Privacy policy

We sell products people are entitled to buy privately. That shapes how this policy is written: we collect as little as we can, we tell you who receives it, and we never treat what you bought as an advertising asset.

We do not sell, rent or trade your personal information to anyone, for any purpose. We share it only as set out in clause 06.

We take reasonable steps to keep your personal information accurate, secure, and handled in line with this policy and the Australian Privacy Principles.

You can browse the Website without telling us anything about yourself, and you can complete an order as a guest without creating an account. A guest order still needs a name, delivery address, email and payment details, because a parcel cannot be delivered or a payment taken without them.

Where we can deal with you anonymously or under a pseudonym, we will. Marketing, reviews and support enquiries do not require your real name.

We collect only what an order, an account or an enquiry actually needs:

• Contact and delivery details — name, delivery and billing address, email address, and a phone number where a courier requires one.
• Order information — what you bought, when, order history, and delivery preferences.
• Payment information — processed by Stripe. Card numbers are entered directly into Stripe and never reach or rest on our servers. We retain only the last four digits, the card type and Stripe’s transaction reference, so we can match a refund to a payment. Stripe is sent the amount to charge, not the contents of your order — see clause 06.
• Website usage data — IP address, browser and device type, and pages visited, collected through cookies and analytics as described in clause 11.
• Communications — what you write to us, and our replies.

We do not collect date of birth, gender, government identifiers, or any health information. Age is confirmed by your own declaration that you are 18 or over, not by documents.

What you buy from us can reveal things about your sexual orientation or your health. Whether or not a given purchase meets the legal definition of “sensitive information” under the Privacy Act, we treat your entire purchase history as though it does.

In practice that means: it is never used for advertising or profiling, never disclosed to anyone outside the list in clause 06, never used in a case study or testimonial without your separate written consent, and visible internally only to staff handling your order or support request.

We collect it because we cannot fulfil an order without knowing what is in it. We do not collect preferences, interests or intentions beyond what you actually order.

Directly from you, when you order, create an account, subscribe, leave a review, or contact us.

Automatically, through cookies and analytics when you use the Website — see clause 11.

From our service providers, limited to what their service produces: a payment result and fraud signals from Stripe, a delivery status from the carrier. We do not buy or enrich data about you from third parties.

We disclose personal information only to the recipients listed on this page, and only the minimum each one needs:

• Stripe — payment processing, refunds and payment-fraud screening. Stripe receives the amount to charge, your name, email and billing address, and the card itself. It is not sent your basket: no product names, no categories, no quantities. Where a payment is disputed we may have to describe the goods to defend the chargeback, and we would do that for that order alone.
• Our delivery partner, currently Australia Post — your name, delivery address and a contact detail for the label and any delivery notification. The carrier is not told what is in the parcel.
• Our hosting, email and analytics providers — as a technical consequence of running the Website and sending order emails.
• Fraud prevention services and our payment provider — where we reasonably suspect fraud, we may disclose the order value, the payment method, the IP address used and the delivery address, for the sole purpose of assessing that risk. Still not the basket: no product names, categories or quantities.
• Legal and regulatory bodies — where we are required by law, by a court order, or where disclosure is necessary to prevent a serious threat to someone’s life, health or safety.
• A buyer of the business — if the business is sold or merged, under confidentiality obligations and on terms no less protective than this policy. We would notify you before your information transferred.

Each provider is bound by contract to use the information only for the service it supplies to us. Anonymised, aggregated figures — such as total orders in a month — may be used for internal reporting, and cannot be traced back to you.

We will never sell, rent, licence or trade your personal information to a third party for any purpose, including marketing, advertising, audience building or data brokering. This is not a current practice we might revise — if it ever changed, it would be a material change under clause 17 and you would be told before it took effect, not after.

Our own records — accounts, orders and correspondence — are held on servers located in Australia.

Some of our providers process data overseas. Stripe processes payment data in the United States and Ireland; our analytics and email providers may process usage data and email addresses in the United States. Clause 09 explains the safeguards that apply.

We keep personal information only as long as we need it:

• Order and tax records — 7 years from the transaction, as Australian tax and consumer law requires. This period cannot be shortened on request.
• Account data — for as long as your account is open. Accounts inactive for 2 years are deleted, and we email you before that happens.
• Support correspondence — 2 years from the last message.
• Marketing consent records — for as long as you are subscribed, plus 2 years, so we can show we had your consent.
• Website usage data — 26 months, then deleted or fully anonymised.

