Privacy policy

Who we are

Bam Studio is a sole trader business based in Wollongong, Australia, ABN 97 582 835 200. In this policy, "we" and "us" mean that business. Email bamstudio.support@gmail.com with any question about this policy. Our contact form reaches the same inbox.

As a small business we may fall below the turnover threshold at which the Privacy Act 1988 (Cth) applies automatically. We have chosen to handle personal information in line with the Australian Privacy Principles regardless.

What we collect

• Order details: your name, email address, delivery address, phone number if you give one, what you bought, and any personalisation text (for example the letters on a name charm).
• Messages: anything you send us through our contact form or by email, including the order number you quote. A message sent through the contact form is saved in our database: your name, your email address, the topic you picked, the order number if you gave one, what you wrote, and the date it arrived.
• Asking to hear about new drops: if you give us your email address to hear about new designs, we save that address, the date you asked and which part of the site you asked from. We do not keep a name with it. There is no newsletter, so nothing is sent to it.
• Account details: if you create an account, your email address and a securely hashed password held by Supabase, the service that runs our accounts and database. We never see the password itself.
• Payment information: handled entirely by our payment processor. Card numbers are never sent to us or stored on our systems. We receive only a payment reference, the amount, and the billing name and email.
• Technical information: basic server logs such as IP address, browser type and pages requested, used to keep the site running and to spot abuse.

Why we collect it

To print, pack and post your order; to answer your questions; to process returns and refunds; to keep the business records the Australian Taxation Office requires; and, if you have asked us to, to note that you would like to hear about new designs and market dates should we start sending them.

We do not sell personal information, and we do not share it for anyone else's marketing.

Who we share it with

Only the service providers we need to run the shop, and only the information they need:

• Payment processing: Stripe, which handles the card transaction and fraud checks.
• Accounts and order records: Supabase, which stores your order history, profile and sign-in details, the messages sent through our contact form and any address given to hear about new drops, and sends the account emails described below.
• Website hosting: Fly.io, which serves these pages from its Sydney region and keeps the basic server logs above.
• Delivery: Australia Post, which receives the name and address on the parcel label.
• Email delivery: Resend, which sends our email for us and is based in the United States. It handles your order confirmation, so it sees your name, your email address, what you ordered and what you paid, and it carries a message you send us through the contact form, or a request to hear about new drops, to our own inbox. It does not use any of it for its own purposes.

We may also disclose information where the law requires it, or where it is reasonably necessary to deal with a serious safety or fraud issue.

Overseas disclosure

Some of these providers store data outside Australia, including in the United States and the European Union. By ordering, or by sending us a message or your email address through this site (both are saved with the same providers), you consent to your information being stored and processed overseas by the providers listed above.

Email we send, and marketing

We do not send marketing email. There is no newsletter: we keep the addresses that have asked to hear about new drops, and nothing is sent to them. A preference ticked in your account only records your choice, and nothing is sent. We never send dispatch, tracking, restock or review-reminder emails.

There are two kinds of email this site sends by itself. The first is about your account: confirming your email address when you sign up, and the link that resets your password when you ask for one. The second is a single order confirmation, sent to the address you gave at checkout once your payment succeeds, listing what you ordered and the total paid. Neither is marketing, and there is nothing to unsubscribe from.

There is no unsubscribe link on this site because there is nothing to unsubscribe from. If you would rather we did not keep your address, ask us using the details under "Accessing and correcting your information" below. If we ever do start a newsletter, it will only go to people who asked for it, every message will carry an unsubscribe link, and this page will be updated before the first one is sent.

Cookies

The site uses cookies and similar browser storage to keep your basket between visits, to keep you signed in if you have an account, and to complete checkout securely. You can block or clear cookies in your browser, but the basket and checkout will not work properly without them. We do not use analytics or advertising cookies.

How long we keep it

Order and payment records are kept for at least five years, which is the period Australian tax law requires. A message sent through our contact form is kept in our database, and so is an address given to hear about new drops. We have not set a period after which either is deleted, and nothing removes them on its own. They stay until we delete them by hand. You can ask us to delete yours at any time; see below.

Security

The site runs over HTTPS, payment details never touch our systems, and access to order records is restricted to the people who need it to fill orders and answer messages. Messages sent through the contact form, and addresses given to hear about new drops, are stored where only the studio's own administrative key can reach them; the key this website runs on cannot read them. No system is perfectly secure, but if a data breach ever occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner.

Messages sent through the contact form are listed on a screen in our studio that only accounts we have given access to can open (for example, someone helping us pack parcels cannot see them). An email tells us a message has arrived. If that email does not go out, your message is still saved on that screen and is seen the next time we look. We are a very small shop and nobody watches it around the clock, so a reply can take a few days.

Accessing and correcting your information

Email bamstudio.support@gmail.com to ask what we hold about you, to correct it, or to ask us to delete it. Our contact form reaches the same inbox. We will respond within a reasonable time, usually 30 days. Deleting an account is done by hand rather than by a button. See the note on the settings page. We may need to keep some records even after a deletion request where tax or consumer law requires it, and we will tell you if that applies.

Complaints

If you think we have mishandled your personal information, tell us first so we can fix it. Email bamstudio.support@gmail.com with what went wrong. Our contact form reaches the same inbox. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Children

Our products are bought by adults. We do not knowingly collect personal information from children, and we ask that anyone under 18 orders through a parent or guardian.

Changes to this policy

We will update this page when our practices change, and the date at the top will change with it.