This Privacy Policy explains how XLIST collects, uses, discloses, stores, and protects personal information when you use our website, services, listings, forms, messages, and related features.

For privacy requests, you can contact us at legal@xlist.com.au. If we provide a different support channel for a particular service, that channel may also be used for service-specific privacy requests.

We collect information you give us directly, information generated by your use of the site, and information received from third parties and service providers.

• Account and profile data such as name, username, bio, contact details, and preferences.
• Age confirmation, policy acknowledgement, and related access-control information.
• Listings, search terms, saved items, messages, support requests, booking details, and other user-generated content.
• Device and browser data such as IP address, user-agent, language, screen size, referring URLs, timestamps, and approximate location inferred from IP address.
• Analytics, measurement, and advertising identifiers, cookies, and similar technologies.
• Server logs and security data, including access records, error logs, and fraud-prevention signals.

We use cookies and similar technologies to make the site work, remember preferences, prevent abuse, and understand how people use the service.

We may use analytics, measurement, advertising, and performance tools provided by trusted third parties from time to time. Those tools may collect or receive browser identifiers, device information, page activity, and related usage data.

Where our age and policy gate applies, we only activate certain tracking or measurement tools after a user confirms they are 18 or over and accepts the site policies. If you do not wish to use those tools, do not proceed past the entry gate.

• We may use an age and policy confirmation cookie so you are not prompted repeatedly after acceptance.
• We may use a locale cookie to store your language choice.
• Analytics and measurement tools may use cookies, pixel tags, tags, or comparable technologies to distinguish users and sessions.
• Advertising and attribution tools may use browser identifiers, IP address, user-agent, page URL, page path, page title, and event identifiers for matching, attribution, and deduplication.

• Verify age eligibility and enforce access restrictions.
• Operate, maintain, secure, and improve the site and its features.
• Display, rank, and moderate listings and content.
• Respond to enquiries, support requests, and account issues.
• Analyse traffic, measure campaign performance, and understand user behaviour.
• Detect spam, abuse, fraud, and security incidents.
• Comply with legal obligations and enforce our Terms.

We share information with service providers and processors that help us operate the site, including hosting, analytics, security, performance monitoring, and advertising measurement providers.

Those providers may receive data such as IP address, browser and device information, event metadata, cookie values, page URLs, and timestamps in order to perform services for us or for their own platform-level measurement and compliance functions.

• Technology and infrastructure providers used to host, secure, analyse, and improve the site.
• Advertising and measurement partners used to assess campaign performance and reach.
• Professional advisers, regulators, law enforcement, or other parties where disclosure is required or permitted by law.

If privacy laws requiring a lawful basis apply to you, we rely on different bases depending on the context, including performance of a contract, legitimate interests in operating and securing the site, compliance with legal obligations, and consent for certain cookies, marketing, and measurement tools where required.

You can withdraw consent where consent is the basis for processing. If you do, some features may stop working and your experience may change.

We keep personal information for as long as reasonably necessary for the purposes described in this Policy, to comply with legal obligations, to resolve disputes, and to enforce our agreements.

Some records may be retained longer where the law requires it or where retention is reasonably necessary for security, fraud prevention, accounting, or audit purposes.

Depending on where you live, you may have rights to access, correct, delete, object to, or restrict certain processing of your personal information, and to receive a copy of some data in a portable format.

You may also have the right to complain to a privacy regulator. In Australia, the Office of the Australian Information Commissioner oversees compliance with the Australian Privacy Principles.

We use reasonable technical and organisational safeguards designed to protect personal information, but no system can be guaranteed to be completely secure.

You are responsible for protecting your own device, credentials, and account access. If you believe your information has been compromised, contact us promptly.

Your information may be processed in countries other than where you live, including where our service providers or their subprocessors operate. Those countries may have different privacy laws than your own.

Where required, we take steps intended to provide appropriate safeguards for cross-border transfers.

The site is intended only for adults. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a minor, we may delete it and restrict access.

We may update this policy from time to time. If we make material changes, we will post the updated version here and may also provide additional notice where appropriate.

Last updated: JUNE 18, 2025

1. INTRODUCTION Turnstile, developed by Cloudflare, Inc. (Cloudflare), is a pro-privacy website security tool that processes minimal Signals (as defined below) solely to protect web properties against malicious activity by distinguishing human users from bots and blocking bot traffic.

Cloudflare does not control whether a website chooses to use Turnstile; instead, we make Turnstile available to any website that is looking for a way to detect and block bot traffic.

2. SCOPE OF THIS ADDENDUM This Turnstile Addendum is supplemental to Cloudflare's main Privacy Policy. It provides additional information specific to your use and interaction with Turnstile. This Addendum also applies to the personal data processed using Cloudflare’s Challenge Platform, and any reference to “Turnstile” in this addendum applies equally to the Challenge Platform.

3. INFORMATION WE COLLECT Cloudflare Turnstile processes a variety of client-side signals ("Signals") such as client IP address, TLS Fingerprint, User-Agent Header and Sitekey and associated origin. Cloudflare does not have the ability to directly identify any individuals from any of the Signals Turnstile collects, including IP addresses.

4. HOW WE USE INFORMATION WE COLLECT (i) Bot detection and blocking Turnstile is a tool to protect web properties by distinguishing human users from bots and blocking any detected bot traffic that could otherwise harm the safety and security of that property. It does so by evaluating the Signals listed above specific to both the website visitor and the website visited. The purpose of collecting these Signals is not to identify, profile or target any individuals but solely to detect and block bots. The Signals collected by Turnstile are strictly necessary for this purpose (i.e. detecting and blocking bots to enable visitors to enjoy a safe and secure experience when visiting websites that have implemented Turnstile). Cloudflare is a data processor of Signals that we process to provide the Turnstile service to our customers, that is, securing our customers’ websites. This means that we process Signals for this purpose on behalf of, and pursuant to instructions issued by, our website operator customers (who are the data controllers of any data processed for this purpose). If you have questions, or wish to exercise any data protection rights, regarding Cloudflare’s processing of Turnstile data to provide our service, please contact the relevant website operator. (ii) Improving Turnstile’s bot detection capabilities Cloudflare also processes the Signals described in this Privacy Notice to improve Turnstile. This is necessary to refine and improve our bot detection algorithms in order to respond to evolving bot threats, and to maintain the security of the web properties that website visitors choose to visit. Cloudflare is a data controller of Signals that we process to improve Turnstile’s bot detection capabilities. This Turnstile Privacy Notice (in conjunction with Cloudflare's main Privacy Policy) governs our processing of Signals for this purpose.

5. NOTICE TO EU AND UK RESIDENTS To the extent that the data described in the Turnstile Privacy Notice qualifies as personal data, then: When processing this personal data as a processor to protect our customers' websites, our customers, as controllers, determine the lawful basis of this processing, and we process this data under their instruction and on their behalf; and When processing this personal data as a controller, we rely on our legitimate interests in improving the effectiveness of Turnstile's bot detection capabilities to process this Turnstile data.

6. COOKIES The Signals collected by Turnstile are strictly necessary for the purpose of detecting and blocking bots to enable visitors to enjoy a safe and secure experience when visiting websites that have implemented Turnstile. For more information about the cookies used by Cloudflare, please check our Cookie Policy and our Turnstile Developer Docs.

CONTACT FOR PRIVACY CONCERNS If you have questions or concerns about this Turnstile Privacy Notice or your personal data processed through Turnstile, please contact Cloudflare’s Data Protection Officer at dpo@cloudflare.com.