When a retention period ends, information is deleted or irreversibly anonymised. Where you ask us to delete something we are legally required to keep, we will delete everything we can and tell you exactly what remains and why.

Before we use a provider that processes data outside Australia, we satisfy ourselves that it is bound by obligations at least equivalent to the Australian Privacy Principles, through its contract with us and its own compliance certifications.

The countries currently involved are the United States and Ireland. We will update this clause if that changes.

We do not transfer data overseas for any purpose other than operating the Website, taking payment and sending order email.

The Website runs over encrypted connections throughout. Card details are entered directly into Stripe, which is PCI-DSS compliant, so we never hold them. Access to order and account records is limited to staff who need it, and is logged.

No transmission over the internet can be guaranteed completely secure, and we do not pretend otherwise. What we can commit to is that a failure on our side is ours to fix: if a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires, and we will tell you what happened rather than the minimum we can get away with.

Your account password protects your order history, which for our products is worth protecting. Keep it to yourself, and use one you have not used elsewhere.

We use cookies and similar technologies for four purposes only: keeping you signed in and your cart intact, remembering preferences you set, measuring how the Website performs, and protecting checkout against fraud.

We set no advertising, retargeting or cross-site tracking cookies, and we do not install third-party advertising pixels. Nothing you view or buy here is used to target you on another website.

You can refuse or clear non-essential cookies through the banner shown on your first visit or in your browser settings. Essential cookies cannot be refused without breaking sign-in and checkout; if you block them, the Website will not work.

Analytics data is collected in a form that does not identify you individually where that is achievable, and is not combined with your order history.

Orders are dispatched in plain, unmarked outer packaging with nothing on the exterior indicating the contents or our trading name, and no invoice enclosed.

Parcels carry a neutral sender name so they can be returned if undeliverable, and card statements show a neutral descriptor. We do not publish either wording on this page — a name printed on a public page stops being discreet. Both are confirmed to you at checkout and in your order confirmation.

The information given to a carrier is limited to what is needed to deliver a parcel: your name, address and a contact detail. The carrier is never told what the parcel contains.

We send marketing email only if you have opted in. Ordering from us does not opt you in, and there is no pre-ticked box at checkout.

Every marketing email carries a one-click unsubscribe. It takes effect immediately, and unsubscribing never affects order or delivery emails, which are not marketing and continue regardless.

We do not use your purchase history to choose what marketing you receive, and we do not disclose your details to anyone else for their marketing.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you may ask us to give you a copy of the personal information we hold about you, correct anything inaccurate or incomplete, delete it, stop using it for a particular purpose while a dispute is resolved, or stop marketing to you.

Send requests to privacy@vibeon.com.au. We acknowledge within 5 business days and answer within 30 days. Access and correction are free; we do not charge for any request under this clause.

We may need to verify your identity before acting, so that nobody else can obtain your order history by asking. We will request the minimum needed to do that and will not retain it.

If we refuse a request in whole or in part, we will tell you in writing which part, the reason, and how to complain about that decision.

If you believe we have mishandled your personal information, write to privacy@vibeon.com.au. We will acknowledge within 5 business days and give you a written response within 30 days.

If you are not satisfied with our response, or we fail to respond, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au, by phone on 1300 363 992, or in writing to GPO Box 5218, Sydney NSW 2001.

You are not required to complain to us before going to the Commissioner, and nothing in this policy limits your rights under the Privacy Act.

The Website is not directed at anyone under 18, and we do not knowingly collect personal information from anyone under 18. Orders are cancelled where we have reason to believe the purchaser is under 18.

If you are a parent or guardian and believe we hold information about a child, write to privacy@vibeon.com.au and we will delete it and confirm that we have.

We may update this policy. The current version is always published on this page with the date it was last revised, and the version in force when you gave us information is the version that governed its collection.

For a material change — a new category of recipient, a new purpose, a longer retention period, or anything affecting what we do with purchase history — we will email registered customers and post a notice on the Website before it takes effect. We will not make a material change retroactive to information already collected without asking you first.

The Website links to third-party sites, and payment is handled by Stripe inside our own checkout rather than by sending you elsewhere. We are not responsible for the privacy practices of sites we do not operate.

Read their policies before giving them personal information. Stripe’s privacy policy governs what it does with the payment details you enter.