Introduction

Lhoop is operated by Lhoop Pty Ltd (ACN 699 927 538, ABN 35 699 927 538), an Australian proprietary company trading as Lhoop. This Privacy Policy explains how we collect, hold, use, disclose, and protect your personal information.

We comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

Beyond the legal minimum. Lhoop operates only in Australia. We are not subject to overseas privacy regimes such as the EU GDPR or the UK Data Protection Act, but we have voluntarily borrowed several of their transparency principles where they exceed the APPs — including stating retention periods in months/years, listing each subprocessor with country and purpose, and committing to faster eligible-data-breach notifications than the law requires. Where this Policy commits to something stronger than the APPs, that is a Lhoop commitment, not a legal obligation we can be sued for.

What we collect, why, and what happens if you don't provide it (APP 5)

Analytics and tracking

Google Analytics

We use Google Analytics 4 to understand how visitors use the site. GA4 collects pseudonymous identifiers, page views, referral source, device and browser info, and approximate (city-level) geographic location. Data is processed by Google in the US. We do not link GA data to your name or email. See the Google Privacy Policy for how Google handles this data.

Microsoft Clarity (session replay)

We use Microsoft Clarity to record how people interact with the site, including mouse movement, clicks, scrolling, and a replay of pages as you saw them. Clarity is configured to mask form inputs (passwords, payment fields), but session replay can incidentally capture text you type into other fields. Clarity also uses cookies. You can opt out of Microsoft's collection at choice.microsoft.com. See the Microsoft Privacy Statement.

In-app analytics (Lhoop mobile app)

In the Lhoop mobile app we use Google Analytics for Firebase to analyse how the app is used (screens viewed, features used, purchases completed) and Microsoft Clarity to record session replays and interaction heatmaps of app sessions. Replays mask text input by default, and sensitive screens (sign-in, checkout and payment, messages) are additionally masked so their content is unreadable. Analytics events contain no personal details: no names, email addresses, or message content are included. The Google and Microsoft privacy policies linked above cover how those providers handle this data.

Cookies we use

Strictly-necessary cookies cannot be turned off without breaking core platform functionality. You can disable analytics cookies via your browser settings or by opting out at the analytics provider links above.

How we use your information

• Run the marketplace: account, listings, search, messaging, checkout, escrow, payouts.
• Process transactions and send transactional notifications (order confirmation, shipping, payouts).
• Verify seller identity and process payouts via Stripe and Stripe Identity.
• Detect, investigate, and respond to fraud, abuse, and breaches of our Terms (including by maintaining audit logs of admin and high-risk user actions).
• Respond to support requests and resolve disputes.
• Notify you of material changes to terms, privacy, or services that affect you.
• Generate AI-assisted listing descriptions when you opt in to that feature.
• Comply with legal obligations (tax reporting, anti-money-laundering, lawful requests from authorities).
• Send marketing emails about featured listings, tips, and promotions. These are on by default; every marketing email has a one-click unsubscribe link, unsubscribing takes effect immediately, and you can turn them off any time in Settings → Preferences.
• Feature items you list, and their photos, in our own marketing, including Lhoop's social media accounts and other platforms we publish on. This is on by default for accounts created from 2 August 2026 and you can turn it off any time via "Feature my items in Lhoop marketing" in Settings → Privacy. Turning it off stops future use but cannot recall a post already published. Photos that identify you or your child are never used in paid advertising without your separate consent (see Terms §10).

Who we share information with

We do not sell your personal information. Ever. We share information only in these specific circumstances:

• With other members: your @username, avatar, listing details, public reviews, and messages you send are visible to the people you're trading with.
• Service providers (subprocessors): see the table below.
• Legal requirements: if a valid Australian court order, subpoena, or law-enforcement request compels disclosure.
• Business transfer: in a sale, merger, or restructure, your information transfers to the new entity. We'll notify you in advance and the same Privacy Policy commitments will apply or you can delete your data.

Subprocessor table

We review this list before adding new subprocessors. If we add one that materially changes how your data is handled, we'll update this page and tell you in advance.

Cross-border disclosure (APP 8)

Some of our subprocessors process data outside Australia — primarily the United States. Before sending personal information overseas, we take reasonable steps under APP 8 to ensure the overseas recipient handles it consistently with the APPs. We do this by relying on the recipient's contractual privacy commitments (Stripe, Microsoft, Google all publish data-processing agreements covering APP-equivalent obligations). Note: this means APP 8.1 applies but we have notobtained your separate consent to overseas disclosure, so we remain accountable for the overseas recipient's handling under APP 8.1.

Data security

We use standard security controls under APP 11:

• HTTPS / TLS encryption in transit
• Encryption at rest for the database and image storage
• Hashed passwords (we never store plaintext passwords)
• Optional multi-factor authentication (MFA) on your account
• Role-based access controls and audit logging on admin tools
• Regular dependency and security review

No system is 100% secure. If we become aware of a breach affecting your personal information, we'll handle it under our breach response commitment below.

Eligible Data Breach response

Australia's Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988) requires us to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable when an eligible data breach is likely to result in serious harm. We follow that standard. The notification will explain what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.

Your rights and choices

Your legal rights under the Privacy Act

• Access (APP 12). You can ask for a copy of the personal information we hold about you. We'll respond within 30 days. Most account information is also visible directly in your Settings.
• Correction (APP 13). You can ask us to correct inaccurate or out-of-date information. Most fields are editable from Settings. For fields we collect via Stripe (e.g. ID-verified name), corrections may need to go through Stripe's flow.
• Complaint. You can complain to us first via our contact form. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Voluntary commitments (above what the APPs require)

• Deletion. You can delete your account in Settings. When you confirm, we clear your contact details (email, avatar, bio, address, phone, password) and revoke your login and service connections straight away, and the action cannot be undone. Your @username and legal name are retained: the @username stays attached to your past activity, and your legal name is kept for tax, financial-records, and dispute purposes (it is not shown on public surfaces). Some records are also retained for fraud prevention, audit logs, and tax/financial-records compliance, see Data retention below.
• Data portability. You can request a copy of the personal information you provided, in a structured, commonly-used format (JSON or CSV), via our contact form. We'll prepare it manually and aim to respond within a reasonable time.
• Opt out of marketing. Use the unsubscribe link in any marketing email or toggle "Marketing emails" off in Settings → Preferences. We will stop sending marketing within 7 days. Service messages still apply (see Terms).

How to exercise these rights. Use our contact form. We may need to verify your identity before acting on a request.

Children's privacy

Lhoop is for adults (18+). We don't knowingly collect personal information from anyone under 18. If we find out we have, we'll delete it.

How long we keep your data

When the retention period ends, we either delete the data or anonymise it so it can no longer identify you.

How we make decisions about you

Personalisation and ranking.We rank listings on your home feed using your declared preferences (categories, sizes, brands you follow), and — if you haven't set any preferences — by inferring them from your last 30 listing views in the past 90 days. You can clear this at any time by signing out, by clearing browsing history, or by setting explicit preferences in Settings → Personalisation.

Fraud and abuse detection.We use signals (device fingerprints, transaction patterns, message content patterns) to flag suspicious behaviour for human review. We do not make automated final decisions to suspend or close your account — a human reviews flagged cases.

Changes to this policy

We'll update this policy as the product and law evolve. Material changes will be notified by email and by an in-app banner before they take effect; minor changes will appear here with a new "Last updated" date. Continued use of Lhoop after a material change takes effect means you accept it.

Privacy contact

For access, correction, deletion requests, marketing opt-out issues, or any other privacy concerns:

If you're not satisfied with our response, you can complain to: