Privacy Policy

WandrLust Privacy Policy

Last updated 23 September 2026

This Privacy Policy explains how Critterpedia Pty Ltd, trading as WandrLust, collects, uses, discloses and protects personal information when people use the WandrLust website, mobile application, partner services, or contact us. In this policy, “WandrLust”, “we”, “us” and “our” refer to Critterpedia Pty Ltd.

WandrLust is designed to help people discover real-world places and activities, verify eligible real-world actions, receive rewards, and allow participating organisations to measure verified outcomes without receiving individual movement histories.

This policy applies only to features that are available to you. Some described controls may apply when related features are introduced or enabled. We will provide additional notice where a new feature materially changes how personal information is handled.

Key points

  • Location and verification data. If you enable location-based features or submit a check-in, we may process precise location and other device signals needed to provide the feature and assess whether an eligible action occurred.
  • AI guidance and verification are separate. AI or recommendation systems may help suggest places, activities and rewards. A separate verification process assesses evidence against defined rules and thresholds.
  • No individual movement histories for clients. Participating organisations receive campaign outcomes or privacy-protected group information, not a named person’s movement history.
  • No sale of personal information. We do not sell personal information for money and we do not use third-party advertising networks in the mobile app as at the date of this policy.
  • Your choices. You can control device permissions, marketing communications and optional features, and you may request access, correction or deletion where applicable.

1 Scope and responsible organisation

This policy applies when you visit wandrlust.io, use a WandrLust mobile application or partner-facing service, participate in a pilot, campaign or research activity linked to this policy, or communicate with us. It does not govern a third party’s own website, application or service, even if WandrLust links to it.

Critterpedia Pty Ltd is responsible for the personal information covered by this policy unless a separate notice identifies another organisation as responsible. If a participating organisation independently decides why and how it will use information it receives, its own privacy policy also applies to that use.

2 Personal information we collect

Information you provide

  • Account and profile information, such as name, username, email address, account identifier, profile details and communication preferences.
  • Business and partner information, such as your name, organisation, role, contact details, campaign enquiries and information you provide through TAO or another partner service.
  • Content and communications, such as support requests, survey responses, feedback and content you choose to submit or share.
  • Optional preferences, such as interests, accessibility choices or the types of places, activities and rewards you want to see.
  • Reward and transaction information, such as points or reward activity, redemption status and records needed to administer a campaign. WandrLust does not currently collect payment-card details through the consumer application.

Information collected from your device or use of the Services

  • Device and application information, such as device type, operating-system and app version, IP address, device or app identifiers, security status, crash information and diagnostic logs.
  • Usage information, such as pages or features used, session times, searches, interactions, referrals and performance events.
  • Location information, which may include precise GPS location, approximate location, route continuity, timing and arrival information when location permission is enabled or you use a location-based feature.
  • Verification information, which may include device-integrity or attestation results, signed check-in data, network and environmental context, motion or sensor-derived features, behaviour plausibility signals, venue information and the resulting verification status.
  • Camera-derived verification information, only where a feature requests it and you choose to use it. Where on-device scene verification is enabled, the aim is to evaluate the scene on the device and transmit the verification result or derived evidence rather than the raw image. The in-product notice will explain the actual handling before capture.
  • Cookie and similar-technology data from the website, subject to your choices and any consent controls we provide.

Information from other sources

We may receive limited information from authentication, device-platform, hosting, analytics, customer-support and campaign providers, or from a participating organisation where necessary to provide a feature. We do not buy personal information from data brokers. If you use an external sign-in method, we receive only the information that the provider and your settings permit, such as an account identifier, name or email address.

Sensitive information

Precise geolocation may be treated as sensitive personal information under some laws. We process it only for stated location, verification, safety, fraud-prevention or user-requested functions, and subject to device permissions and applicable law. We do not seek health information, biometric identifiers, government identifiers, racial or ethnic origin, religious beliefs or sexual orientation as part of the core Services. An image or sensor reading is not used to create a facial template or identify a person unless we give separate notice and obtain any consent required by law.

