privacy policy
Flower Puss Pty Ltd (ABN 93 684 368 401) — “Flower Puss”, “we”, “us”, “our” — handles your personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This Policy tells you what we collect, why, how long we keep it, who we give it to, and what you can ask us to do. Read it with our Cookie Policy, our Age Verification & Restricted Content Policy and our Terms of Service.
1. Scope & Application
This Policy applies to every Member, Creator, visitor and waitlist subscriber who accesses or uses the Flower Puss website, applications and related services (the “Services”). Flower Puss Pty Ltd is the only entity you contract with and the only entity responsible for the personal information described here.
By using the Services you acknowledge that you have read this Policy. Where we need your consent for something — marketing, or optional cookies — we ask for it separately and you can refuse.
2. Where We Offer the Services
We do not offer the Services to residents or citizens of the European Union, the United Kingdom or the United States of America. That restriction applies to Members and Creators alike and we enforce it ourselves at signup, on both country and citizenship. It is a consequence of our payment arrangements — it is not a statement about the law of those places.
Because we do not offer the Services in those markets, this Policy is written to the Australian Privacy Principles rather than to overseas privacy regimes. If we begin offering the Services in a new market, we will update this Policy before we do so.
3. Definitions
4. Information We Collect
We collect only what we reasonably need to run, secure and account for the Services.
4.1 Information you give us
- account identifiers — email address, username, password credential;
- date of birth and your 18+ declaration;
- profile details you choose to add;
- your messages to our support, billing, privacy and Trust & Safety teams, and any attachments you send with them; and
- reports you make about Content or about another user.
4.2 Information we collect automatically
- IP address, captured server-side;
- user agent, device and operating-system information;
- page URL, referrer and UTM parameters;
- locale and language;
- usage logs, timestamps and session identifiers; and
- security and abuse-prevention signals.
Cookies and similar technologies are covered in section 14 and in the Cookie Policy.
4.3 Information about Creators
Creators give us the identity, age, tax and payout information described in section 6 and in the Creator Agreement, including an ABN where one applies.
5. Waitlist, Marketing & Consent Records
When you join the waitlist or opt in to marketing, we record more than your email address. We set the full field list out here so you can see exactly what a consent record contains.
5.1 What the waitlist form captures
| Field | What it is and why we hold it |
|---|---|
| Email address | The address you asked us to contact. Required. |
| Name (if given) | Used only to address messages to you. Optional. |
| IP address at submission | Captured server-side when you submit the form, from the connection itself. It is not read from anything the browser can set. |
| IP address at confirmation | Captured server-side again when you click the confirmation link in the double opt-in email. Two separate addresses are stored, one for each step. |
| User agent | The browser and device string sent with the submission. |
| Form ID | Which form you used, so we can show which wording you saw. |
| Page URL | The page the form was submitted from. |
| Referrer | The page that sent you to that page, where your browser supplies it. |
| UTM parameters | Campaign tracking values in the link you arrived on. |
| Consent method | How you consented — the tick box, the form, or the confirmation click. |
| Locale | The language and region setting at submission. |
| Per-item consent rows | One row per thing you consented to, stored separately. Age, terms and marketing are never bundled into a single yes. |
| Double opt-in fields | Confirmation status, the date and time you confirmed, and the confirmation IP address. Unconfirmed records are never marketed to. |
| Policy version and wording | The exact version and the exact text of what you agreed to, stored with the record. |
| Timestamps | The date and time of submission and of confirmation. |
5.2 Double opt-in
The consent record is written when you submit the form. Your address only reaches our email sending platform after you click the confirmation link. If you never confirm, we do not market to you.
5.3 The consent record is discrete, auditable and retrievable
Each consent is stored as its own record, not as a flag on your account. Each record carries its own timestamp, its own IP address, and the exact policy version and wording you accepted. The store is append-only — a later consent, or a withdrawal, is written as a new record; nothing already written is edited or overwritten.
You can ask us for a copy of the consent records we hold about you, and we will give you the record itself — the wording, the version, the timestamps and the addresses. Email privacy@flowerpuss.global.
