Privacy policy

This policy covers two groups of people, and the distinction matters because our obligations differ.

• Merchants — people who open an account and run a shop. We decide how their information is handled, so for them we are the controller.
• Shoppers — people who buy from a merchant’s shop. The merchant decides how that information is handled; we process it on the merchant’s instructions, so for them we are a processor and the merchant is the controller.

If you bought something from a shop and want your information corrected or deleted, contact that shop. If they cannot resolve it, contact us and we will help them do so.

• Account information — name, email address, password credentials, and any profile details you add.
• Shop information — your shop name, branding, products, pricing and settings.
• Billing information — subscription status and payment records. Card numbers are handled by our payment provider and are never stored on our systems.
• Payout information — the details our payment provider requires to pay you, collected and held by them.
• Usage information — pages visited in the dashboard, features used, device and browser information, IP address.
• Support correspondence — what you tell us when you contact us.

When someone buys from a shop on Stashed, we process the information needed to complete and support that order:

• Contact details — name, email address, and phone number where provided.
• Delivery details — shipping and billing address for physical goods.
• Order details — what was bought, when, for how much, and its fulfilment status.
• Payment status — whether payment succeeded. Card details go directly to the payment provider.
• Wallet addresses — where a purchase is paid for in cryptocurrency, the paying address is recorded as part of the transaction record.

We do not sell this information, use it to market to shoppers on our own behalf, or share it between merchants.

• To provide the platform — running shops, processing orders, delivering digital goods, sending transactional email.
• To take payment and pay merchants out.
• To prevent fraud, abuse and prohibited trading.
• To provide support.
• To improve the platform, using aggregated or de-identified information wherever it will do.
• To meet legal obligations, including tax and financial record-keeping.

We send merchants marketing email about Stashed only where they have opted in or where it relates to a service they already use. Every marketing email has an unsubscribe link that works.

We use third-party services to run the platform. They may access personal information only to perform their function for us. The current list is published on our sub-processors page.

We also disclose information where the law requires it, where it is necessary to protect our rights or someone’s safety, and to a purchaser in the event we sell the business — in which case this policy continues to apply until you are told otherwise.

Our infrastructure providers store and process data outside Australia, including in the United States and the European Union. By using Stashed you consent to that transfer. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.

Account and shop data is kept while the account is open and for a limited recovery period after closure. Transaction records are kept for as long as tax and financial law requires — generally seven years in Australia. Support correspondence is kept while it is useful for support purposes.

We use encryption in transit, access controls, and least-privilege access to production systems. Card details never touch our servers. No system is perfectly secure, and we do not claim otherwise.

If a data breach occurs that is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

You may ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, and withdraw consent where we rely on it. Contact us and we will respond within a reasonable period.

If you are unhappy with how we have handled your information, tell us first at privacy@stashed.one. If we do not resolve it, you can complain to the Office of the Australian Information Commissioner.

privacy@stashed.one — Akashi Labs, Melbourne, Victoria, Australia.