Privacy policy

Who we are

Fresh Sale is an online clothing retailer operated by Fresh Sale. We are the entity responsible for the personal information described here, and we can be reached at support@freshsale.store.

This policy covers this website and the emails we send about your orders. It does not cover other websites we link to, which have their own policies.

What we collect

We collect only what an order or a conversation actually requires:

• Contact details — your name, email address and, if you give it to us, a phone number for delivery questions.
• Addresses — the shipping address for your order and the billing address attached to your payment.
• Order history — what you bought, when, what you paid, the status of the order, and the tracking number of the parcel.
• Account details — if you create an account, your email address and a securely hashed password, held by our authentication provider. We never see your password.
• Messages — anything you send through the contact form or by email, including your order number if you quote one.
• Technical information — your IP address and basic browser information, used to rate-limit forms and to detect abuse.

We do not ask for your date of birth, your gender, your income or any other information a clothing order does not need, and we do not buy customer data from anyone.

How we use it

• To take payment for, pack, dispatch and deliver your order.
• To send transactional email — order confirmations, dispatch and tracking notices, refund confirmations.
• To answer your messages and handle returns and warranty claims.
• To keep records we are required by law to keep, principally for tax purposes.
• To detect and prevent fraud, spam and abuse of this site.

We do not send marketing email unless you have asked us to, and we never sell or rent your personal information to anyone.

Payments and card details

Payments are processed by Stripe. Your card number, expiry date and security code are never stored by us, and never reach our servers. They are entered directly into payment fields hosted by Stripe and are transmitted to Stripe, who are certified to the PCI DSS standard for handling card data.

What we keep against your order is Stripe’s payment reference and the status of the payment. That is enough for us to confirm you paid and to issue a refund, and not enough to charge your card again. Stripe handles your card information under its own privacy policy.

Cookies and your cart

We use a small number of cookies and similar storage, all functional:

• Session cookies set by our authentication provider, which keep you signed in while you browse. Sign out and they are cleared.
• Your cart, which is stored in your own browser’s local storage rather than on our servers. It stays on your device and is only sent to us when you go to checkout — and even then, the server re-prices everything from our own catalogue rather than trusting what the browser sends.
• Stripe’s cookies on the checkout page, which Stripe uses for fraud prevention.

There are no advertising cookies, no third-party trackers and no cross-site profiling on this site. You can clear cookies and local storage from your browser at any time; doing so will sign you out and empty your cart.

Where your data is stored

Orders, accounts and messages are stored in a Postgres database hosted by Supabase, our database and authentication provider, with access controlled by row-level security rules so that a customer can read their own records and nobody else’s.

Some of our providers — Supabase, Stripe and our email and hosting providers — operate infrastructure or support teams outside Australia, so your information may be stored or accessed overseas. Where that happens we take reasonable steps, as required by Australian Privacy Principle 8, to ensure the recipient handles your information consistently with the Australian Privacy Principles.

Who we share it with

Only the parties needed to complete your order:

• Stripe — to take payment and process refunds.
• Supabase — to store order, account and message records.
• Our suppliers and delivery carriers — your name, delivery address and phone number, so a parcel can be addressed and delivered.
• Our email provider — to send order and reply emails.
• Regulators, or where the law requires it — for example a valid request from a law-enforcement agency, or our accountants and auditors under confidentiality.

How long we keep it

• Order and payment records: seven years, which is the period Australian tax law requires us to retain financial records.
• Contact messages: until the matter is resolved, then cleared periodically.
• Account details: for as long as your account exists, plus the retention period above for orders already placed.

Access, correction and deletion

You can ask us what personal information we hold about you, ask us to correct it if it is wrong, or ask us to delete it. Email support@freshsale.store from the address on your account or order, and tell us what you want.

We will respond within 30 days. We may need to verify your identity first — usually by confirming details of a recent order — because handing your order history to whoever asks for it would be the opposite of protecting it.

If you ask us to delete your data we will remove your account and your marketing preferences. We must keep the financial record of completed orders for the seven-year period described above; where that applies we will tell you exactly what has been retained and why. If we cannot give you access to something, we will explain the reason in writing.

If you have an account, you can also see and update your own details and addresses under your account at any time.

Security

The site is served over HTTPS, so traffic between your browser and us is encrypted in transit. Administrative access to the database is limited to the store owner, database rules restrict what any one account can read, and payment data is out of our hands entirely by design.

No system is perfect. If we ever become aware of a data breach likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Privacy Principles and complaints

We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

If you think we have mishandled your information, email support@freshsale.store with “Privacy complaint” in the subject line. We will acknowledge it within five business days and give you a written response within 30 days. If you are not satisfied with our response, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We will update this page if our practices change, and the “last updated” date at the top will change with it. Material changes will be flagged on the site. The version published when you place an order is the one that applies to that order.