Privacy policy

How Fiesto Pty Ltd collects, uses, shares and protects personal information in Societi, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Effective 15 October 2026. Fiesto Pty Ltd, ABN 52 683 897 261.

The short version

We collect what you give us, what you do in Societi and basic device information. We don’t sell personal information and we don’t show ads.
Societies you join or buy from see what they need to run their event or membership, such as your name, ticket and the answers you give them.
Other people can see your profile, the activities you join and the messages you send them. You control friend matching, activity sharing and university sharing in Settings.
Our database is hosted in Singapore. Some service providers are in the United States and other countries.
You can download your data or delete your account in the app at any time.

Who we are and what this covers

Societi is operated by Fiesto Pty Ltd (ABN 52 683 897 261), an Australian company (“Societi”, “we”, “us”). This policy explains how we handle personal information when you use societi.app, the Societi app and its public pages, our emails and notifications, and when you contact us. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

It doesn’t cover how a society, club, student union or university handles your information outside Societi, for example in its own spreadsheets, mailing lists or websites. Their own privacy policies apply to that. It also doesn’t cover other websites we link to.

What we collect

What we collect depends on how you use Societi.

When you browse our pages: device and log information such as your IP address, browser, device type, the pages you view and the site that referred you, and choices saved in your browser (see Cookies and browser storage).
When you pre-sign up or send an enquiry: your name and email, and for societies and unions, the organisation’s name and university.
When you create an account: your name, email address and password, or your Google account details if you sign in with Google. Your password is stored by our sign-in provider as a one-way hash. You can add a university, course, year of study, birthday, interests, bio, profile picture or avatar, cover image and phone number. We use your birthday to confirm you are at least 13 and to apply age limits such as 18+ events.
When you buy a ticket, membership or merchandise: order details, attendee names and emails, a student number where the organiser asks for one, your answers to an organiser’s questions, any delivery details, check-in records, and payments a society takes from you in person. You enter card details directly into Stripe’s secure fields; we don’t receive or store full card numbers. If you check out as a guest, we collect what you enter at checkout.
When you use social features: the people you add as friends, your messages in direct messages, group chats, activity chats and event chats, photos and links you add to event albums, activities you create or join, events you save or go to, feedback you give after an event, and any reports or blocks you make.
When you subscribe to your calendar in another app: we create a private link to your calendar feed. Anyone with that link can see the events in it, so keep it private.
When you connect your contacts: only the contacts you pick. We keep a one-way fingerprint of each phone number and email address, never the number or address itself, so we can show you which of your contacts are on Societi. You can remove them at any time.
When you use your location: when you choose to locate yourself on the map, your device’s location is used on your device to centre the map and we don’t store it. If you create an activity at your current location, that location becomes the activity’s meeting place and is shown to people who can see the activity.
When you run a society or union workspace: your role and contact details, and the records you manage there, such as member lists you add or import, events and sales, budgets, expenses and receipts, bank account details for payouts, governance documents, annual returns, funding applications, volunteer rosters, meeting attendance, election records and recognition records.
When you contact us: your messages and emails, the details you share and our replies.
When you use AI and voice features: the text, audio or content you submit and the result (see AI and voice features).

How we use it

To create and secure your account and keep you signed in.
To show you events, societies, activities and people relevant to your campus.
To sell, deliver, check in, transfer, resell and refund tickets and memberships, and to pay societies.
To run friends, chats, activities, calendars and notifications.
To help societies, clubs and unions run their workspaces.
To send service messages, such as ticket confirmations, reminders, receipts, and account and security notices.
To send updates you’ve asked for. You can unsubscribe at any time.
To prevent fraud, abuse and unsafe behaviour, enforce our Terms and respond to reports.
To understand how Societi is used, fix problems and improve it.
To meet our legal, tax and accounting obligations.

We don’t sell personal information, we don’t share it with advertisers and we don’t use it to build advertising profiles.

What other people can see

Your profile: other Societi users can see your name, picture or avatar, university, course and bio. Your friends list is visible only to you.
Your plans: friends can see events you’re going to and activities you join, unless you turn off “Show my activity to friends”. Events that show a guest list show it to other attendees.
Activities: activities you create, including their meeting place, are visible to people on your campus. People who join an activity can see who else has joined and use its chat.
Messages: direct messages and group chats are visible to the people in them. Event chats are visible to the event’s attendees and organisers.
Societies: a society you join or buy from can see your name, contact details, membership or ticket, check-in status and your answers to its questions.
Your university or student union: if you turn on “Share with university” in Settings, your university admin can see your society participation for engagement reporting. Student unions that oversee societies can see the records societies submit to them, such as executive lists and annual returns.

We share personal information only as described in this policy.

Societies and organisers you buy from, join or register with receive the details they need to run their event or membership (see Information societies collect).
Student unions and universities, as described in What other people can see.
Other users, as described above, and when you share an event, invite friends or send a message.
Service providers who help us run Societi, under contracts that limit how they use the information (listed below).
Advisers, insurers and authorities, where needed for legal, tax or insurance purposes, to respond to a lawful request, or to protect someone’s safety.
A buyer or successor if our business is sold or restructured. This policy would continue to apply to your information.

