What we collect, why we collect it, and how to ask us to stop.

When you place an order we collect your name, email address, shipping address, and the contents of that order. Stripe, our payments processor, collects your payment-card details and returns us a reference token. We never see or store the card itself.

When you browse the site without signing in we collect anonymous page-view data (the page you visited, the page that referred you, a randomly-generated session id, your approximate location from IP, and your user-agent string) to understand what people read and to catch errors. This data is not linked to an identity unless you later place an order.

When you sign in (for account-based order history) we handle your email address via Supabase Auth and a sign-in token stored in your browser. No password is ever collected or stored. We use magic-link sign-in only.

We use a small number of service providers to actually operate the shop. Each one sees only the subset of your data that they need to do their job:

• Stripe. Payment processing. Handles card details and processes refunds. Their privacy policy applies to what they hold.
• Printify. Print fulfillment. Receives your name, shipping address, and the items on your order so production partners can print and ship them. Their privacy policy and their production partners’ policies apply to that data downstream.
• Resend. Transactional email (order confirmations, shipping notifications). Receives your email address and the contents of each message.
• Supabase. Database hosting. Our order data, account data, and anonymous analytics live on their infrastructure. They are our data processor, not an independent controller.

We do not sell your information. We do not share it with advertisers or data brokers. If we ever change that, we will re-post this policy and email everyone with an account.

Order records (name, email, shipping address, what was ordered, what was paid) are retained for seven years after the order date. This matches the Australian tax-record retention obligation. You can ask for earlier deletion, but where we are legally required to keep the record we will say so.

Anonymous analytics events are retained for one year and then deleted. Cancelled and abandoned checkout data is retained for 90 days and then deleted.

You can at any time ask us to show you the personal information we hold about you, correct any of it, export it in a machine-readable format, or delete it (with the tax-record exception noted above). Residents of the EU, UK, and California have these rights by statute under GDPR, UK GDPR, and CCPA/CPRA respectively. We extend the same rights to everyone else by policy.

To exercise any of these rights, email cannyrecollection@threeeyedemu.com.au from the address on your order. We respond within 30 days.

If you are dissatisfied with how we handle a request, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. EU and UK residents can complain to their national data protection authority.

We use strictly-necessary cookies to keep you signed in to your account and to remember the contents of your cart between sessions. We do not run advertising tracking, cross-site tracking pixels, or third-party analytics like Google Analytics or Facebook Pixel.

We will update this page when our practices change. For material changes (particularly ones that affect what data we collect or who we share it with), we will email everyone with an account at least 14 days before the new policy takes effect. The date at the top of this page will always reflect the last time we changed anything substantive.

cannyrecollection@threeeyedemu.com.au for privacy queries, access requests, or anything else. A postal address is available on request by email.