Privacy policy
This describes what this site actually collects, which is less than most. It was written by reading the code rather than by copying a template, so everything below is something the site really does.
There is no tracking on this site
No Google Analytics, no advertising pixel, no session recorder, no heatmap, no third party tracker of any kind. The site sets no advertising or analytics cookies. That is not a promise about the future, it is a description of the code that builds this page today.
What we collect when you buy
Your email address, your name, the country you are shipping to, what you ordered, what you paid, and the identifiers Stripe gives us for the payment and any subscription. We keep this because it is the order, and because we need it to send the parcel and to handle a refund.
What we never see
Your card number, expiry and security code. Those go straight to Stripe and never touch this site. We can see the last four digits and the card brand through Stripe, the same as you can.
Signing in
The account area sends a six digit code to your email instead of using a password. We store a one way hash of that code, never the digits, along with when it was sent so the same address cannot be used to send hundreds of them. A successful sign in creates a session token that expires.
If you submit a review
We store the name, rating and text you wrote, your email if you gave one, and a one way hash of your IP address. The hash is only ever compared with itself to stop one person flooding the form. The plain address is not stored, because it would be of no use to us and a liability to keep.
If you enter your email in the discount popup
It is stored so the discount can be attached to your order. We do not add you to a mailing list from that box.
Who else touches your data
Stripe processes payments. Cloudflare hosts the site and the database. An email provider sends order confirmations and sign in codes. Each of them only receives what they need to do that job. We do not sell your data to anybody, and we do not share it for advertising.
Where it is stored
In a Cloudflare database. Cloudflare and Stripe both operate internationally, so your information may be stored or processed outside New Zealand. Both are bound by their own privacy obligations to protect it.
How long we keep it
Order records are kept while we may still need them for tax, accounting and warranty, which in New Zealand means at least seven years. Sign in codes expire in minutes. Sessions expire. Reviews we decline to publish are deleted.
Your rights over it
Under the Privacy Act 2020 you can ask what we hold about you and ask us to correct it. Write to [email protected] and we will answer within twenty working days. You can ask us to delete your data, and we will unless we are legally required to keep the order record.
Cookies
The site uses only what it needs to work: your cart, and your sign in session if you have one. There is no advertising cookie and no cross site tracking, which is why this site has no cookie banner asking you to accept any.
A complaint
Write to us first at [email protected]. If we do not sort it out, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Contact
Silka, 129 Eglon Street, Parnell, Auckland, New Zealand. [email protected]