the chat, we log the content of your conversation (both your messages and Mariposa’s responses) along with a randomly generated session identifier and, where applicable, the fundraiser page you were visiting at the time.

Chat logs are retained for 90 days and are then automatically deleted. They are used to improve the quality and accuracy of Mariposa’s responses and to identify common questions.

Mariposa is powered by Anthropic PBC (“Anthropic”), a third-party AI provider based in the United States. To generate responses, your messages and Mariposa’s own replies are sent to Anthropic, together with relevant context assembled by the Platform: the campaign or blog article you are currently viewing, your first name if you previously provided it when purchasing a square, and, if you are a logged-in Organiser, a summary of your own campaigns. This means Participant and Organiser information may be included in what is sent to Anthropic. Anthropic processes this information in the United States, does not use it to train its models, and retains it only as needed for safety and abuse-monitoring purposes in accordance with its own data-handling policies. Conversation logs are not shared with any other third party, and are not linked to any personal account unless you are also logged in as an Organiser during the same session.

We share information with trusted third-party service providers who assist us in operating the Platform, including:

• Stripe: secure online payment processing. Card details are handled exclusively by Stripe and are never stored on Lucky Squares systems. Stripe operates under PCI-DSS compliance.
• Supabase: secure database and file storage (Australian data residency)
• Resend: transactional email communications (confirmation emails, draw notifications)
• Google Analytics 4: website usage analytics. Google Analytics collects usage and device information using cookies and similar identifiers (pages visited, session duration, general location, device type). Lucky Squares uses this information in aggregated reporting to understand Platform usage. See Section 8 for more detail.
• Vercel: hosting infrastructure for the Platform, and website performance analytics (Vercel Analytics)
• Anthropic: powers the Mariposa AI chat assistant. See the Mariposa Chat entry in Section 2 for full detail on what is shared and why.
• Meta (Facebook): advertising measurement. When you purchase a square or an Organiser launches a campaign, we share a cryptographically hashed version of your email address, together with your IP address, browser type, and details of the purchase or campaign, with Meta. This is used to measure the effectiveness of our advertising and is not used to build a Meta advertising profile of you beyond that measurement. See Section 8 for how to opt out.

These providers are contractually required to handle your information securely and only for the purposes for which it is shared. Some of these providers process information outside Australia: see Section 4.5.

• Sell your personal information to third parties
• Share your information with advertisers beyond the limited, hashed data described in Section 4.2 used for ad measurement purposes
• Use your information for purposes unrelated to the operation of the Platform

Some of the service providers listed in Section 4.2 store or process personal information outside Australia. Where this occurs, the relevant countries are:

• Supabase: Australia only
• Stripe: United States, and other countries in which Stripe or its payment processing partners operate
• Google (Analytics): United States, and other countries in which Google operates
• Resend: United States
• Vercel: United States
• Anthropic: United States
• Meta: United States, and other countries in which Meta operates

By providing personal information to us, you consent to this disclosure. These overseas recipients may not be subject to privacy obligations equivalent to the Australian Privacy Principles, and to the extent permitted by the Privacy Act 1988 (Cth), Lucky Squares Australia is not required to take steps to ensure they comply with those Principles in relation to your information.

Organiser information is retained differently depending on its type:

• Financial and transaction records (Campaign Fee payments, payout records): retained for seven years following account closure, to meet Australian tax and financial record-keeping obligations
• Legal acceptance and audit records (Terms acceptance, compliance acknowledgements, cancellation records): retained for seven years following account closure, to evidence compliance with these Terms and applicable law
• Account profile information (name, contact details, organisation details): retained while the account is active and for a reasonable period after closure to allow account recovery and to respond to queries, after which it is deleted or de-identified
• Uploaded images and campaign content: retained while the associated Fundraiser or account is active, and deleted within a reasonable period after account closure unless retention is required for one of the purposes above
• Support correspondence: retained only for as long as reasonably necessary to resolve the matter and for quality and audit purposes

Google Analytics 4 collects usage and device information using cookies and similar identifiers, including pages visited, time spent on each page, general geographic location (country and city level), device type, and referral source. Lucky Squares uses this information in aggregated reporting to understand Platform usage.

Google Analytics sets cookies prefixed with _ga. Google states that GA4 does not log or store individual IP addresses.

You can opt out of Google Analytics tracking at any time by installing the Google Analytics Opt-out Browser Add-on or by adjusting your browser’s cookie settings.

We use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram. When you visit the Platform, purchase a square, or launch a campaign, a cryptographically hashed version of your email address is sent to Meta together with your IP address, browser type, and details of the purchase or campaign. Meta uses this to match the activity to an ad we have shown, but the Pixel does not give us access to your Facebook or Instagram account or profile.

You can opt out of Meta advertising cookies by adjusting your Facebook ad preferences or by disabling advertising cookies in your browser settings.