Privacy

Privacy policy

Draft: needs legal review. This policy was written by the Blueberry Bear Team to follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It hasn't been reviewed by a lawyer yet and may change before launch. Last updated 19 October 2026.

Who we are

Blueberry Bear Organics (ABN shown in the footer) runs this website, Australia's organic and low-tox marketplace. In this policy “we” and “us” means Blueberry Bear Organics. We may be a small business that the Privacy Act doesn't strictly cover yet, but we choose to follow the APPs anyway.

What we collect

• Account details (if you create an account): your email address, optional first name, a salted, one-way hash of your password (never the password itself), the date you joined, and whether you asked for reward emails.
• Sign-in session: a random session code stored in a cookie on your device and a scrambled (hashed) copy on our side, so you stay signed in.
• Interest and founding-member lists: your email, optional postcode, whether you're a seller or a shopper, and the page you signed up on.
• Orders (once checkout opens): your name, email, phone, delivery address and what you bought. Card details go straight to our payment provider, Stripe. We never see or store your card number.
• Messages you send us, and basic technical data our host records for security, such as your IP address (used briefly to limit repeated sign-in attempts).

Why we collect it

• To create and run your account and keep you signed in.
• To process, deliver and support your orders, including sending your name, delivery address and phone number (not your email or payment details) to the supplier or seller who posts your order.
• To send the emails you asked for: launch news, the founding-member offer, or reward emails if you ticked that box. Every marketing email will identify us and include a working unsubscribe link (Spam Act 2003).
• To keep the site secure (for example, limiting repeated sign-in attempts) and to meet our legal obligations, such as tax records for orders.

We collect only what we need for these purposes. You can browse the site without giving us any personal information.

Where it's stored

The website and its databases run on Cloudflare (Cloudflare Pages, Workers, D1 and KV). Cloudflare is a US company with data centres around the world, so your information may be stored or processed outside Australia, including in the United States. Payments are handled by Stripe, and order emails may be sent through an email provider. We choose providers that protect personal information to a standard similar to the APPs, and we take reasonable steps to keep it secure: HTTPS everywhere, hashed passwords, access limited to the team, and no card data held by us.

We don't sell your data

We will never sell, rent or trade your personal information. We share it only with the service providers above, with the supplier or seller who fulfils your order (only what they need to post it), or when the law requires us to.

Cookies

We use one essential cookie, bb_session, only if you log in. It's marked HttpOnly, Secure and SameSite, lasts up to 30 days and is deleted when you log out. Your cart and some form drafts are kept in your own browser's local storage and never sent to us unless you submit them. We don't use advertising or tracking cookies. If we ever add analytics or affiliate links, we'll update this policy first.

Access, correction and deletion

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete your account or remove you from any list. Email sales@blueberrybearorganics.com.au or use our contact page. We'll reply within 30 days and won't charge you. We may need to confirm it's really you, and we may have to keep some order records for tax law.

Complaints

If you're unhappy with how we've handled your information, contact us first at sales@blueberrybearorganics.com.au or through the contact page and we'll respond within 30 days. If you're still not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Data breaches

If a data breach is likely to cause you serious harm, we'll tell you and, where required, the OAIC, as soon as we can.

Changes

We'll post any changes here with a new date. If a change affects how we use information we already hold, we'll ask for your consent where the law requires it.

— the Blueberry Bear Team