Version: 5.0 - 29 August 2026
Alice and Bear Holdings Pty Ltd (ACN 701 192 896) trading as With A Bow
Alice and Bear Holdings Pty Ltd (ACN 701 192 896) trading as With A Bow ("With A Bow", "we", "us" or "our") operates a digital wishing well and wedding registry platform that allows event organisers to create event pages through which guests can make cash gifts, select gift items, leave messages and receive related communications ("Platform"). We provide registry creation, payment facilitation, payout coordination, messaging, reporting, moderation and related support tools ("Services"). This Privacy Policy explains how we collect, hold, use and disclose Personal Information in connection with the Platform and Services. In this Privacy Policy, "Privacy Act" means the Privacy Act 1988 (Cth).
By accessing or using the Platform or Services, you acknowledge that you have read and understood this Privacy Policy. Capitalised terms used but not defined have the meaning given in our applicable Terms of Service, available at withabow.com.au/terms.
This Privacy Policy applies to all individuals whose Personal Information we collect in connection with the Platform and Services, including event organisers, hosts, guests, contributors, prospective users, individuals who report an event or content, individuals who interact with us through With A Bow or related business channels, and other visitors to our website and Platform.
It also applies to Personal Information collected through our website, event pages, account registration flows, payment flows, communications, support interactions, reporting tools, referrals, partner or supplier interactions, and other online and offline channels related to the Platform and Services.
We are committed to respecting your privacy and to handling Personal Information in a lawful, fair and transparent manner. This Privacy Policy is designed to be clear and accessible for all users of the Platform, whether you are creating an event, contributing to an event, receiving communications through the Platform, reporting a concern or visiting our website.
We collect information that is reasonably necessary for our functions and activities, including to operate, secure, administer, support and improve the Platform and Services. The types of Personal Information we collect may include:
Sensitive Information. We do not seek to collect Sensitive Information (as defined in the Privacy Act), such as information about your race, religion, health, sexual orientation or criminal record. However, you may choose to include Sensitive Information in an event page, message, photo, report or other communication. If you do so, you consent to us handling that information for the purposes described in this Privacy Policy. You should consider carefully before including Sensitive Information in content that may be visible to other users or recipients.
We collect Personal Information:
We collect, use and disclose Personal Information for purposes reasonably necessary for, or directly related to, our functions and activities, including to:
We do not use or disclose Personal Information for purposes other than those described in this Privacy Policy, our agreements with you, or as otherwise permitted or required by law.
The Platform is designed to allow event organisers to publish event pages and allow guests to contribute to those events. As part of this functionality, certain Personal Information may be visible to, or shared with, other users and recipients.
An event organiser's event title, event date, names, descriptions, gift items, event photos, cover images and public messages may be visible to anyone who can access the event page.
Unless a guest chooses to contribute anonymously, the guest's name, the gift item or cash fund they contributed towards, and the date of the contribution may be displayed on the event page and visible to anyone who can access that page. Contribution amounts, email addresses and contribution messages are not displayed on the event page. Where a guest has not chosen to contribute anonymously, the guest's name, email address, contribution details, selected gift item and message are also made available to the relevant event organiser so they can manage the event, reconcile contributions and send permitted thank-you communications.
Where a guest chooses to contribute anonymously, the guest's name and email address are not displayed on the event page and are not shown to the event organiser. The event organiser can see the contribution amount, the gift item or cash fund, the date and any message the guest has written, shown under a generic label.
Choosing anonymity changes how the contribution is displayed. With A Bow still collects and retains the guest's name, email address and contribution details, and may use and disclose that information for payment processing, receipts, record-keeping, fraud prevention, dispute handling and the other purposes described in this Privacy Policy.
You are responsible for the information you choose to share on or through the Platform, including in an event page, gift item, contribution message, thank-you message, photo, report or communication with us. Once information is shared with another user or recipient through the Platform, With A Bow may not be able to control how that person uses, stores or further discloses that information. We encourage you not to share sensitive personal details unless you are comfortable doing so.
We may provide tools and settings to help you manage your privacy on the Platform, including controls relating to event pages, account details, notifications, communications, reporting and moderation. We may also implement verification, moderation, reporting and safety features to help protect users, guests, event organisers and the Platform.
We use the Payment Processor to process contributions, service fees, refunds, chargebacks, disputes, connected accounts, identity verification and payouts. The Payment Processor may collect and process payment card details, identity verification information and bank account details directly from event organisers and guests. With A Bow may receive limited information from the Payment Processor, such as account identifiers, verification status, transaction metadata, refund status, dispute status and payout status, to operate the Platform, manage risk and comply with our obligations.