3 Why we use personal information

Purpose How information may be used
Provide the Services Create and manage accounts, display places and campaigns, provide navigation or contextual information, support check-ins, issue or administer rewards, and deliver requested features.
Verify real-world actions Assess device, location, journey, timing and other permitted evidence against defined verification rules and thresholds, and return a status such as pending, verified, step-up required or rejected.
Prevent fraud and protect users Detect spoofing, replay, abuse, security incidents and violations, apply rate limits or campaign rules, and investigate disputes.
Personalise guidance Use preferences and current-session context to rank or recommend relevant places, activities and rewards. Participating organisations may fund eligible opportunities but do not control an individual’s personal ranking.
Operate partner services Create and manage campaigns, calculate verified outcomes, provide reporting, administer billing and support participating organisations.
Improve reliability Analyse performance, troubleshoot problems, test features, measure aggregate use and improve security and usability.
Communicate Respond to requests, send service notices and, where permitted, send marketing that you can opt out of.
Meet legal obligations Maintain required records, respond to lawful requests, enforce agreements and establish or defend legal claims.

4 AI recommendations and automated processing

WandrLust may use recommendation logic, artificial intelligence or machine learning to help identify places, activities or rewards that may be relevant to you. Recommendations may use preferences you provide, current-session context and privacy-protected information available to the feature. You remain free to ignore a recommendation or choose another action.

Proof of Presence is separate from personal recommendations. Verification is designed to assess submitted evidence against defined rules, evidence thresholds and campaign requirements. Artificial intelligence does not make decisions that produce legal or similarly significant effects about you. If we later introduce a materially different automated decision-making use, we will provide the disclosures and choices required by law.

We do not use identifiable user content or precise movement histories to train general-purpose third-party AI models unless we clearly disclose that use and obtain any consent required by law. De-identified or aggregated information may be used to evaluate and improve system reliability, fraud controls and recommendations where it cannot reasonably be linked back to an individual.

5 Proof of Presence and privacy architecture

Proof of Presence uses multiple independent signals because GPS alone is not sufficient to verify a real-world action. The evidence used depends on the feature and the value or risk of the reward. We aim to collect only the evidence reasonably needed for the relevant verification tier.

Our architecture is designed to separate identity, verification evidence and the outcome made available to other parts of the system. Where confidential-computing controls are deployed for a feature, approved software processes protected evidence inside a hardware-isolated environment and releases only permitted outputs. Because the production architecture is being developed in stages, the specific controls operating for a feature will be those described in the application or feature notice at that time.

Participating organisations are intended to receive verified campaign outcomes and privacy-protected group patterns. They do not receive a named person’s raw verification evidence or individual movement history unless you direct us to share specific information or we give separate notice and have a lawful basis.

6 Legal bases for processing

Where the law requires a legal basis, we rely on one or more of the following:

  • Contract, where processing is necessary to provide a service you request or administer your account.
  • Consent, including for device permissions, precise location, optional camera access, non-essential cookies or marketing where consent is required. You may withdraw consent, although this does not affect earlier lawful processing.
  • Legitimate interests, where reasonably necessary to operate and improve the Services, secure systems, prevent fraud, support users and conduct proportionate business analysis, provided those interests are not overridden by your rights.
  • Legal obligation, where processing is necessary to comply with law, regulation, court orders or lawful government requests.
  • Vital interests, in the limited circumstances where processing is necessary to protect a person from serious harm. WandrLust is not an emergency service.

7 When we disclose personal information

We may disclose personal information to:

  • Service providers that support hosting, storage, authentication, device integrity, communications, analytics, security, engineering, customer support and website operations. They may process information only for the contracted service and subject to applicable safeguards.
  • Participating organisations, to provide verified campaign outcomes, administer a reward you choose to claim, or provide privacy-protected reporting. We do not provide them with individual movement histories as a product.
  • Professional advisers, auditors, insurers and financiers where reasonably necessary and subject to confidentiality obligations.
  • Regulators, courts, law-enforcement bodies or other parties where required or permitted by law, or where necessary to protect rights, safety, systems or users.
  • A buyer, investor or successor in connection with a proposed or completed financing, merger, restructuring or sale, subject to appropriate confidentiality and legal protections.
  • Other people, where you ask us to share information or make content public. Public content may be copied or shared outside WandrLust, so do not publish information you want to keep private.

We do not sell personal information for money. As at the date of this policy, the WandrLust mobile application does not use third-party advertising networks for cross-context behavioural advertising. If this changes, we will update this policy and provide any legally required opt-out mechanism before the change applies.

8 Cookies and website analytics

The website may use essential cookies and similar technologies needed for security, page delivery and preferences. We may also use analytics technologies to understand aggregate website use and diagnose performance. Where required, non-essential technologies will not operate until you consent. You can use our cookie controls or browser settings to change your choices. Blocking essential cookies may affect website functions.

9 International data transfers

WandrLust and its service providers may process information in Australia and other countries where they operate. Those countries may have different privacy laws. Where required, we use contractual, technical or organisational safeguards for international transfers and provide further information on request.

