Privacy

What we collect

When you reserve a box we collect your name, your email address and your mobile number. We use your email to send your confirmation and to tell you the day your box is ready, and your mobile for the same reason if email is not reaching you.

We keep a record of what you ordered, what you paid, and the weight your box came in at.

We never collect your address

Every box is collected from our cold room in Emerald, so there is no delivery address to hold and we do not ask for one. We hold no street address for any customer.

Your card

Card details go to our payment provider, Stripe, and only to Stripe. They never reach our servers and we never store them. What we hold is a reference that lets us charge the balance to the card you reserved with, which is the arrangement you agree to at checkout.

Stripe holds card data under its own terms and its own security standards.

Where your information is kept

Your name, email, mobile and order history are stored in Australia, in Google's Sydney region.

Two things go overseas, and both carry your contact details rather than just the contents of a message:

• Email. Our email provider, Resend, is in the United States. Your email address and the emails we send you are stored there.
• Marketing, only if you opt in. If you ask us to tell you when a new cycle opens, your name, email and mobile go to GoHighLevel, which is also in the United States, along with the messages we send you.

If you never opt in to hearing about new cycles, your details never reach GoHighLevel.

Marketing, and how to stop it

We only send you cycle announcements if you tick the box asking for them. Every one of those messages carries an unsubscribe link, and you can also reply to any email from us and ask to be taken off. We act on that within five working days.

Emails about an order you have placed are part of the sale: your confirmation, and the message telling you your box is ready. You receive those whether or not you opt in to marketing.

Stopping abuse of the reservation system

When a reservation is made we keep a one-way fingerprint of the connection it came from, so a script cannot hold every box in a cycle. It is never linked to your name or your order, it cannot be turned back into an address, and it deletes itself within a few hours.

Who else sees it

Our supplier receives an order for cuts and grades. It contains no customer names and no customer contact details, because it is one consolidated order for the whole cycle.

We share your details with nobody else, and we sell them to nobody.

How long we keep it

We keep order records for seven years, because tax law requires it. Contact details we keep while you are a customer and for two years after your last order, then remove them.

Asking to see it, fix it, or have it removed

Reply to any email from us and ask. You can ask for a copy of what we hold about you, ask us to correct something wrong, or ask us to delete it. We answer within 30 days.

Order records stay for the seven years above, because tax law requires it. We tell you when that applies to something you have asked us to remove.

If something goes wrong

Tell us first, by replying to any email from us, and we will look into it and come back to you. If you are not satisfied with how we handle it, you can take a privacy complaint to the Office of the Australian Information Commissioner at oaic.gov.au.