RaffleSwap Pty Ltd trading as RaffleSwap Australia · Last updated 25 October 2026
1. Who We Are
RaffleSwap Pty Ltd (ACN 700 559 342), trading as RaffleSwap Australia ("RaffleSwap", "we", "us", "our"), operates a digital goods exchange platform connecting Australian DGR-registered charities and educational institutions (schools, TAFEs, universities, early childhood centres, and other education partners) with surplus donated goods, and enabling corporate donors to contribute goods for charitable and educational redistribution. Our registered office is Level 3/1 Lawson St, Southport, QLD 4215. This Privacy Policy explains how we collect, use, store, and protect personal and organisational information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
2. Information We Collect
For charity accounts:
- Organisation name, ABN/DGR registration number
- Physical address, suburb, state, postcode
- Contact name, email address, telephone number
- Organisation website and logo image
- Account authentication credentials (managed by Clerk — we do not store passwords)
- Points balance and transaction history
- Goods listing details including photos, descriptions, and estimated values
For education partner accounts:
- Institution name and institution type (e.g. primary school, TAFE, university)
- Physical address, suburb, state, postcode
- Contact name, email address, telephone number
- Institution website and logo image
- Account authentication credentials (managed by Clerk — we do not store passwords)
- Points balance and transaction history
- Goods listing details including photos, descriptions, and estimated values
We collect information about educational institutions and their nominated adult contact persons only. RaffleSwap accounts are held by organisations, not individuals — we do not knowingly collect personal information from students or children.
For business/corporate accounts:
- Company name, Australian Business Number (ABN)
- Industry, physical address, suburb, state, postcode
- Contact email address, telephone number, website
- Company logo image
- Donation listing details including photos and CSR statistics
- Available points balances and records of points donated to registered charities or education partners
Automatically collected:
- Server access logs (request method, URL path, HTTP status — no query strings or personal data)
- Session tokens managed by Clerk (our authentication provider)
- Browser cookies required for authentication and session continuity
- Where analytics is enabled, interaction events with fixed categories such as page location or organisation type; our custom events do not include your name, email address, enquiry text or other user-entered content
For optional paid services:
- Preregistration and preferred-plan selections where supplied; selecting a preferred plan is not payment authorisation
- Your selected subscription plan, billing interval, account credit top-ups, and related entitlement history
- Payment status, amount, currency, invoice, refund, cancellation, and subscription information received from Stripe
- Stripe customer, checkout, subscription, invoice, and payment identifiers used to reconcile billing events
- Billing contact and address information provided directly to Stripe
Stripe processes payment card details directly. RaffleSwap does not receive or store full card numbers or card verification values.
For support enquiries:
The Support page lets you prepare an email containing your name, email address, enquiry category and message. It opens your email application; you must send that email before our team receives your enquiry. Completing the form does not automatically send a support request.
3. How We Use Your Information
- To verify DGR charity status and ABN registration with the Australian Business Register (ABR)
- To review and approve education partner registrations
- To facilitate goods exchange and donation claims between registered organisations
- To display your organisation profile on public charity, education partner, and corporate partner directories
- To manage your points balance and trade history
- To generate charity and education impact reports and corporate CSR reports from recorded Platform activity, subject to plan entitlements and temporary free-launch access, including separately labelled current-listing production estimates derived from listing descriptions, weights and published benchmarks, and completed-transfer reuse estimates based on preserved completion-time evidence
- To provide optional paid plans and account credit top-ups, reconcile payments and refunds, and manage paid entitlements
- To send platform notifications related to trades, claims, and approvals
- To understand use of Platform services through non-identifying custom interaction events where analytics is enabled
- To communicate account-service changes, including the commitment to email each affected organisation at least 30 days before its free launch access ends
- To comply with our legal obligations under Australian law
4. Contact Information Disclosure
Your contact email and telephone number are not visible to other platform users unless a trade or donation claim is in "accepted" or "completed" status. At that point, contact details are shared only between the two parties directly involved in that transaction to facilitate handover logistics.
