Privacy

• When you order: your name, email, delivery address, shipping choice and what you bought. We need this to take the order, make the right thing and get it to you.
• When you message us: whatever you put in the contact or custom-print form: your name, email and message, plus the project type and colour you pick on the custom form.
• Automatically: standard web server logs kept by our host, including IP address and browser type. We do not run advertising trackers, we do not use cookies to profile you, and there is no third-party analytics on this site.

Your cart is stored in your own browser using local storage, not on our servers. Clearing your browser data clears it, and we never see it unless you check out.

We never receive them. Payment is handled by Stripe, and card details are entered on Stripe's own systems rather than ours. What comes back to us is the payment status and the customer, delivery and order information needed to fulfil the purchase. Our website server does not receive or store your full card number.

We use your information to fulfil the order you placed, to contact you about that order, and to keep the business records the tax law requires us to keep. That is the whole list.

We will only send you marketing email if you have asked for it. Every such email will say who it is from and will have a working unsubscribe link, and using it takes effect immediately. Order confirmations, dispatch notices and delivery updates are not marketing and will still be sent, because you need them.

Only the services needed to run the shop. Each receives the information needed for its role, and each handles it under its own agreement and privacy terms.

Some of these store data outside Australia, which is normal for online services and is noted above so you can see exactly where. We will also disclose information if the law actually requires it, and not otherwise.

Order records are kept for five years, because Australian tax law requires it. Contact form messages are kept while they are useful and then deleted. If you ask us to delete something we are not legally required to keep, we will.

Email ethan@arrowhit.xyz and ask. You can request a copy of what we hold about you, correct anything wrong, or ask us to delete it. We will respond within 30 days and there is no charge.

We will need to be reasonably sure you are who you say you are before handing over personal information, which protects you rather than us.

The site is served over HTTPS on every page. Payment happens on Stripe's infrastructure. Access to the services that hold order information is restricted to the accounts needed to operate the shop. Full delivery details and print specifications are not deliberately copied into general website logs. We also collect as little as we need, which reduces the information at risk.

If a breach ever occurs that is likely to cause you serious harm, we will tell you, and we will tell you what actually happened rather than a sanitised version. We will notify the Office of the Australian Information Commissioner as well, even though as a small business we are not currently obliged to.

Some of what we make appeals to kids, but this shop is intended for adults to buy from. We do not knowingly collect information from anyone under 16. If you believe a child has given us their details, email us and we will delete them.

Raise it with us first, at the address above, and we will take it seriously. We are a small business, and small businesses are generally exempt from the Privacy Act, but we have chosen to handle your information as though the Australian Privacy Principles applied to us.

If you are not satisfied with how we respond, you can raise it with the Office of the Australian Information Commissioner at oaic.gov.au, who will tell you what they are able to do.