Privacy Policy

1. Who we are

Panty Post is operated by G Dykyj & O.S Richards, trading as Panty Post (ABN 16 501 428 474), an Australian partnership. We are the data controller for the information described in this policy.

Contact: support@pantypost.com

2. What we collect

Account information

• Username and email address
• A cryptographically hashed password — we never store or see your actual password
• Country, if you choose to provide it
• Profile biography and picture, if you provide them

Identity verification (sellers)

• Government-issued photographic identification
• A photograph of you holding a verification code we issue

This is sensitive information under the Privacy Act. It is collected only to confirm identity and age, is held under the protections described in section 5, and is used for no other purpose.

Transaction information

• Purchases, sales, wallet balances and transaction history
• Delivery addresses, where you provide one to complete an order

We do not store full card numbers. Card payments are processed by our payment provider, who handles that data directly.

Content and communications

• Listings, posts, images and gallery content you upload
• Messages exchanged with other users
• Reviews you write or receive
• Reports or complaints you submit

Technical information

• IP address, retained for security and abuse prevention
• Browser and device information
• Activity such as login times and pages viewed

3. Why we collect it

• To operate your account and the marketplace
• To confirm sellers are who they say they are, and are 18 or over
• To review content before publication, as required by our Content Policy
• To process payments and maintain accurate financial records
• To investigate complaints, reports and suspected breaches
• To detect and prevent fraud and abuse
• To meet our legal obligations and those of our payment processors

We do not sell your personal information. We do not use it for advertising profiling.

4. Who we share it with

• Other users — only what you choose to make public: your username, profile picture, biography, approved content, and any delivery address you provide to a seller to fulfil an order.
• Payment processors — the information they require to process transactions and meet their own compliance obligations, including, on legitimate request, evidence that a seller was verified.
• Service providers — hosting, email delivery and, where implemented, age assurance. They may process data only on our instructions.
• Law enforcement and regulators — where we are legally required to, or where we reasonably believe disclosure is necessary to prevent serious harm. Content involving a minor is reported proactively.

Some providers are located outside Australia. Where personal information is disclosed overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

5. How we protect it

• All traffic is encrypted in transit using TLS.
• Passwords are hashed and salted; they are never stored in a readable form.
• Identity documents are never publicly accessible. They can be viewed only by authorised administrators through short-lived links that expire automatically, cannot be shared, and are never cached.
• Sensitive fields are excluded from all public API responses by default.
• Administrative access is restricted and every action is logged.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

6. How long we keep it

• Account information — while your account is open, then deleted or anonymised on request.
• Identity documents — while the account is active and for as long as required to evidence verification to our payment processors, then securely deleted.
• Transaction records — seven years, as required by Australian tax and financial record-keeping law.
• Moderation and complaint records — retained to evidence that review and investigation took place.
• Messages — while both accounts remain open.

7. Your rights

Under the Privacy Act you may:

• Ask for a copy of the personal information we hold about you
• Ask us to correct anything inaccurate
• Ask us to delete your information, subject to records we must retain by law
• Withdraw consent for content depicting you to remain published
• Complain about how we have handled your information

Email support@pantypost.com and we will respond within 30 days.

To request removal of content depicting you, use our Complaints & Content Removal process — it is faster and does not require an account.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

8. Cookies and local storage

We use browser storage to keep you signed in, remember your preferences, and record that you have confirmed your age. We use analytics to understand how the site is used in aggregate. We do not use advertising or cross-site tracking cookies.

9. Children

Panty Post is strictly for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If we become aware that we have, the account is closed immediately and the information deleted. See our Age Verification Policy.

10. Changes to this policy

We will post any changes on this page and update the date above. Material changes will be notified to account holders by email.