PRIVACY POLICY.

This Privacy Policy explains how Fight Society collects, holds, uses and discloses personal information when you browse our website, contact us, create an account, publish a profile, list an event, apply for a bout or use a fighter, promoter or administrator workspace.

We are committed to handling personal information transparently and in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply. This policy should be read with our Terms and Conditions.

Depending on how you use Fight Society, we may collect and hold:

• Account information: name, email address, phone number, date of birth, gender, account role, account status, authentication identifiers and sign-in or security events. We do not receive or store your plain-text password.
• Fighter information: biography, profile image, gym, location, height, walk and fight-weight ranges, level, styles, divisions, availability, fight record, opponents, results, titles, media links, social links and verification history.
• Promoter and event information: organisation details, profile image, biography, location, websites and social links, event descriptions, venues, dates, ticket links, purse information, bout requirements, applications, decisions and matchups.
• Communications: contact-form enquiries, support correspondence, application notes and the information needed to send account and workflow notices.
• Technical and security information: IP address, browser and device information, authentication cookies, request timing, security-challenge results, rate-limit records, audit events, delivery status and diagnostic logs.
• Sensitive or safety-related information: eligibility, medical, licensing or sanctioning information you choose to provide, or that is requested for a particular opportunity. Please do not send detailed medical records through a general contact form unless we specifically ask you to do so through an approved channel.

• Directly from you when you register, complete or update a profile, upload an image, add a fight record or title, list an event, apply for a bout, contact support or request account deletion.
• From other platform users where a promoter records an event decision or result, an opponent is linked to a fight, or an administrator reviews or corrects a platform record.
• From identity providers if you choose an available third-party sign-in method. We receive only the account information the provider makes available for that sign-in.
• Automatically through necessary authentication cookies, server logs, security controls and Cloudflare Turnstile when you use the website.
• From publicly available or authoritative sources where reasonably necessary to verify a fight record, title, event, identity claim or platform eligibility.

• Create, secure and administer fighter, promoter and administrator accounts.
• Operate public profiles, the fighter registry, event listings, applications, matchmaking, fight-card and result workflows.
• Review and verify profiles, records, titles, events, results and platform eligibility.
• Share relevant application information with the promoter responsible for the event applied to.
• Send email confirmation, password reset, account, application, matchup, result, security and account-deletion notices.
• Respond to enquiries and complaints, provide support and maintain service records.
• Prevent spam, fraud, abuse and unauthorised access; enforce our Terms; investigate incidents; and protect users, events and the platform.
• Maintain accurate fight and audit history, improve reliability and meet legal, safety, regulatory and record-keeping obligations.

Verified fighter, promoter and event profiles are intended to be public. Public information may include a person's name, profile image, biography, location, gym or organisation, fight attributes, availability, fight history, titles, media and social links. Event details, open bout requirements, ticket links, participating fighters and results may also be public.

Email addresses, phone numbers, full dates of birth, authentication information and account-security records are not intended for public display. A promoter reviewing an application sees the applicant's relevant public profile, fight information and application note, but not the applicant's private account contact fields through the application workspace. Administrators may access information where necessary to operate, secure and review the platform.

Information published online can be copied, indexed or shared by others outside our control. Consider this before choosing information or media for a public profile.

We may disclose personal information:

• to the fighter, promoter or administrator involved in the relevant platform workflow, only to the extent reasonably needed;
• to suppliers that host, secure and deliver Fight Society, including Vercel for application hosting, Supabase for database, authentication and file storage, Cloudflare for DNS and Turnstile security, and Resend and connected mail systems for transactional email;
• to professional advisers, insurers, regulators, law-enforcement bodies, courts or other authorities where reasonably necessary or required or authorised by law;
• in connection with a genuine sale, restructure or transfer of the platform, subject to appropriate confidentiality and privacy protections; or
• with your consent or at your direction.

We do not sell or rent personal information and we do not provide private account contact details to promoters for unrelated marketing.

Some service providers operate global infrastructure or process information outside Australia, including in the United States and other locations selected by those providers. The countries involved may change as providers update their infrastructure. We take reasonable steps to select reputable providers and protect information in accordance with applicable Australian requirements.

Public profiles may contain links to third-party websites or social accounts. YouTube or Vimeo media and other external content may be displayed or opened through those providers. Those third parties handle information under their own privacy policies, and Fight Society does not control their practices.

Fight Society uses cookies that are necessary for authentication, account security and session continuity. We also use limited browser storage for interface preferences, such as dashboard table settings and tutorial state. Cloudflare Turnstile may process device, browser and network signals to distinguish legitimate use from abuse.

We do not currently use third-party advertising cookies or sell browsing behaviour for targeted advertising. Blocking necessary cookies may prevent account features from working. If we introduce materially different analytics or advertising technologies, we will update this policy and provide any notice or choice required by law.

We use measures designed to protect information, including encrypted connections, role-based access checks, row-level database security, restricted administrative access, multifactor authentication for administrators, rate limits, security challenges, audit records and account-session controls. No online service can guarantee absolute security.

If we become aware of a data breach, we will investigate, take reasonable steps to contain and remediate it, and notify affected individuals and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires us to do so. Contact us promptly if you believe an account or record has been compromised.

We retain information for as long as reasonably needed to provide the service, maintain accurate fight and event records, deliver notices, resolve disputes, prevent fraud, enforce our Terms and meet legal or regulatory obligations.

Sent transactional-email recipient details and template data are scheduled to be redacted from the platform outbox after 30 days. Copies may remain for a different period in the systems of the email provider and recipient.

When account deletion is requested, the account is archived and its public profile is hidden immediately. The account can be restored during a 30-day grace period. After that period, the account, personal profile and account-linked uploads are scheduled for permanent deletion. We may retain limited de-identified fight history, non-personal operational records, or information required for legal, safety, fraud-prevention or dispute purposes. Backup copies may persist temporarily until overwritten through normal backup cycles.

You can update many account and profile fields in your workspace and control whether eligible profile information is submitted for public verification. You may contact us to request access to or correction of personal information, withdraw consent where processing relies on consent, question a verification decision, or raise a privacy complaint. We may need to verify your identity before acting on a request.

We will respond within a reasonable period and explain any lawful reason we cannot fulfil a request. Required authentication, application, matchup, account and security messages are service communications and cannot be opted out of while the relevant account or workflow remains active. Fight Society does not currently send a general marketing newsletter; any future commercial messages will require an appropriate basis and an unsubscribe method.

Fight Society accounts are for people aged 18 or older. We do not knowingly create accounts for children. If you believe a person under 18 has provided personal information, contact us so we can investigate and remove it where appropriate.

For privacy questions, access or correction requests, deletion support or complaints, email admin@fightsociety.com.au. Please describe the issue and the outcome you are seeking. We aim to acknowledge privacy complaints promptly and respond within 30 days where practicable.

If you are not satisfied with our response and the Privacy Act applies, you may contact the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints.

We may update this policy as the platform or law changes. The current version will be published here with a revised effective date, and material changes may also be notified through the platform or by email.