We may use automated and manual tools to support fraud prevention, platform security, risk review, dispute handling, operational monitoring and enforcement of our Terms of Service. These tools may assist us to identify suspicious activity, apply risk flags, review contributions, delay or suspend payouts, suspend accounts or events, remove content, or take other steps reasonably necessary to protect users, guests, event organisers, With A Bow, the Payment Processor and the Platform.
Where a contribution, account, payout, event page or other activity is subject to review, we may collect and use related Personal Information to investigate the issue, contact relevant users, liaise with the Payment Processor or other service providers, comply with applicable laws, and take action permitted by our Terms of Service.
In addition to the user disclosures described above, we may disclose Personal Information to:
We do not sell your Personal Information to third parties or disclose it to third parties for their own unrelated marketing purposes.
The Platform uses Supabase infrastructure and, based on the current platform architecture, core production account data is stored in Sydney, Australia.
Some third-party service providers we engage may store, process or access Personal Information outside Australia. Based on the current service stack, this may include the Payment Processor processing payment and connected-account data in the United States and other jurisdictions in which it operates, Resend processing transactional email data through its Tokyo/Japan region, and PostHog processing product analytics data in the European Union. Other suppliers may process Personal Information in other countries or regions notified in their applicable service arrangements.
Where we disclose Personal Information to an overseas recipient, we will take reasonable steps in relation to that recipient's handling of the information, for example by entering into appropriate contractual arrangements or obtaining consent where required.
We may also disclose Personal Information to law enforcement, regulators, courts or other authorities in Australia or overseas where required or authorised by law.
We use cookies and similar technologies to operate the Platform, authenticate sessions, keep you signed in, support payment processing and fraud prevention, remember your settings and monitor security. These are essential for the Platform to function and cannot be switched off through our systems.
We also use PostHog, a product analytics service, to understand how the Platform is used and to improve it. Where you have not accepted analytics, PostHog is not loaded in your browser: no cookie is set, no analytics identifier is created, and your browser makes no request to PostHog. Separately, our own servers record a small number of operational events about contributions and payments, identified only by internal account and contribution references, so that we can trace and correct faults on the money path. We are working to remove these. If you accepted previously and later decline, we remove PostHog cookies and stored identifiers from your browser.
Where you accept, PostHog collects information about how you use the Platform, including pages viewed, features used, clicks and similar interactions, and heatmaps showing where visitors click and scroll. For account holders this is linked to your account identifier. Guests are not identified. Your IP address is anonymised before it is stored.
We also record browsing sessions where you have accepted analytics. A session recording is a replay of the pages you saw and the actions you took, which we use to diagnose faults and improve the Platform. Text you type into forms is masked before it leaves your browser, so we do not receive passwords, card details or the contents of messages you write. We do not record browser console output. Session recordings are kept for 30 days and then deleted.
PostHog processes this information in the European Union.
You may adjust your browser settings to refuse some or all cookies. This may affect authentication, payments and fraud-prevention features. If you want to change your analytics choice after making it, or ask us to delete analytics data associated with you, contact us using the details below.
The Sending Gratitude feature allows event organisers to send thank-you communications to guests or contributors who have contributed to their event. To deliver those communications, we may use the contributor's name, email address, contribution details, message content and any photo or message the event organiser chooses to include.
Photos uploaded through the Sending Gratitude feature are stored securely and may be made available to the intended recipient through a time limited signed URL. Hero images and event cover photos may be stored in a separate public domain because they are designed to be visible on event pages. Signed URLs, photos and related content may remain available for the periods notified to the user or recipient, unless deleted or expired earlier in accordance with our retention practices.
When you make a contribution to an event, you acknowledge that the relevant event organiser may use your contact details to send you permitted thank-you communications through the Platform. We will not use contributor contact details for unrelated marketing by With A Bow unless permitted by law or with the contributor's consent.
If a person submits a report about an event, user, contribution, message or other content on the Platform, we may collect the reporter's name and contact details, the details of the report, supporting information and related technical information. We use this information to assess the report, contact the reporter for clarification, investigate the issue, contact relevant users, moderate content, suspend accounts or events, liaise with the Payment Processor or other providers, and take any other action we consider appropriate under our Terms of Service or applicable law.
We may share the substance of a report with the relevant event organiser, user, service provider, adviser or authority where reasonably necessary to investigate or respond to the issue. We will not share a reporter's identity more broadly than necessary unless the reporter consents, the disclosure is required or authorised by law, or we consider disclosure reasonably necessary to protect users, guests, event organisers, With A Bow, the Payment Processor or the Platform.