5. Data Storage and Security
- Authentication: All passwords and authentication credentials are managed by Clerk (clerk.com), a SOC 2 Type II certified authentication provider. We do not store passwords.
- Database: Organisation data is stored in a PostgreSQL database hosted within Australia on Replit's infrastructure.
- Uploaded images: Logos and listing photos are stored with their associated Platform records on Replit-hosted infrastructure.
- Transmission: All data in transit is encrypted via HTTPS/TLS 1.2 or higher.
- Security headers: HTTP Strict Transport Security (HSTS), X-Frame-Options, X-Content-Type-Options, and Content Security Policy headers are enforced on all API responses.
- Access control: Platform admin access is restricted to authorised personnel only, authenticated via Clerk multi-factor authentication.
6. Payments and Stripe
During free launch access, new subscription purchases and one-off account credit top-ups are unavailable, and the prices on Plans & Pricing are future pricing. Preregistration, a preferred-plan selection and use of complimentary features do not authorise payment. We will give each affected organisation at least 30 days’ email notice before its free launch access ends and require active confirmation before starting a paid subscription; organisations may remain on $0 Basic. Any separately existing paid subscription remains subject to its billing and cancellation terms.
When purchases become available, optional subscriptions and account credit top-ups will be payments for account services, separate from goods donations and the non-monetary points used for goods exchanges. Stripe is our payment service provider. The following describes how payment information is handled when paid services are used:
- Payment card details are entered into Stripe-hosted checkout and billing pages and are handled under Stripe's security and privacy practices
- RaffleSwap does not receive or store full card numbers, card verification values, or full track data
- We receive limited billing records from Stripe, such as payment status, amounts, dates, refunds, and identifiers needed to provision or reverse paid benefits and account credits
- Stripe may retain payment and billing records under its own legal, regulatory, fraud-prevention, and record-keeping obligations
7. Cookies
We use the following types of cookies:
- Essential cookies: Required for authentication and maintaining your logged-in session. These are managed by Clerk and cannot be disabled without breaking core functionality.
- Preference cookies: Used to remember UI settings such as consent acknowledgements.
We do not use advertising or tracking cookies.
8. Data Retention
- Account data is retained for as long as your account is active on the platform.
- When you delete your account, active access, your organisation profile, and active listings are removed. Some transaction, billing, dispute, fraud-prevention, tax, accounting, or compliance records may be retained where reasonably necessary or required by law.
- Server access logs are retained for 30 days for security and debugging purposes, then automatically purged.
- Trade and donation records may be retained in anonymised form for platform analytics.
9. Notifiable Data Breaches (NDB Scheme)
RaffleSwap complies with the Notifiable Data Breaches (NDB) Scheme under the Privacy Act 1988. In the event of a data breach that is likely to result in serious harm:
- We will assess the breach within 30 days of becoming aware of it
- We will notify the Office of the Australian Information Commissioner (OAIC) if required
- We will notify affected individuals as soon as practicable
- To report a suspected breach or security vulnerability, contact us immediately at support@raffleswap.com.au
10. Your Rights
Under the Australian Privacy Principles, you have the right to:
- Access the personal information we hold about you
- Correct inaccurate or outdated information (via your dashboard profile)
- Delete your account via the Danger Zone in your dashboard, subject to the lawful retention of records described in this policy
- Complain about a privacy breach to the OAIC at oaic.gov.au
11. Third-Party Services
- Clerk (clerk.com): Authentication and user identity management
- Stripe: Payment processing, subscription management, invoices, refunds, and secure billing portal services. Stripe receives the payment and billing information you provide during checkout or billing management.
- Australian Business Register (ABR): ABN verification
- Australian Charities and Not-for-profits Commission (ACNC): Charity registration status verification against the public ACNC register
- Replit: Platform hosting infrastructure
Each third party maintains their own privacy policy. We only share the minimum data necessary for each service to function.
12. Governing Law
This Privacy Policy is governed by applicable Commonwealth laws and the laws of Queensland, Australia. Any agreed jurisdiction is subject to rights and remedies available under the Privacy Act 1988 (Cth), the Australian Privacy Principles, and other laws that cannot lawfully be excluded.