Legal

Privacy policy

Effective date: [Effective date]

Draft for review. Placeholders in square brackets are still to be confirmed.

We collect as little as we need to run VELLUM. This page explains what we collect, why, who we share it with, and how you can ask us about it.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Who we are

vellum.au is run by Vellum Skincare (ABN [ABN]) of [Business address]. In this policy, “we” and “us” mean Vellum Skincare.

What we collect

When you place an order

Your name, email address, phone number, delivery address and, where it’s needed, a billing address, plus the products you order. You enter these on a checkout page hosted by Stripe. Stripe handles your payment details. Your card number never reaches us or our website. We receive your order details so we can pack and send your order.

When you write to us

If you use the contact form, we collect your name, email address, your message and the topic you choose. If you email us, we collect your email address and whatever you tell us.

When you join Letters on aftercare

Your email address.

When you visit the site

We use Plausible for simple analytics. It doesn’t use cookies and doesn’t collect personal information about you. It tells us totals, such as which pages are read and where visits come from.

Like any website, our host processes technical information, such as an IP address and browser type, to deliver pages and keep the site running. We also use IP addresses briefly to limit spam on our forms.

Why we collect it

To take payment, pack and send your order, and send you order emails.
To answer your messages and questions.
To send Letters on aftercare, but only if you have signed up.
To keep the records the law requires, such as tax records.
To understand how the site is used, so we can improve it.
To protect the site and our forms from spam and misuse.

We don’t sell your personal information, and we don’t share it for advertising.

We share information only with the people who help us run VELLUM, and only what they need to do their job.

Stripe takes payments and hosts our checkout.
Resend sends our emails: order confirmations, contact form messages and Letters on aftercare. It also holds the newsletter list.
[Hosting provider] hosts the website and our email inbox.
Plausible provides cookie-free analytics, with no personal information.
[Carrier] delivers your order, so it receives your name, delivery address and contact details.
Amazon, only if you order VELLUM on Amazon AU. Amazon looks after that order, and its own privacy notice applies.
Our accountant and other professional advisers where we need them, and government agencies or others where the law requires.

Sending information overseas

Some of these providers store or process information outside Australia, for example in the United States or the European Union. That can include Stripe, Resend and Plausible.

We use established providers with published privacy commitments, and we take reasonable steps to make sure they handle your information in line with the Australian Privacy Principles. You can read their policies: Stripe, Resend and Plausible.

Cookies and browser storage

We don’t use advertising or tracking cookies, and there is no cookie banner. Two small things are stored in your own browser, because the site needs them to work:

Your bag. We save the items and quantities in your bag in your browser’s local storage, so they’re still there if you leave and come back. It stays in your browser. You can clear it by emptying your bag or clearing your browser’s site data.
The intro. Your browser’s session storage remembers that the opening animation has already played, so you don’t see it again during the same visit. It’s cleared when you close the tab.

Stripe’s checkout page is hosted by Stripe, and it may use its own cookies for payments and to guard against fraud. Stripe’s privacy policy explains how.

How long we keep it

Orders and payments: for as long as Australian tax and business record-keeping laws require, which is generally five years.
Messages: for as long as we need them to answer you and keep a record of the conversation. Then we delete them.
Letters on aftercare: until you unsubscribe.
Analytics: Plausible holds no personal information about you.

Keeping your information safe

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. The site uses encrypted (HTTPS) connections, card payments are handled by Stripe, and we keep only what we need.

If a data breach is likely to cause serious harm, we’ll tell the people affected and the Office of the Australian Information Commissioner, as the law requires.

Access and correction

You can ask to see the personal information we hold about you, or ask us to correct it. Email hello@vellum.au. We may need to confirm who you are first. We aim to reply within 30 days. If we can’t give you access, we’ll tell you why in writing.

Unsubscribing

We send Letters on aftercare only to people who have signed up. Unsubscribe at any time using the link in any issue, or email us and we’ll remove you. Order emails, such as confirmations, aren’t marketing, and are sent as part of your order.

Complaints

If you think we’ve mishandled your personal information, email hello@vellum.au with the details. We’ll look into it and reply in writing. If you’re not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Changes to this policy

We may update this policy. The latest version is always on this page, with its effective date.

Contact

Questions about privacy? Email hello@vellum.au. See also our terms of sale and our FAQ.

Business: Vellum Skincare
ABN: [ABN]
Address: [Business address]
Effective date: [Effective date]