ATNM's Guestlist legal suite, version of 11 September 2026: Part 3, Privacy Collection Notice, and Part 4, Privacy Statement. Parts 1 and 2, the Terms & Conditions and the Code of Conduct, are on the Terms page.
Short-form notice shown at the point personal information is collected — e.g. on sign-up. It summarises the fuller Privacy Statement in Part 4, which governs.
When you sign up to Guestlist, we collect information such as your name, age/date of birth, contact details, profile photo(s), music and event preferences, and messages you send through the App. We use this to create your profile, help you connect with other attendees, verify you meet our age requirement, and keep the App and Events safe.
We may also ask you to provide your sexual orientation and matching preferences. Because this is sensitive information, we'll ask for your explicit, separate consent to collect and use it — declining is fine, and won't stop you using the App, though it may limit some matching features.
We may share limited information with Event and Affiliate Event organisers (for entry verification and safety purposes, including Code of Conduct enforcement described in Part 2), our IT/hosting providers, and, if legally required, law enforcement or regulators. We do not sell your personal information.
If you don't provide the information marked as required at sign-up, we may not be able to create your account or verify your eligibility to use the App.
Our full Privacy Statement (Part 4 of this document) explains all of this in more detail, including how to access or correct your information and how to make a complaint.
Zentropy Solutions Pty Ltd handles personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), whether or not the small business operator exemption would otherwise apply to a business of this size.
We may collect: name, date of birth/age, email address and/or phone number, profile photo(s), a 'who you're open to meeting' preference (see clause 4.3), messages and connection activity through the App, device and usage data, and Event ticket/attendance information.
For the App's two romantic modes, you choose which pronoun groups you're open to meeting. This is stored as a list attached to your profile, used only to filter who you're shown, and is never displayed to other users or disclosed to Affiliate Events.
There is no separate 'sexual orientation' field in the App. But because a preference for meeting particular pronoun groups can reveal something about a person's own orientation, we treat this field with the same care as sensitive information under the Privacy Act 1988. Before this is collected, you will be asked to give separate, explicit consent to us collecting and using it for matching purposes. This consent is distinct from, and cannot be bundled into, your general acceptance of these Terms. You may decline to provide this information; if you do, the App's matching feature will rely on the non-sensitive information in your profile only, and some matching functionality may be limited as a result.
Your date of birth is collected to verify you meet the App's 18+ minimum age requirement and is never shown to other users. Your age is only shown, as a number, after both you and another user have mutually accepted a connection — it is not visible while browsing or before that point. A separate age-range search filter lets you choose the range of ages you'd like to see, independent of when age itself becomes visible.
This reflects the App's broader approach to revealing information gradually rather than all at once: your alias, photo, pronouns, chosen 'modes,' anthem and one prompt answer are visible during general discovery; fuller prompts and your chosen mode are visible once you send or receive an invitation; your age and message history become visible only after mutual acceptance; and the physical meeting point is shared only once a meetup is proposed. Your last name, email address, ticket reference and location are never shown to other users at any stage.
Directly from you when you create a profile, use the App, message other users, or contact us. We may also receive Event ticketing information from the Event Promoter to verify your attendance.
We collect, hold, use and disclose your personal information to:
Where a ticket is purchased for an Event, we may also hold limited information about that ticket even if the ticket holder never creates an App account, for the purpose of verifying entry at the door. This is limited to a one-way hashed ticket reference and a one-way hashed surname, plus ticket type — derived from the event's door list, hashed on upload, with the original list then deleted. On their own, these hashed values do not identify anyone. If a ticket is never claimed by an App account, this information is deleted 30 days after the Event; if it is claimed, it becomes part of that account's own data.
Where we reasonably believe a user has breached the Code of Conduct in a way that raises a safety concern, we may disclose relevant details of that breach — such as the nature of the conduct and identifying information reasonably necessary to act on it — to the organisers of Affiliate Events, so they can make their own decision about that person's entry or participation.
We limit this disclosure to what is reasonably necessary for that safety purpose. We do not disclose your general profile, matching activity, or message content to Affiliate Events beyond what is relevant to a specific reported breach.
We don't maintain a shared, written cross-event database of banned or cautioned people. The Event Promoter may keep their own informal record of people who have been refused entry to, or cautioned at, an Event. We generally won't proactively contact you at the time a caution is recorded — if it becomes relevant, such as if you later seek to attend an Event or Affiliate Event, we may tell you at that point, or take it into account without telling you, at our discretion. Whether that record is shared with an Affiliate Event is also at the Event Promoter's discretion; it is not shared automatically or as a matter of course. If you ask us directly whether we hold or have shared information about you, we'll answer honestly — that's a legal minimum regardless of our general notification approach.
The App's application server is located in Melbourne, and its database and file storage are located in Sydney. Access controls are enforced at the database level (row-level security), meaning even a compromised front-end cannot access another person's data beyond what is intended to be visible to them. Backups are encrypted, and photos are served through links that expire shortly after they're issued.
Most of the App's infrastructure and your personal information is stored within Australia. Some overseas service providers are involved in supporting the App, as follows:
Where personal information is disclosed to an overseas recipient, we take reasonable steps to ensure that recipient does not breach the Australian Privacy Principles in relation to your information.
You can ask to access or correct the personal information we hold about you by contacting alltimenomoney@gmail.com or booking@nullkitten.com. We will respond within a reasonable period.
You can export a copy of your own data at any time, including your profile, invitations, connections and messages. Because a conversation involves another person, an export of your messages will include what the other person sent you as part of that conversation, in the same way a copy of your own inbox would. It will not include any of their other information.
You can delete your account at any time. This immediately removes your profile, photos and personal data from the App. Where you are the subject of an open Code of Conduct report, a limited snapshot of the relevant conversation may be retained with your identifying details removed, so the report can still be resolved.
If you have a concern about how we've handled your personal information, contact us at alltimenomoney@gmail.com or booking@nullkitten.com. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).
Retention periods differ by type of information. Messages are deleted 30 days after the relevant Event ends, unless a Code of Conduct report involving that conversation is still open. Meeting-point details are deleted after 7 days, and failed verification attempts after 30 days.
Code of Conduct reports, moderation records, feedback, and waitlist/beta-invite emails are retained without an automatic deletion period, since they may need to be referred to in connection with a later report or a pattern of behaviour across Events. You can request review or deletion of information no longer required for these purposes by contacting us — see 4.11 above.
Privacy queries: alltimenomoney@gmail.com or booking@nullkitten.com.