Privacy Policy
Last updated 3 October 2026
1. Who we are
Bounty is operated by Bounty Limited in Aotearoa New Zealand (“Bounty”, “we”, “us”). We are responsible for the personal information described here, and we handle it in line with the Privacy Act 2020 and its Information Privacy Principles.
Bounty helps you find dresses listed by rental businesses and buy and sell pre-loved dresses. When you rent, you book with the rental business on its own website; what that business does with your information is covered by its own privacy policy, not this one.
Bounty is an independent directory. It is not affiliated with, sponsored by or endorsed by the rental businesses, designers or brands listed on it (see our Terms).
2. What we collect
Information you give us
- Account details — your name, username, email address, city, whether you’re a customer or a business, and a password (stored only as a secure hash — we can’t see it). If you sign in with Google, we receive your name and email address from Google.
- Early access — if you join the waitlist before launch, we create your account with the details you give, so you can sign in when Bounty opens.
- Profile — a photo and any other details you add to your profile.
- Things you post — reviews and review photos, dress requests, comments, poll votes, and (for businesses) feed posts, stories, polls and listings.
- Messages — conversations you have with businesses, buyers and sellers on Bounty.
- Pre-Loved — your listings and photos; order details; the delivery address you give for an order; courier and tracking details; and any dispute you open, including the photos and description you provide.
- Seller payouts — if you sell on Pre-Loved, the bank account name and number you give us so we can pay you.
- Business accounts — information you give to claim a business page (for example an Instagram handle, email or note used to verify you represent the business), and your Premium subscription status.
- Listed businesses — some rental businesses appear on Bounty without having signed up. For those, we use information the business has made public on its own website or social media, such as its name, location, links, dresses and photos. To have it removed, see section 11.
- Renter flags — if you run a Premium business and flag a renter, the details, date and photo evidence you submit. See section 4.
- Emails to us — anything you send to our support address.
Information collected as you use Bounty
- Activity — dresses and items you save to wishlists, businesses you follow, searches you run, and business pages you view while signed in (so businesses can see how many people visited, never who).
- Notifications we send you and whether you’ve read them.
- Analytics — only if you turn analytics cookies on: pages visited, device and browser type, approximate location (city level) and how you arrived. See section 7.
What we don’t collect
We never see or store your card number. Payments are entered on Stripe’s secure checkout page and processed by Stripe. We don’t use your device’s precise location.
3. How we use it
- To create and run your account and sign you in, and to help you reset your password.
- To show listings, businesses, events and search results, and to let you save, follow, message, review and request.
- To run Pre-Loved: take payment, hold it until delivery, pay sellers, share a delivery address with the seller of an order, and handle cancellations, refunds and disputes (see our Terms).
- To run Bounty Premium, including billing and business analytics such as profile views, wishlist adds and the most-searched terms.
- To send you service emails and in-app notifications (for example order updates, messages and password resets).
- To keep Bounty safe — preventing spam, fraud and abuse, enforcing our Terms, and handling reports and appeals.
- To understand how Bounty is used and improve it (anonymous or aggregated where we can).
- To meet our legal obligations, such as tax and accounting records.
We don’t sell your personal information, and we don’t use it for third-party advertising.
4. What other people can see
- Everyone on Bounty can see your name, username, profile photo, city, reviews you write, comments, and anything you list for sale.
- People you message see the messages you send them.
- The seller of a Pre-Loved order sees your name and the delivery address you give for that order, so they can post it. The buyer sees the courier and tracking details.
- Businesses see totals of how many people viewed their page or saved their dresses — not who.
If you don’t have a Bounty account, a business can still flag a rental with you, identifying you only by your Instagram handle and/or your first name and last initial, never a full surname. Because there’s no account, we can’t notify you. You can email us to ask whether we hold a flag about you, see it, respond to it, or ask for it to be corrected or removed, and we’ll handle it under the Privacy Act.
