Privacy

What we collect

When you reserve a box we collect your name, your email address and your mobile number. We use your email to send your confirmation and to tell you the day your box is ready, and your mobile for the same reason if email is not reaching you.

We keep a record of what you ordered, what you paid, and the weight your box came in at.

Your card

Card details go to our payment provider, Stripe, and only to Stripe. They never reach our servers and we never store them. Your card pays the deposit and nothing else. We hold Stripe's reference to that one payment, and the balance comes on an invoice you pay yourself.

Stripe holds card data under its own terms and its own security standards.

Where your information is kept

Your name, email, mobile and order history are stored in Australia, in Google's Sydney region.

Two things go overseas, and both carry your contact details rather than just the contents of a message:

• Email. Our email provider, Resend, is in the United States. Your email address and the emails we send you are stored there.
• Our customer list, and your order. When you place an order, your name, email and mobile go to GoHighLevel, the system we use to run our orders and keep our customer list. So does your order: its number, the cuts and grades, your deposit and how you paid it (for a card, Stripe's reference to that payment), and later the weight of your box and your bill. We never send it your card details. If an earlier order of yours included a street address, that's there too. GoHighLevel is in the United States, and so are any messages we send you through it.
• Messages from our contact page. Your name, email, mobile if you give it, and your message go to GoHighLevel too, so we can reply. Sending a message doesn't sign you up for anything.
• How the site is used. Google Analytics counts the pages and cuts people look at, and the orders placed. It sees your device, your browser and roughly where you are, and sets a cookie to tell one visit from the next. It never gets your name, email, mobile or card. Google is in the United States.

Placing an order doesn't sign you up for anything. We'll message you about your own order, for example when your box is ready to collect. Cycle announcements only go to people who tick the box asking for them.

Marketing, and how to stop it

We only send you cycle announcements if you tick the box asking for them. Every one of those messages carries an unsubscribe link, and you can also reply to any email from us and ask to be taken off. We act on that within five working days.

Emails about an order you have placed are part of the sale: your confirmation, and the message telling you your box is ready. You receive those whether or not you opt in to marketing.

Stopping abuse of the reservation system

When a reservation is made we keep a one-way fingerprint of the connection it came from, so a script cannot hold every box in a cycle. It is never linked to your name or your order, it cannot be turned back into an address, and it deletes itself within two days.

Who else sees it

Our supplier receives an order for cuts and grades. It contains no customer names and no customer contact details, because it is one consolidated order for the whole cycle.

We share your details with nobody else, and we sell them to nobody.

How long we keep it

We keep order records for seven years, because tax law requires it. Contact details we keep while you are a customer and for two years after your last order, then remove them.

Asking to see it, fix it, or have it removed

Reply to any email from us and ask. You can ask for a copy of what we hold about you, ask us to correct something wrong, or ask us to delete it. We answer within 30 days.

Order records stay for the seven years above, because tax law requires it. We tell you when that applies to something you have asked us to remove.

If something goes wrong

Tell us first, by replying to any email from us, and we will look into it and come back to you. If you are not satisfied with how we handle it, you can take a privacy complaint to the Office of the Australian Information Commissioner at oaic.gov.au.