Account · Australian Privacy Principles
Privacy policy
Privacy & your data
What we hold, why, for how long — and the three buttons that give you control
What we hold about you
| Category | Examples | Why | Kept |
|---|---|---|---|
| Identity | Name, email, mobile, pronouns, birthday | Orders, delivery SMS, 2FA, birthday credit | Until deletion + 30 days |
| Orders & returns | 14 orders, 4 returns, QC notes | Service, warranties, ACL claims | 7 years (ATO) for invoices; 3 years for return records |
| Payments | Stripe tokens pm_…, last4, expiry | Charges & refunds | Stripe retention; never full card numbers |
| Content you write | 3 reviews, 2 questions, 1 dispute | Public Q&A / reviews you chose to publish | Anonymised on deletion, not erased (public threads) |
| Device & security | Sessions, login history, 2FA methods | Account protection | 12 months rolling |
Export my data
JSON + CSV, human-readable, everything in the table above.
Last export: 2 Jun 2026 · 41 KB
Ready within 24h, link valid 7 days
Correct something
Wrong name on an invoice, old address, mis-gendered pronoun — fixed same day.
APP 13 right; we confirm by email once done
Edit profileInvoices re-issue with a correction note, original kept for tax law
Delete my data
Erases identity, addresses, wallets and history after the legal hold periods.
Blocked while orders or returns are open — you have 2 right now
Close & delete30-day cool-off: change your mind and we restore everything
Cookies & tracking, right now
Essential — cart, session, fraud checks
Cannot be switched off; without these checkout breaks
Analytics — anonymous usage stats
Currently sharing: yes
Personalisation — recommendations & personalised offers
Currently sharing: no (you declined at the banner on 11 Sep)
Questions or complaints: privacy@apexcommerce.example.com.au · we answer within 5 business days · unresolved complaints can go to the OAIC (oaic.gov.au) — we'll even link the form.