Who we are
Charlie and Me Sensory (ABN 16 909 933 836), trading as Charlie & Me Handcrafted Sensory Tubs, is a small Australian business based in Echuca, Victoria. This policy explains how we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Questions about anything here can go to [email protected].
What we collect and when
- When you place an order: your name, email address, delivery address, phone number (only if you give it) and what you ordered. We need these to make and post your tubs and to contact you about your order.
- When you create an account: your name, email address and a password. Passwords are stored only in securely hashed form; we never see or store the actual password. Your account also keeps any delivery addresses, wishlist items and order history you build up.
- When you send a message: the name, email address and message you type into the contact form.
- When you join the newsletter: your email address, and nothing else.
- When you browse: analytics data described under “Cookies and analytics” below, plus the things your browser stores locally to make the site work (your basket, your signed in session). Those local items stay on your device.
We do not collect sensitive information (such as health information) and we do not ask for more than the shop genuinely needs.
Children
Our products are made for children, but this website is directed at the adults who buy for them. We do not knowingly collect personal information from children. Accounts and orders are for people 18 and over.
What we use it for
- Making, posting and following up your orders.
- Answering the messages you send us.
- Running your account, wishlist and order history.
- Sending the newsletter, only if you opted in. Every newsletter includes an unsubscribe link and we honour the Spam Act 2003: no marketing without your consent.
- Understanding how the site is used so we can improve it.
We never sell or rent your personal information and we never add you to marketing lists you did not ask for.
Payments
Card payments are not taken on this site yet; orders are currently confirmed by email. When online payments launch they will be handled by a dedicated payment provider (Stripe); your card details will go directly to them and will never be stored by this site. This policy will be updated when that happens.
Where your information lives
Order, account, message and newsletter data is stored in our database hosted by Supabase on servers located in Sydney, Australia. Data is encrypted in transit and access is restricted to the shop owner.
Who we share it with
Only the service providers needed to run a small online shop, and only the minimum each needs:
- Supabase: database and account hosting (Sydney, Australia), as above.
- Australia Post or couriers: your name, address and phone number, so your order can be delivered.
- Google: analytics data via Google Analytics, described below. Google may process this data on servers outside Australia, including in the United States.
- Stripe: payment processing, once payments launch.
Beyond overseas processing by Google (and later Stripe), we do not disclose personal information overseas. We would only ever hand over information beyond this list if the law required it.
Cookies and analytics
The site uses Google Analytics to understand which pages are visited and how people find the shop. Google Analytics sets cookies and collects things like pages viewed, device and browser type, and approximate location. We use it only to improve the site, never to build advertising profiles. You can opt out with Google’s browser opt out add on or by blocking cookies. The full detail, including the strictly necessary items like your basket, lives in the Cookie Policy.
How long we keep it
Only as long as it is needed. Order records are kept for at least five years because Australian tax law requires it. Contact messages are deleted once dealt with. Newsletter emails are kept until you unsubscribe. Account information is kept while your account exists and deleted when you ask us to close it.
Keeping it safe
All traffic to the site is encrypted (HTTPS), passwords are hashed, database access is locked down with row level security and only the shop owner can see customer information. If a data breach ever occurred that was likely to cause serious harm, we would notify the affected people and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme.
Access, correction and deletion
You can see and update your name, email and addresses yourself in your account. For anything else, email [email protected] and ask for a copy of your information, a correction, or deletion. We will respond within 30 days and will not charge you for asking.
Complaints
If you think we have mishandled your information, please email us first and we will do our best to put it right quickly. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Changes to this policy
If how we handle information changes (for example, when online payments launch), this page will be updated and the date below revised. Significant changes will be flagged to account holders by email.