5. Who we share it with
We use a small number of service providers who process information on our behalf, only to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, and photo storage — where your account and content live | South Korea (Seoul) |
| Stripe | Card payments, Premium billing, and payment records | USA and other countries |
| Resend | Sending service emails (e.g. password resets, order updates) | USA |
| “Continue with Google” sign-in; web fonts; and Google Analytics only if you accept | USA and other countries | |
| Cloudflare (cdnjs), OpenStreetMap | Serving website code libraries and map tiles (they see your IP address as any website would) | Global |
| Our website host | Serving the website | Global |
We may also disclose information if the law requires it, to prevent a serious threat to someone’s life or health, to protect Bounty or our users from fraud or harm, or to a buyer of our business (who would have to keep treating it in line with this policy).
6. Storage outside New Zealand
Our main database is hosted by Supabase in Seoul, South Korea, and some of our providers are in the United States. Under the Privacy Act (Information Privacy Principle 12) we only send personal information overseas to providers who are required to protect it in a way that, overall, gives comparable safeguards to New Zealand law — through their contracts with us and their own security and privacy commitments.
7. Cookies & local storage
Essential — always on, because Bounty can’t work without them:
- Your sign-in session, kept in your browser’s local storage so you stay signed in.
- Small preferences, such as the last tab you had open and your cookie choice.
Analytics — optional, and off until you turn it on:
- Google Analytics sets cookies (named
_gaand_ga_…) to count visits and see which pages are used. IP addresses are anonymised. We use the results in aggregate to improve Bounty.
Your choices. The first time you visit, you can Accept all, Reject non-essential, or choose Manage preferences to switch each optional category on or off. Nothing optional loads until you say yes. You can change or withdraw your choice at any time with cookie settings (also in the footer of every page). Turning analytics off stops tracking straight away and we remove the analytics cookies we can. Your choice is remembered in your browser’s local storage on this device, so it won’t carry over to other browsers or devices. You can also block or delete cookies in your browser settings.
8. How long we keep it
- We keep your account information for as long as your account is open.
- If you have no Pre-Loved order or payment history, deleting your account (from your account settings) permanently deletes your profile and the content linked to it, including your listings, reviews, messages, wishlists and uploaded photos. Business pages you manage stay up, because they belong to the business.
- If you have ever bought, sold, withdrawn money or opened a dispute on Pre-Loved, we can’t delete those order and payment records, because the other person in the order and our tax records need them. Instead we remove your name, photo, bio and location from your profile, delete your uploaded photos, and close the account so nobody can sign in to it. The order and payment records stay, and anything else you posted stays but shows as “Deleted user”. We can’t close an account while a Pre-Loved order or dispute is still in progress.
- Payment records are also kept by Stripe, and we keep any records that New Zealand tax law requires us to keep (generally for 7 years).
- A renter flag is deleted automatically, with its photos, 24 months after the incident. It is deleted sooner if the business withdraws it or accepts a correction request, or if we uphold an appeal against it.
- Analytics data is kept by Google for 14 months.
9. Age
Bounty is for people aged 18 and over. You must be at least 18 to create an account, and we don’t knowingly collect personal information from anyone under 18.
10. Security
Information is encrypted in transit (HTTPS) and at rest by our hosting provider. Access in our database is restricted row-by-row, so accounts can only read and change what they’re allowed to. Passwords are stored only as secure hashes, and card details are handled entirely by Stripe. No system is perfectly secure; if a privacy breach is likely to cause anyone serious harm, we will tell the people affected and the Privacy Commissioner as the law requires.
11. Your rights
Under the Privacy Act you can:
- Ask for a copy of the personal information we hold about you.
- Ask us to correct it if you think it’s wrong. If we don’t agree to change it, you can ask us to attach a statement of the correction you asked for.
- Delete your account yourself from your account settings, or ask us to.
- Withdraw consent to analytics cookies at any time (cookie settings).
- Ask us to remove a listed business that appears on Bounty without an account, including its page and dresses, using our business opt-out form.
Email hello@bountynz.com. We’ll respond within 20 working days, and we may need to confirm it’s really you first. If you’re not happy with how we’ve handled a privacy matter, you can complain to the Office of the Privacy Commissioner.
12. Changes & contact
If we change this policy we’ll update the date at the top, and if the change is significant we’ll tell you in the app or by email before it takes effect. Questions? Email hello@bountynz.com.