We implement reasonable technical and organisational measures designed to protect Personal Information against unauthorised access, modification or disclosure, and against misuse, interference and loss. These measures may include access controls, encryption in transit and at rest where appropriate, secure hosting, Row Level Security, administrative multi-factor authentication, secret management, logging, monitoring, operational security reviews and incident response processes.
No method of transmission or storage is completely secure. You are responsible for maintaining the security of your account credentials and for any activity that occurs under your account. We recommend using a strong, unique password and enabling any additional security features we make available.
We retain Personal Information for as long as reasonably necessary to provide the Services, fulfil the purposes described in this Privacy Policy, comply with legal and regulatory obligations, resolve disputes, manage fraud and security risks, and enforce our agreements.
Event records. We keep the financial and transaction records for each event, including contribution records, payment records, fee records, refund and dispute records and related transaction details, for seven years after that event closes to contributions. We then delete them. Each event is counted on its own, so creating a new event does not extend how long we keep the records of an earlier one.
Your account. We keep your account for seven years after your most recent event closes to contributions. If you have not created another event in that time, we delete your account and the personal information held in it. Creating a new event starts that seven years again from the date the new event closes. If you create an account and never create an event, we keep your account for two years and then delete it.
We keep these records because we are required to keep records that record and explain our transactions, and because they may be needed for tax, dispute, fraud prevention or audit purposes.
When you close your account or request deletion, we will delete or de-identify your Personal Information within a reasonable period, unless we are required or permitted to retain it for legal, regulatory, dispute, fraud-prevention, backup, security or operational purposes. Some information may remain in backups for a limited period as part of our ordinary backup and disaster recovery processes.
You can request access to or correction of the personal information we hold about you using the "Request my data" option below or by contacting us. We will take reasonable steps to verify your identity and provide our response securely. We may redact or withhold information where necessary to protect another person's privacy or where permitted or required by law.
You can access and update much of your Personal Information directly through your account settings on the Platform. If you wish to access other Personal Information we hold about you, request correction of information you believe is inaccurate, incomplete or out of date, or request deletion of your Personal Information, please contact us using the details below.
We may need to verify your identity before responding. Every privacy request must be confirmed via a one-time link sent to the email address named in the request. The link is valid for 24 hours. Unverified requests are automatically deleted after 7 days and no action is taken on them. Where we refuse access, correction or deletion as permitted by law, we will provide reasons where required. We will endeavour to respond to requests within 30 days.
If we become aware of a data breach involving Personal Information that is likely to result in serious harm, we will assess the incident promptly and, where required under the Notifiable Data Breaches scheme in the Privacy Act, notify affected individuals and the Office of the Australian Information Commissioner (OAIC). We will also take reasonable steps to contain, investigate and address the incident.
We may send you marketing communications about the Platform, new features, events, updates and related services where permitted by law. You may opt out of receiving marketing communications at any time by using the unsubscribe link in our emails, adjusting your notification preferences where available, or contacting us using the details below. We will respect your preferences.
Opting out of marketing communications will not affect service-related communications, receipts, security alerts, policy notices, support messages, account notices, payment notices, dispute notices or permitted thank-you communications sent by an event organiser through the Platform.
We may de-identify Personal Information and create aggregated datasets, statistics and insights for purposes including service improvement, product analytics, research, reporting, fraud-risk assessment, operational monitoring and platform performance analysis. De-identified information does not identify you as an individual. We may use and disclose de-identified or aggregated information for any lawful purpose, provided it is not re-identified.
The Platform may contain links to third-party websites or services, including Payment Processor-hosted payment flows, Payment Processor dashboards, authentication providers, email links, event-related links provided by users and other third-party services. We are not responsible for the privacy practices, content or security of those third parties. We encourage you to review their privacy policies before providing Personal Information to them.
The Platform is intended for users who are at least 18 years of age. We do not knowingly collect Personal Information from individuals under 18. If you believe a person under 18 has provided Personal Information to us, please contact us so we can take appropriate steps.
We may update this Privacy Policy from time to time. We will post the updated version on our website with a new version number and date and, where appropriate, notify you via the Platform or by email. The updated policy will take effect on the date indicated. Your continued use of the Platform after an update constitutes acceptance of the updated policy. We encourage you to review this Privacy Policy periodically.
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a complaint about our handling of your Personal Information, please contact:
Privacy Officer
Alice and Bear Holdings Pty Ltd
Email: hello@withabow.com.au
We take privacy complaints seriously. We will investigate your complaint and respond within a reasonable period, usually within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au or by calling 1300 363 992.
For the purposes of this Privacy Policy: