Privacy Policy

01About this policy and who we are

This policy applies to our website at https://pokestore.com.au (the "Site") and to the orders you place with us. It explains what personal information we collect, why we collect it, who we share it with, how it may be handled overseas, and the choices and rights you have.

PokeStore is an independent, fan-run store and is not affiliated with Nintendo, The Pokémon Company or the grading companies. See our Terms of Service for the full non-affiliation and trade mark statement. Naming a service provider in this policy does not imply that provider endorses or is affiliated with PokeStore.

02What personal information we collect

We only collect what we need to run our store, fulfil your orders, and communicate with you. The personal information we collect and hold is described below.

▸Account information

There are two ways to sign in: with Google (Google sign-in) or with an email address and password. If you create an account, we hold:

• Your name
• Your email address
• Your profile image, if you sign in with Google
• A hashed (not plaintext) password, for email and password accounts only
• Your marketing preference (whether you have opted in to promotional email)

If you sign in with Google, we receive basic Google account details (your name, email address and profile image) and OAuth tokens from Google. We never see or store your Google password.

▸Order information

When you place an order, we hold:

• The email address used for the order
• Your shipping details (name and address)
• Your order history and order number
• The Stripe payment reference (a payment intent ID)
• Order totals
• Your tracking number

We never see or store your full card number. When you pay, your card details are entered directly with, and handled by, Stripe, our payment processor.

▸Guest checkout

You can check out as a guest without creating an account. In that case we collect just your email address and the order details needed to process and deliver your order. You can look up a guest order later using your order number and the email address you provided at checkout.

▸Messages you send us

If you contact us, for example by sending a support or enquiry email, we hold the information in that message, including your email address and whatever you choose to tell us.

▸Technical and server-log information

Like any website, our hosting and delivery providers process limited technical data in their server and security logs, such as:

• Your IP address
• Your browser and device type
• Access timestamps

03How and why we use your information

We only use your personal information for the purposes set out below. We do not use it for any unrelated purpose without your consent or unless permitted by law.

▸Creating and managing your account

• Set up and maintain your account if you sign in with Google or with an email address and password.
• Verify it is you when you sign in, and keep your account secure.
• Store your marketing opt-in preference.

▸Processing, fulfilling and delivering your orders

• Take and confirm your order, and process your payment securely through Stripe. Card details are entered directly with Stripe and are not seen or stored by us.
• Use your name and shipping address to pack and arrange delivery of your order.
• Share the name and address needed for delivery with the relevant shipping carrier.
• Keep your order history, order number, tracking number and order totals so you, or a guest using an order number and email, can look up an order later.

▸Sending order-related (transactional) emails

• Send you emails that are needed to handle your order, such as order confirmations, payment receipts and shipping or tracking updates.
• These emails are part of providing the service you have asked for, so we send them whether or not you have opted in to marketing.

▸Sending marketing emails (only if you opt in)

• We only send promotional or marketing emails if you have chosen to receive them. The marketing opt-in checkbox at signup is off by default, so you receive marketing only if you actively tick it.
• You can opt out at any time by using the unsubscribe link in any marketing email, or by contacting us at alvinhe9@gmail.com.
• Opting out of marketing does not stop order-related (transactional) emails, as those are needed to fulfil your order.

▸Providing customer support and handling returns

• Respond to your enquiries, help with your account or orders, and process returns, refunds or exchanges.

▸Keeping the Site secure and preventing fraud

• Use technical and server-log information, such as your IP address, browser or device type and access timestamps, only to keep the Site secure and reliable and to detect, prevent and respond to fraud, unauthorised access, misuse and other security or technical issues.
• Protect the security of your account, our Site and the people who use it.

▸Meeting our legal obligations

• Comply with our legal, tax and record-keeping obligations, including keeping transaction records for as long as the law requires.
• Establish, exercise or defend legal claims where necessary.

▸Maintaining and improving the Site

• Keep the Site running, fix problems and make improvements over time.

04Who we share your information with

We share your personal information only with the service providers we need to run the store and fulfil your orders. We require these providers to handle your information for those purposes only. The providers we use, and their roles, are:

• Google: Google sign-in (OAuth), for customers who choose to log in with their Google account.
• Stripe: secure payment processing. Your card details are entered directly with Stripe; we do not see or store your full card number.
• Resend: sending our order-related (transactional) emails and, where you have opted in, our marketing emails.
• Amazon Web Services (S3 and CloudFront CDN): hosting and delivering our product images.
• Supabase: our database, hosted in Sydney, Australia (ap-southeast-2).
• Vercel: website hosting and serverless compute; our app runs in Vercel's Sydney region.
• Shipping carriers: to deliver your order. We share the name and delivery address needed to get your parcel to you.

We may also disclose your personal information where:

• it is required or authorised by law;
• it is necessary to prevent or investigate fraud, or to protect against harm to a person or to our business; or
• it forms part of a sale, merger or restructure of the business.

We do not sell your personal information.