10 How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide the Services, resolve disputes, prevent fraud, meet accounting or legal obligations and maintain security. Retention depends on the type of information, the sensitivity and risk, whether the purpose can be achieved with de-identified information, and any legal requirement.

  • Account and profile information is generally retained while the account is active and for a limited period afterwards to complete deletion, resolve disputes and meet legal obligations.
  • Raw or detailed verification evidence is intended to be retained for the shortest period reasonably necessary to make or review the verification decision, manage fraud and support a dispute. Where possible, it is deleted or converted into a separated or de-identified record after that purpose is complete.
  • Verified outcome, reward, fraud-prevention and transaction records may be retained longer where needed for account history, campaign settlement, security, audit, tax or legal requirements.
  • Support, business and legal records are retained for the period reasonably required to address the matter and comply with applicable limitation and recordkeeping rules.
  • Backups may retain information for a limited additional period before secure deletion or overwriting.

When information is no longer needed, we delete it, securely destroy it or de-identify it so that it is no longer personal information, unless the law requires or permits continued retention.

11 Security

We use reasonable technical and organisational measures appropriate to the nature and risk of the information. Depending on the feature and its deployment stage, measures may include encryption, access controls, device attestation, signed evidence, separation of identity and verification data, monitoring, testing and protected processing environments. No system can be guaranteed to be completely secure.

If a data breach is likely to cause serious harm or triggers another legal notification requirement, we will investigate and notify affected people and regulators as required by applicable law.

12 Your choices and rights

Depending on where you live, you may have the right to:

  • request access to personal information we hold about you;
  • request correction of inaccurate or incomplete information;
  • request deletion or de-identification, subject to lawful exceptions;
  • object to or request restriction of certain processing;
  • receive certain information in a portable format;
  • withdraw consent;
  • opt out of marketing communications;
  • limit certain uses of sensitive personal information or opt out of sale, sharing or targeted advertising where those rights apply; and
  • complain to us or an applicable privacy regulator.

You can change app permissions in your device settings. If precise location is disabled, location-based discovery and verification features may not work. You can unsubscribe from marketing by using the link in the message or contacting us. We may still send essential service communications.

To exercise a privacy right or request account deletion, email support@wandrlust.app. We may need to verify your identity. We will respond within the period required by applicable law and explain any lawful reason why a request cannot be fully completed.

13 Children and young people

The Services are not directed to children under 16 and we do not knowingly create accounts for or collect personal information from children under 16 without a legally valid form of parental or guardian involvement. If you believe a child under 16 has provided personal information, contact us so we can investigate and take appropriate action.

Where the Services are likely to be accessed by young people, we aim to use privacy-protective defaults, clear language, proportionate age measures and data minimisation. We will review this policy and relevant product settings when Australia’s Children’s Online Privacy Code is finalised and as other child-specific requirements apply.

14 Regional information

Australia

We handle personal information in accordance with the Privacy Act 1988 and the Australian Privacy Principles where they apply. You may request access or correction and may complain to us about our handling of personal information. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

European Economic Area and United Kingdom

If the GDPR or UK GDPR applies, you may have rights of access, rectification, erasure, restriction, objection and portability, and the right to complain to your local supervisory authority. You may also withdraw consent at any time. WandrLust does not use automated processing to make decisions that produce legal or similarly significant effects about users.

United States

Residents of certain US states may have rights to know, access, correct, delete or obtain a copy of personal information, and to opt out of sale, targeted advertising, certain sharing or profiling. WandrLust does not sell personal information for money. We will not discriminate against you for exercising an applicable privacy right. An authorised agent may submit a request where permitted by law, subject to verification.

15 Third-party services and links

The Services may link to or interact with third-party websites, applications, venues, reward providers or platforms. Their handling of personal information is governed by their own policies. Review those policies before providing information directly to them. WandrLust is not responsible for an independent third party’s privacy practices.

16 Complaints

Please email support@wandrlust.app with the subject line “Privacy Complaint” and describe your concern. We will acknowledge and investigate the complaint, may request further information, and will respond within a reasonable period or the period required by law. You may also complain to the privacy regulator in your jurisdiction.

17 Changes to this policy

We may update this policy to reflect changes to the Services, technology or law. The revised policy will show a new last-updated date. If a change materially affects how we use personal information, we will provide additional notice or seek consent where required before the change applies.

18 Contact us

Critterpedia Pty Ltd trading as WandrLust

Email: support@wandrlust.app

Website: https://wandrlust.io