Privacy Policy

This policy explains what personal information FAIRLY GROUP PTY LTD (ACN 701 371 575) ("FairlyCart", "we", "us") collects when you use fairlycart.com.au or the FairlyCart iOS app, why we collect it, who we share it with, how long we keep it, and the choices you have — in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

FairlyCart operates a marketplace connecting shoppers with local Indian and Asian grocery stores in Melbourne. Each store is the seller of the groceries in your order; FairlyCart provides the platform, checkout, payment processing and customer support.

What we collect

• Contact details you give us — name, email address and phone number — when you check out (as a guest or with an account), create an account, or contact us.
• Account details, if you create an account — your email address, a password (stored only as a hash by our sign-in provider, Clerk), or the identity Google or Apple gives us if you use "Continue with Google" or "Sign in with Apple". Apple lets you hide your real email address; if you do, we only ever see the relay address.
• Delivery details — the address you enter, its suburb and postcode, and the map coordinates our address lookup returns for it, so the store can check you are inside its delivery area.
• Device location, only if you tap "Use my current location" and allow location access. In the iOS app your coordinates are used on your device to sort nearby stores and are not stored on our servers. On the website your approximate location is used to find nearby stores. You can always type a suburb or address instead.
• Order details — items purchased, order value, delivery or pickup preferences, substitution preferences, promo codes used, and the 4-digit delivery PIN for store-delivered orders.
• Payment information, handled directly by our payment processor, Stripe. Card details are entered into Stripe's secure form and never reach FairlyCart's servers; we store only a payment reference, amount and status.
• Saved preferences, if you have an account — saved addresses, shopping lists and your marketing email preference.
• Store and merchant details, if you register or operate a store on FairlyCart — business name, ABN, contact details, banking and identity details (collected by Stripe Connect), and catalogue information.
• Communications you send us — support requests, store requests, partner enquiries, dispute correspondence and privacy requests.
• Device and usage data — on the website, pages visited, referral source, approximate location inferred from IP address, and interactions, collected via cookies and analytics (see "Cookies and analytics"). In the iOS app, a device identifier (Apple's "identifier for vendor"), app version and iOS version are sent to our sign-in and payment providers so they can secure your session and detect fraud. The app does not track you across other companies' apps or websites and contains no advertising SDKs.

How we use it

• To process and fulfil your order, including passing your name, phone number, delivery address and order contents to the store fulfilling it, and to the person delivering it.
• To send transactional messages about your order — confirmations, status updates, delivery PINs and receipts — by email and SMS. These are part of the service you ordered and are sent whether or not you have opted in to marketing.
• To operate accounts, saved addresses, shopping lists, order history and store dashboards.
• To send promotional email (offers, new stores) only if you have expressly opted in. See "Marketing communications" below.
• To detect and prevent fraud, abuse of promotional offers, and misuse of the platform, including rate limiting by hashed IP address.
• To improve the service, understand how it is used, and troubleshoot problems.
• To respond to support, complaints and privacy requests.
• To meet legal, tax and accounting obligations.

We do not sell your personal information, and we do not share it for advertising.

Marketing communications

Promotional email is separate from order messages and is off by default. We only send it if you switch it on in your account (website or app), and we record when and where you did. Every promotional email includes a one-click unsubscribe link that works without signing in and takes effect immediately (the Spam Act 2003 requires within 5 business days). You can also change the setting in your account at any time. We do not send promotional SMS. Withdrawing marketing consent does not affect the transactional messages needed to complete an order you have placed.

Cookies and analytics

On the website we use cookies and similar technologies (such as local storage) to keep you signed in, remember your cart and delivery location, and understand how FairlyCart is used so we can improve it. This includes product analytics (PostHog), Google Analytics and Google Maps (for address search). For details on specific cookies, retention periods and how to control them, see our Cookie Policy. The iOS app does not use cookies or third-party analytics; the only usage data it produces is the checkout and order events recorded by our own servers, associated with your account if you are signed in.

Who we share it with

We share the minimum information needed to fulfil your order with the local store you are buying from: your name, phone number, delivery address or collection choice, delivery window, order contents and any notes. The store uses it only to prepare and deliver or hand over your order. We also share information with service providers who help us run FairlyCart, currently:

• Clerk — account sign-in, sessions and password security (United States).
• Apple and Google — only if you choose to sign in with them; they tell us your name and email (or Apple relay address) and nothing about your orders.
• Stripe — payment processing, receipts, fraud prevention and, for merchants, payouts and identity verification (United States and other countries).
• Supabase — our database and file storage, hosted in Supabase's Tokyo, Japan region.
• Vercel — hosting of the website and the servers the app talks to (United States and global edge locations).
• Resend — email delivery (United States).
• Twilio — SMS delivery for order updates (United States).
• Google — Maps/Places address lookup and, on the website, analytics (United States).
• PostHog — product analytics for the website and server-side order events (United States).

These providers may only use your information to deliver their service to us, are bound by their own privacy and security commitments, and must give your information the same level of protection this policy describes. We may also disclose information where required by law, to enforce our terms, or to protect the rights, property or safety of FairlyCart, our users or the public.

Overseas disclosure

Our database is hosted in Japan, and the providers listed above process data in the United States and other countries, so using FairlyCart involves disclosing your personal information overseas. Before we do, we take reasonable steps to ensure the recipient handles it in line with the Australian Privacy Principles, relying on the provider's security certifications and contractual commitments.

Security

Data is encrypted in transit, stored with providers that apply industry-standard controls, and protected by row-level access rules so a store can only see its own orders and a customer only their own. Delivery PINs are stored as salted hashes. Access to customer and order data within FairlyCart is limited to team members who need it to operate the service. No method of transmission or storage is completely secure; if a data breach is likely to cause serious harm we will notify you and the OAIC as the Notifiable Data Breaches scheme requires.

How long we keep it

• Account and saved details (profile, addresses, lists, marketing preference) — until you delete your account.
• Orders — 5 years from the end of the financial year in which the order was placed, as required for tax records, then deleted. If you delete your account, your name, email, phone, street address and location are removed from your orders immediately and only the anonymised order record is kept.
• Payment records — held by Stripe under its own retention obligations; FairlyCart keeps only the payment reference with the order.
• Transactional email and SMS delivery logs — kept by Resend and Twilio for up to 90 days for troubleshooting, then purged.
• Checkout retry data — 24 hours.
• Rate-limiting records — stored as one-way hashes and expire within days.
• Support correspondence — 2 years after the matter is closed.
• Deletion audit — a one-way hash of your former account id and the date, kept for 7 years to prove the deletion occurred.

Deleting your account

If you have an account you can delete it yourself from Account → Delete accounton the website or in the iOS app. We tell you exactly what will be removed and what we must keep before you confirm, ask you to re-enter your password (or sign in again with Apple or Google), and then delete your login, saved details and analytics profile and anonymise your orders immediately. You are signed out on every device. If you signed in with Apple, we also revoke FairlyCart's access in your Apple ID settings. Orders still being prepared or delivered must finish first so the store can complete them; refunds are unaffected because they go back to the original payment method. Guest orders are not linked to an account; to have your details removed from a guest order, contact us.

Your rights and how to make a privacy complaint

You can ask us what personal information we hold about you, request a correction, or ask us to delete it, subject to what we are legally required to keep. Make a request via the Contact page or by emailing admin@fairlycart.com.au; we will verify your identity and respond within 30 days. If you believe we have mishandled your personal information, lodge a complaint the same way including your name, contact details and a description of the issue. We will acknowledge it and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).

Children

FairlyCart is not directed at children, and we don't knowingly collect personal information from anyone under 18 without the consent of a parent or guardian.

Changes to this policy

As we add features or change providers, this policy will be updated to reflect them — the "updated" date above always shows the latest revision. Material changes will be highlighted on this page and in the app.

Contact

Privacy questions or requests: email admin@fairlycart.com.au, call 0475 926 578, or use the Contact page.