Privacy policy

Information we collect

When you place an order, we collect your name, email address, phone number, fulfilment choice, delivery address or pickup details, ordered items, and any order notes you provide. We also keep the order, receipt, payment method, payment status, and refund status needed to manage the transaction.

If you choose online payment, Stripe processes payment information on its secure checkout. We receive the payment outcome and limited transaction details needed to match the payment to your order. We do not receive or store your full card number.

When product analytics is enabled, we record limited anonymous session events about storefront entry, navigation, catalogue and cart actions, checkout steps, safe validation categories, and a completed order. These events are separate from the customer and payment information used to fulfil your order.

How we use information

We use this information to prepare and fulfil orders, send confirmations and status updates, provide receipts, answer questions, handle cancellations or refunds, keep accounting records, prevent misuse, and operate the service reliably. Anonymous product events help us understand where a storefront session stops before checkout or purchase. We do not use customer contact information for product analytics or build advertising profiles from these events.

Service providers and overseas processing

Neon stores the order database in Sydney, Australia. Netlify Functions are likely to process order information in their default region in Ohio, United States before it reaches the database.

When you select online payment, Stripe receives the information needed to complete and report the payment. Google processes order and contact information through Gmail when we send customer confirmations and operational order emails. These providers may process information outside Australia, including in the United States, under their own privacy and security arrangements.

Axiom receives limited operational telemetry without customer contact details, delivery addresses, order notes, payment credentials, or email content. Provider configurations, locations, and processing arrangements can change, so we review this notice when our hosting or service configuration changes.

Axiom also receives limited anonymous session events about navigation, catalogue, cart, and checkout progress. After an order is committed, this can include our internal order reference and fulfilment outcome. We do not send Axiom customer contact details, delivery addresses, notes, payment information or credentials, cart contents, prices, discounts, or fees as product analytics.

How long we keep information

We generally keep order, receipt, payment-status, and related customer-service records for five years after the transaction is completed. We may keep a record longer when required by law or while it is reasonably needed for an unresolved refund, chargeback, complaint, or legal dispute. After that, we take reasonable steps to delete or de-identify personal information that is no longer needed.

Product analytics and operational telemetry use the same environment-specific Axiom dataset and are retained for 30 days without a secondary archive. Production and staging use separate datasets. These privacy-safe session records may be incomplete and are non-authoritative; they are not a complete record of all business orders or a replacement for customer order and accounting records.

Cookies and browser storage

Your cart is stored in your browser until you clear it or complete an order. Information entered during checkout is temporarily stored in the current browser session so you can move between checkout steps. We remove this draft after a pay-on-receipt order. For an expired or failed online-payment attempt, we remove the draft when you return to the order page. If you do not return, it normally ends when the browser tab is closed. After an accepted Stripe payment, the draft remains in the current browser session and normally ends when the browser tab is closed.

A secure order-access cookie lets you view the protected tracking and receipt pages for your order. The order-access cookie expires after 30 days. We do not currently set advertising or product-analytics cookies.

Product analytics uses a random anonymous session reference stored only in the current tab's sessionStorage. It rotates after 30 minutes of inactivity or 24 hours from creation and normally disappears when the tab closes. It is not derived from your contact, order, cart, device, network address, or browser details, and it is not linked across tabs or later visits to create a profile. There is no product-analytics cookie and you do not need to sign in or take an extra browser action for this session reference to work.

Security

We use access controls, encrypted connections, limited operational logging, and service providers with security controls to protect personal information. No online service can guarantee absolute security, but we limit access to people and systems that need the information for the purposes described in this policy.

Access, correction, and privacy complaints

You can ask to access or correct your personal information, or make a privacy complaint, by contacting us at puravivasydney@gmail.com or +61 416 130 313. Tell us what information or concern your request relates to so we can investigate and respond within a reasonable time.