Privacy Policy

THAT COIN PTY LTD (ACN 653 947 454), an Australian company ("THAT", "we", "us", or "our"), is committed to protecting your privacy. This policy explains how we collect, use, disclose, and protect personal information through the THAT website, the THAT mobile application (the "App"), and our related services, and how we handle it in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Information you provide to us:

• Your email address, when you subscribe to our newsletter.
• Your name, email address, and the content of your message, when you contact us. For business or promotional enquiries, this may also include your phone number, which we use to verify listings and prevent fraudulent activity.

Information collected through the App:

• Device information (such as device type) and your wallet address, used to operate and display the App.
• Your approximate location, only with your permission, to help you find nearby businesses that accept crypto.

Information collected automatically:

• Limited technical information, such as your IP address, used briefly to keep our forms secure (for example, rate-limiting and spam prevention).

We do not use tracking cookies or third-party analytics on our website. Some information, such as a wallet address or location, may be personal information where it can be linked to you, and we handle it accordingly.

We use personal information to:

• send you newsletters, updates, and service communications you have asked for;
• provide, operate, and improve the App and its features, including showing you nearby participating businesses;
• respond to your enquiries and provide support;
• verify businesses and participants for merchant tools or promotions, and prevent fraud and misuse;
• keep our services secure and comply with our legal obligations.

Every newsletter includes an unsubscribe link, and you can opt out of marketing emails at any time.

We do not sell your personal information, and we share it only as described below.

Service providers. We use trusted providers who handle personal information on our behalf, only as needed to run our services, including:

• Resend — to manage newsletter subscriptions and to deliver and route our emails, including messages you send us through the contact form;
• Vercel — to host our website and App;
• Sanity — to manage our website content.

Third-party services in the App. The App connects to Onramper (to buy crypto with fiat currency) and 1inch (to swap tokens). These services operate under their own privacy policies and independently handle any information you provide to them; we do not control or store the data they collect.

Legal and safety. We may disclose personal information where required by law, to enforce our terms, or to protect the rights, safety, or property of THAT, our users, or others.

Some of our service providers are located, or store data, outside Australia (for example, in the United States). Where we disclose personal information to overseas recipients, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. By using our services, you acknowledge that your information may be disclosed overseas in this way.

The App is non-custodial. We do not store your private keys, seed (recovery) phrase, password, or PIN, and we do not store your transaction history. Your crypto activity happens on your own device, on public blockchain networks, and through third-party services that we do not control.

We will never ask you for your seed (recovery) phrase or private keys. Anyone who does is trying to defraud you.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law. For example, we keep your newsletter subscription until you unsubscribe, and contact enquiries for as long as we need to handle them and to keep reasonable business records.

You can ask to access, correct, or delete your personal information at any time. App users can delete their account in the App via Settings > Account > Delete Account. You can unsubscribe from our newsletter using the link in any email. To make a request, contact us at privacy@that.global.

If you have a privacy concern, or you believe we have breached the Australian Privacy Principles, please contact us at privacy@that.global and we will investigate and respond. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

If a data breach occurs that is likely to result in serious harm, we will respond in line with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), including notifying affected individuals and the OAIC where required.

Our services are not directed to people under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps.

We may update this policy from time to time. We will post the updated policy on this page with a new effective date.

THAT COIN PTY LTD (ACN 653 947 454). For privacy questions or requests, contact us at privacy@that.global.