Shop policies

Privacy

This page explains what personal information the shop collects, why, who receives it, and how to see, correct or remove it.

Who is responsible

[confirm with Ahmad: legal name] (Ahmad Hraichie, the Muslim Undertaker) runs this shop and is responsible for your personal information. This page is written to the Australian Privacy Principles, and the shop aims to follow them. [confirm with Ahmad: whether the Privacy Act 1988 applies to his business (some small businesses are exempt); the shop aims to follow these principles either way]

What the shop collects

Your account: name, email address and password. The password is kept only as a one-way hash, never as you typed it.
Each sign-in: the IP address and browser it came from, so the account can be kept safe.
Your cart and orders: the items, prices, dates, the order reference and Stripe's payment references.
From Stripe's payment page, after you pay: your name, phone number and, for goods, your delivery address.
For a booked service: the preferred date and the note you write for Ahmad.
Emails the shop sends you: your address, the subject and whether it went out (never the message itself), kept 180 days.
To stop abuse of the forms: a short-lived record of the connection's IP address and a one-way hash of the email typed into sign-in and reset forms.

Sensitive information

Booking a funeral service for a Muslim burial can show your religion or the religion of the person who died, and a booking note may say how or where someone died. That is sensitive information. The shop collects it only to arrange the booking you make, and only what you choose to write: please include only what Ahmad needs.

Why

To run your account, take and deliver your orders and bookings, contact you about them, send receipts, keep the forms and accounts safe, and keep the business records the law requires.

Who receives it

Ahmad, who sells to you. And these others, which the shop and Ahmad use to run it:

Cloudflare (Cloudflare, Inc., United States) runs the shop: its servers answer every page, its database (D1) holds accounts, carts, orders and booking notes, its storage (R2) holds product photographs, Turnstile checks that a form is sent by a person, and Cloudflare Email Service sends the shop's emails. Cloudflare also keeps short-term logs of requests to the shop.
Stripe takes the card payment on its own page and collects your card details, name, email, phone and (for goods) delivery address there. The shop receives your name, email, phone, delivery address and Stripe's payment references, never your card number. Stripe handles what it collects under its own privacy policy.
The email service behind Ahmad's inbox holds the emails the shop sends to Ahmad's own address. For each paid order: your name, email, phone, delivery address, the items, the preferred date and any booking note you wrote. Also the shop's notices of refunds and payment problems, and every reply you send to an email from the shop, since replies go to Ahmad's inbox. That service keeps them under its own terms. [confirm with Ahmad: the email service his inbox uses and where it stores mail]
Safina Studio built the shop and looks after it for Ahmad. The shop runs in Safina Studio's Cloudflare account, so the studio can reach the shop's database to keep it running. [confirm with the owner: the studio's legal name, the country it works from, and its support arrangement with Ahmad]

The shop does not sell personal information and sends no marketing email. It has no advertising or analytics scripts of its own.

Outside Australia

Cloudflare, Stripe, the email service behind Ahmad's inbox and Safina Studio may store, process or reach your information outside Australia, including in the United States. [confirm with the owner: where the shop's D1 database is located]

Cookies

The shop sets two cookies of its own: one keeps you signed in, and one keeps a guest's cart for up to 30 days. It sets no advertising or tracking cookies.

How long it is kept

Orders and receipts: kept as Ahmad's business records for [confirm with Ahmad: how long; the ATO generally expects business records to be kept for five years].
Your account: until you ask Ahmad to remove it.
A guest cart nobody touches: deleted after 30 days.
The records that stop abuse of the forms: deleted about a day after they were last used.
Records of past sign-ins: [confirm with the owner: how long old sign-in records are kept]

Seeing, correcting or removing your information

Signed in, you can see your orders under Orders. To correct something, contact Ahmad. [confirm with Ahmad: how he corrects a customer's name or email when asked: the shop has no way to edit them yet]

You can also ask Ahmad to remove your account: your name and email are then replaced and you can no longer sign in. Your orders stay as Ahmad's business records, and he can clear the name, phone, delivery address and booking notes on them if you ask.

Questions or complaints

Contact Ahmad first. If you are not satisfied with his answer, you can contact the Office of the Australian Information Commissioner (www.oaic.gov.au).

Phone: [confirm with Ahmad: phone number]
Email: [confirm with Ahmad: email address]
Seller: [confirm with Ahmad: legal name]
ABN: [confirm with Ahmad: ABN]
Address: [confirm with Ahmad: business address]

Also: Terms of sale · Cancellations and refunds · Delivery · Contact