05Overseas disclosure (APP 8)

Our database and app compute are located in Australia (Sydney). However, some of our service providers store or process personal information overseas, or may access it from overseas for support, which means your personal information may be disclosed to, or processed by, recipients located outside Australia. The countries where overseas recipients are likely to be located are:

• Stripe: the United States.
• Google: the United States.
• Resend: Japan.
• Amazon Web Services: product images are stored in the Sydney region (ap-southeast-2) and served through a global content delivery network, so cached copies may be held at edge locations worldwide.
• Vercel: our compute runs in Vercel's Sydney region, but Vercel's control plane, support and logging are based in the United States.

Where we disclose your personal information to overseas recipients, we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles, and we remain accountable for how these providers handle your information.

06Cookies and browser storage

We keep our use of cookies and browser storage to the minimum needed to run the Site. We do not use any tracking, analytics or advertising technology.

▸A strictly-necessary sign-in cookie

When you sign in, our authentication system sets a session cookie in your browser. This cookie is what keeps you logged in as you move around the Site. It is strictly necessary for the sign-in feature to work, and we do not use it to track you across other websites.

▸Limited browser storage during your visit

We use a small amount of browser storage (sessionStorage) to remember things like your place on a page and basic navigation while you are visiting. This information stays in your own browser, is cleared when you close the tab or browser, and is not used to build a tracking profile of you.

▸What we do not use

• We don't use third-party analytics cookies. There is no Google Analytics or any similar tool.
• We don't use advertising, marketing or retargeting cookies, ad trackers or tags.
• We don't use cross-site tracking cookies or tracking pixels, including no Facebook/Meta pixel.

▸Managing cookies and storage

Your browser lets you block or clear cookies and browser storage at any time, usually through its settings or privacy menu. If you block or clear the strictly-necessary sign-in cookie, you may not be able to stay signed in to your account.

07How we protect your personal information

We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

• Card details: we never see or store your full card number. Card payments are entered directly with, and handled by, Stripe.
• Passwords: if you have an email and password account, your password is stored in a hashed form, not as plain text.
• Encryption in transit: information sent between your browser and our Site is encrypted in transit.
• Limited access: access to personal information is limited to what is needed to run the store and fulfil your orders.
• Reputable providers: we use reputable, established service providers to host our Site, store our data and process payments.

No way of sending information over the internet or storing it electronically is completely secure, so while we work to protect your personal information we cannot guarantee absolute security.

08How long we keep your personal information

We keep your personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law. For example, we keep order and transaction records for the period required by Australian tax and record-keeping laws.

When we no longer need your personal information, we take reasonable steps to delete it or to de-identify it so it can no longer be linked to you.

09Accessing and correcting your personal information

You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

• To make a request, contact us at alvinhe9@gmail.com. We may need to verify your identity before we act on your request.
• We will respond within a reasonable time, usually within 30 days, and we will not charge you for making a request.
• If we cannot give you access or make a correction, we will let you know the reasons in writing.
• If we refuse to correct your information, you can ask us to attach a statement noting that you consider it inaccurate, out of date, incomplete, irrelevant or misleading, and we will take reasonable steps to do so.
• If we have disclosed information that we later correct, you can ask us to notify the third parties we shared it with, and we will take reasonable steps to do so.

If you are not satisfied with our decision on an access or correction request, you can make a complaint as described in the Complaints section below.

10Opting out of marketing

We only send marketing or promotional emails if you have opted in. You can opt out at any time:

• Use the unsubscribe link in any marketing email, or
• Contact us at alvinhe9@gmail.com.

Opting out of marketing does not stop order-related (transactional) emails, such as order confirmations and shipping updates, because we need to send these to fulfil your order.

11Complaints

If you have a concern about how we have handled your personal information, please contact us first at alvinhe9@gmail.com so we can try to resolve it. We will acknowledge your complaint promptly and aim to respond within 30 days.

If you are not satisfied with our response, you can make a complaint to the Office of the Australian Information Commissioner (OAIC). You can reach the OAIC through its website at https://www.oaic.gov.au or by phone on 1300 363 992.

12Children and under-18s

Our store is intended for customers aged 18 and over. If you are under 18, you may use PokeStore and provide personal information only with the consent and supervision of a parent or guardian, who agrees to our Terms of Service on your behalf, consistent with those Terms.

We do not knowingly collect personal information from children without parental involvement. If you believe we have collected a child's personal information without the necessary consent, please contact us at alvinhe9@gmail.com and we will take reasonable steps to delete it.

13Changes to this policy

We may update this Privacy Policy from time to time. If we make changes, we will post the updated version on this page and update the "last updated" date at the top. That date tells you when the current version took effect, and the version shown on this page is the one that applies. We encourage you to review this policy periodically.

If we propose to use or disclose personal information we already hold for a materially different purpose, we will seek your consent or otherwise comply with the Privacy Act before doing so.

14Contact us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us at alvinhe9@gmail.com.