Marketing consent is always separate
At signup you are asked three separate questions — age, terms, and marketing — and each one can be refused on its own. Marketing consent is never pre-ticked and never bundled with anything else. You can withdraw it at any time, with no effect on your account.
6. Age Assurance & Identity Verification
These are two different checks on two different groups of people. We keep them separate and we hold very different amounts of information for each.
6.1 Member age assurance — result only
Every Member must pass an 18+ age assurance check before reaching restricted Content, taking out a subscription, or entering any payment area. The check is performed by a specialist third-party provider. Flower Puss stores the result only. That means:
- a verified-18-plus flag;
- the provider that performed the check;
- the date and time;
- the provider’s reference for the check;
- the country; and
- your Flower Puss user ID.
✔ We do not hold Member ID documents or facial images
No identity document, no scan, no selfie and no facial image is stored by Flower Puss for Member age assurance. We hold a yes-or-no result and the record of who checked it and when. This is deliberate: it is information we cannot lose, because we never keep it.
6.2 Creator identity verification
Creators are verified to a higher standard, because we pay them. Creator verification requires government-issued identification, a liveness check, proof of being 18 or older, and anti-money-laundering and sanctions screening. Those records are retained as evidence of compliance and are available for lawful review. Creators must keep their identity, age, tax and payout details accurate and current.
Do not confuse the two. Being a Member never requires you to hand us an identity document.
7. Payment & Transaction Information
At launch, the only payment method is cryptocurrency — USDT and USDC only. Every purchase is paid for individually at the time it is made, at a price set in AUD. What we hold about payments is therefore:
- Wallet address — the address funds were sent from or to;
- On-chain transaction reference — the identifier for the transfer on the public blockchain;
- Provider payload — the confirmation data our payment provider returns to us for the transaction, including its status, amounts and reference; and
- Platform-balance ledger entries — the credits, debits, refunds and credits-back that make up your balance history.
✔ We never receive card data
There is no card payment method in operation. Flower Puss does not receive, process or store card numbers, expiry dates or security codes, because no such data ever reaches us. Where a card payment method is in operation in future, we will update this Policy before it goes live.
Note that a public blockchain is public. The transfer itself, and the addresses involved, exist on that blockchain independently of us. We cannot amend, reverse or remove anything recorded there.
8. How We Use Your Information
- to create and administer your account;
- to run age assurance and Creator identity verification;
- to enforce our eligibility rules, including the country and citizenship restriction in section 2;
- to process your purchases and pay Creators;
- to detect and prevent fraud, abuse and financial crime, and to keep the Services secure;
- to moderate Content and act on safety reports;
- to answer your support, billing and privacy enquiries and to resolve disputes;
- to send you marketing, where you have consented and not withdrawn that consent;
- to improve the Services, using analytics only where you have turned analytics cookies on; and
- to meet our obligations under Australian law and to cooperate with law enforcement and regulators where the law requires it.
✔ We do not sell your personal information
We do not sell or rent personal information. We do not use age assurance or identity verification information for advertising or personalisation, ever.
9. Who We Disclose It To
We disclose personal information only where it is reasonably necessary, and only to:
- the age assurance and identity verification providers who perform the checks in section 6;
- the payment provider that processes crypto payments and returns the confirmation payload in section 7;
- cloud hosting, storage and infrastructure providers;
- email delivery, analytics, security and content-moderation providers;
- our professional advisers, including lawyers and accountants, under duties of confidence; and
- courts, regulators and law-enforcement agencies, where we are required or authorised by law, or where it is necessary to protect a person from serious harm.
Every provider is bound to protect the information and to use it only for the purpose we gave it to them for. We do not name our providers on this page; the Legal Centre carries a standing notice that providers and methods are published once each is confirmed and integrated.
10. Overseas Recipients
Some of our providers store or process information outside Australia. Before we disclose personal information to an overseas recipient we take reasonable steps to satisfy ourselves that it will be handled consistently with the Australian Privacy Principles, and we bind the recipient contractually to do so.