Our service providers are:

Supabase: database, sign-in, file storage and server functions (Singapore).
Stripe: card payments, fraud prevention and, for some societies, payouts (Australia and the United States).
Our payout provider: bank transfers to the accounts societies nominate (Australia).
Resend: sending and receiving email (United States).
Lovable: website hosting, visit statistics and the gateway our AI features use.
Google and OpenAI: the AI models behind our AI and voice features (United States).
Mapbox and Google Maps: maps and place search (United States).
Google: Sign in with Google, Google Meet links you create, and the fonts on our website.
Apple and Google: Wallet passes you choose to add, and push notifications sent through your browser’s or device’s push service.

Information societies collect

Societies, clubs and student unions use Societi to run their memberships and events. When a society asks you for information, for example through a membership form, an event question or a request for your student number, the society decides what to collect and how to use it, and is responsible for handling it lawfully.

We store and process that information on the society’s behalf to provide Societi. We don’t use it for anything else except as this policy allows, and we don’t sell it or give it to other societies.

Society executives can access their society’s records only while they hold their role, and access moves to the new committee at handover. For questions about how a society uses your information, contact the society first. If you can’t reach them, contact us and we’ll help.

AI and voice features

Some features use AI, for example drafting an event description, suggesting activities, importing or filtering a member list, answering questions in the assistant and summarising event feedback. Voice features convert your speech to text and reply with speech.

When you use these features, the content needed for the request is sent through our AI gateway to the model provider, currently Google or OpenAI, to produce a result. Only use them with information you’re comfortable sharing, and don’t include sensitive information such as health details. AI output can be wrong, so check it before you rely on it.

Emails and notifications

We send service emails, such as tickets, receipts, reminders, and account and security notices, as part of providing Societi.
We send updates and announcements only with your consent, and each one includes an unsubscribe link, as the Spam Act 2003 (Cth) requires.
Societies can email their members and attendees through Societi. Each email includes a link to unsubscribe from that society’s messages.
We send push notifications only if you allow them in your browser or on your device. You can turn them off there at any time.

Cookies and browser storage

We use your browser’s storage to keep you signed in, remember choices such as your campus and preview access, and help pages load faster. We don’t use advertising cookies or track you across other websites.

Some services set their own cookies or receive device information when they load: Stripe on checkout (to prevent fraud), and our map and font providers, which receive your IP address to deliver maps and fonts. Our hosting provider gives us visit statistics such as page views, referring sites, country and device type.

You can clear your browser’s storage at any time. If you do, you’ll be signed out.

Children and teens

You must be at least 13 to create an account.
If you’re under 18, we encourage you to talk to a parent or guardian before using Societi, and you can’t get tickets to 18+ events.
If you think a child under 13 has an account, contact us and we’ll delete it.

Where your information is stored

Our main database is hosted by Supabase in Singapore. Some service providers store or process information in other countries, including the United States and countries in the European Union. When we disclose personal information overseas, we take reasonable steps, including contractual protections, to make sure it’s handled consistently with the APPs.

How we protect it

Connections to Societi are encrypted, and our hosting providers encrypt stored data.
Database access rules mean people can see only what they’re allowed to. For example, executives see only their own society’s records, and only while they hold their role.
Card details are handled by Stripe, which is certified to the highest level of the payment card industry security standard (PCI DSS Level 1).
Administrative actions are logged, and we review access regularly.

No system is perfectly secure. Use a strong password, and contact us straight away if you think your account has been compromised. See also our Security page.

How long we keep it

Your account: while it’s open. When you delete it, we delete or anonymise your information as described below.
Financial records such as orders, tickets sold, payouts and receipts: 7 years, as Australian tax law requires. Records we keep after you delete your account are anonymised where possible.
Unfinished checkouts: deleted automatically after 90 days.
Contact fingerprints: until you remove them or delete your account.
Messages: while the conversation exists. When you delete your account, your direct and group messages are deleted and your event chat messages are replaced with “[deleted]”.
Society records: kept in the society’s workspace while it’s active, including records a union needs for governance and audit.
Support messages: for as long as we need them to resolve your request and keep proper records.

Your choices and rights

Update your profile at any time in the app.
Privacy settings: in Settings you can turn off friend matching, hide your activity from friends, and choose whether to share your society participation with your university.
Remove your contacts at any time: choose Disconnect under your saved contacts in Find friends.
Download your data: choose Download my data in Settings to get a copy of your profile, tickets, memberships, orders, registrations, friends and chats.
Delete your account: choose Delete my account in Settings. If you’re the only owner or admin of a society, hand it over to another executive first.
Unsubscribe from emails using the link in each one, and turn off push notifications in your browser or device settings.
Access or correction: email us at support@societi.app. We’ll respond within 30 days, and may need to confirm your identity first.
Browse anonymously: you can view our public pages without an account. To buy tickets or join societies, we need to know who you are.

Complaints

If you have a privacy concern, email us at support@societi.app with “Privacy” in the subject line. We’ll acknowledge it within 5 business days and aim to resolve it within 30 days. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Data breaches

If a data breach is likely to cause serious harm, we’ll notify the people affected and the OAIC as the Notifiable Data Breaches scheme requires.

Changes to this policy

We’ll update this policy as Societi changes. The date at the top shows when it last changed. If we make a significant change, we’ll tell you in the app or by email before it takes effect.

Contact us

Fiesto Pty Ltd (ABN 52 683 897 261), Queensland, Australia. Email support@societi.app.