11. Security
We protect personal information with administrative, technical and physical safeguards. These include encryption of data in transit and at rest, access control on a need-to-know basis, logging of access to sensitive records, and separation of consent and verification records from ordinary account data.
No system is completely secure. If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
12. How Long We Keep It
We keep personal information only as long as we need it for the purposes in this Policy, or as long as an Australian law requires. The specific periods are:
| Record | How long we keep it | Why |
|---|---|---|
| Consent records | 7 years from the later of the closure of your account, or the last marketing message we sent in reliance on that consent. | So we can prove we had your permission if it is ever questioned. |
| Unsubscribe suppression record | Permanent, in minimal hashed form. | We cannot honour an unsubscribe for an address we have deleted entirely. |
| Financial records | 7 years. | Section 286 of the Corporations Act 2001 (Cth). |
| Age assurance results | For as long as your account is open, and then as long as we need to show the gate was applied. | Evidence that an 18+ check was completed before access and before purchase. |
| Creator verification records | As long as required by law and as evidence of compliance after the account ends. | Identity, age, AML and sanctions evidence. |
| Account and profile data | Deleted or de-identified after account closure, except where a row above requires otherwise. | We do not keep what we no longer need. |
| Moderation and safety records | As long as needed to run the report, any appeal, and any legal or regulatory matter arising from it. | Safety and legal defence. |
The consent store is append-only, so a consent record is not edited during its retention period. It expires and is deleted at the end of it.
13. Your Rights & Their Limits
Under the Australian Privacy Principles you can ask us to:
- give you access to the personal information we hold about you, including your consent records;
- correct information that is wrong, out of date, incomplete or misleading;
- delete personal information we no longer need — subject to the limits below;
- withdraw a consent you have given, including marketing consent; and
- be told how we handled your request, and why, if we refuse any part of it.
Email privacy@flowerpuss.global. We will confirm who you are before we act, and we aim to respond within 7 business days. There is no fee to make a request.
What deletion cannot reach
We will not promise you a deletion we cannot perform. Two categories survive a deletion request, and we would rather tell you now than discover it with you later:
- Consent records. The consent store is append-only by design — that is what makes it evidence. Withdrawing a consent writes a withdrawal record; it does not erase the earlier one. Consent records are kept for the period in section 12 and are then deleted. While they are held they are used for nothing except proving what you were shown and what you agreed to.
- Financial records. Records of your transactions and platform-balance ledger entries are retained for 7 years under section 286 of the Corporations Act 2001 (Cth). We cannot delete them earlier, and we would be breaking the law if we did.
A permanent minimal hashed suppression record also survives, because deleting it would mean we could no longer honour your unsubscribe. Separately, anything already written to a public blockchain is outside our control and cannot be deleted by anyone. Everything else that is genuinely ours to delete, we delete.
15. Under 18s
The Services are for adults aged 18 and over. There are no exceptions and no variation by jurisdiction. We do not knowingly collect personal information from anyone under 18. If we learn that a person under 18 has registered or accessed the Services, we close the account immediately, remove the information, and treat any related report as our highest priority. See the Age Verification & Restricted Content Policy.
16. Complaints & the OAIC
If you think we have mishandled your personal information, tell us first. Email privacy@flowerpuss.global with what happened and what you would like us to do. We will acknowledge your complaint, investigate it, and write to you with the outcome and our reasons. We aim to respond to privacy and compliance enquiries within 7 business days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC), the regulator for the Privacy Act 1988 (Cth). You do not need our permission to do so.
Complaints about Content or safety follow a different route — see the Acceptable Use Policy and the Content & Community Guidelines. Complaints about a payment, a refund or a credit follow the route in the Refund & Cancellation Policy.
17. Changes & Contact
We may update this Policy. Where a change is material, we will tell you before it takes effect, and the version number and “Last updated” date above will change. Where a change alters what you have consented to, we will ask you for that consent again rather than assume it.
Flower Puss Pty Ltd · ABN 93 684 368 401 · ACN 684 368 401 · C/- Whitehawk Advisors Pty Limited, Floor 11, 65 York Street, Sydney NSW 2000, Australia.