Privacy Policy

1. About Us

This Privacy Policy applies to Ozmuro Pty Ltd (ABN 46 699 269 862) ("Ozmuro", "we", "us", "our"). Our platform is accessible at ozmuro.com.

For privacy-related enquiries, contact us at hello@ozmuro.com.

Our registered address is 67 Earl Street E, Windsor VIC 3181, Australia.

2. What Data We Collect

We collect the following personal information:

From brand administrators:

• Name, email address, and password
• Business name, logo, and brand colours
• Product information including product names, descriptions, pricing, variants, and product images and photos uploaded to the platform
• Stripe payment and payout information (processed by Stripe, not stored by us)
• Shopify store domain and access credentials

From the brand's connected Shopify store we also receive product, inventory and fulfilment information (including tracking numbers) to operate the integration.

From gift buyers (corporates placing orders):

• First and last name
• Company name
• Email address
• Phone number
• Billing address
• Order details including scheduled send dates and gift messages
• Personalisation content you provide, such as engraving or name text and uploaded images

Note: some of the above fields are optional at checkout. Payment details are processed directly by Stripe and are not stored by Ozmuro; we never see or store card numbers.

From gift recipients:

• First and last name
• Email address
• Phone number (optional)
• Delivery address (street, suburb, state, postcode)
• Delivery notes (optional, e.g. access instructions)
• Personal gift message content

3. How We Use Your Data

We use personal data solely for the following purposes:

• Creating and managing gift orders on the Ozmuro platform (including multi-recipient orders, scheduled delivery, and eGift claim flows where applicable)
• Displaying brand products, logos, and imagery on the Ozmuro storefront and in order communications
• Delivering orders to recipients by pushing shipping details to the brand's Shopify store for fulfilment
• Sending transactional emails (order confirmations, gift notifications, eGift claim links, and fulfilment notifications)
• Contacting buyers or recipients regarding their order where necessary
• Processing payments via Stripe
• Providing brands with order management and reporting tools

We do not use personal data for advertising or any purpose beyond order fulfilment, platform operation, and the limited marketing described in section 4.

4. Marketing Communications

4.1 Ozmuro to Brand Administrators

We may send marketing communications to brand administrators including product updates, new feature announcements, and platform news. These communications are sent to the email address provided at registration.

Brand administrators can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us at hello@ozmuro.com. Opting out of marketing communications does not affect transactional emails related to your account and orders.

4.2 Brands Marketing to Buyers and Recipients

Where a gift buyer explicitly opts in to marketing communications from a brand at the time of placing an order (via an optional, unchecked opt-in checkbox at checkout), the brand may use that buyer's name and email address to send marketing communications. Similarly, where a gift recipient explicitly opts in to a brand's mailing list (for example via an optional opt-in during gift claiming), the brand may use that recipient's name and email address for marketing.

Brands are responsible for:

• Ensuring their marketing communications comply with the Australian Spam Act 2003
• Providing a clear and functional unsubscribe mechanism in every marketing email
• Not marketing to buyers or recipients who have not explicitly opted in

Ozmuro does not send marketing communications to buyers or recipients on behalf of brands.

5. How We Share Your Data

We share personal data only with the following third parties, solely to operate the platform:

• Stripe - payment processing (stripe.com/privacy)
• Supabase - secure database hosting (supabase.com/privacy)
• Resend - transactional email delivery (resend.com/privacy)
• Shopify - order fulfilment (shopify.com/legal/privacy) - recipient name, address, email, and phone number is shared with the brand's connected Shopify store to create orders for fulfilment
• Vercel - platform hosting (vercel.com/legal/privacy-policy)
• Google - address validation (Google Address Validation API) (policies.google.com/privacy)
• Sentry - error monitoring (sentry.io/privacy) - may receive limited technical and personal data contained in error reports

We do not sell personal data to any third party.

Order and recipient information is also shared with the brand you purchase from (including via its connected Shopify store) so the brand can fulfil the order. Once shared, the brand's own privacy practices also apply to that information, and we encourage you to review the relevant brand's privacy policy. We are not responsible for the privacy practices of brands.

6. Overseas Disclosure

Our primary database is hosted in Australia (Supabase, Sydney region). Some of our service providers, including Stripe, Resend, Vercel, and Sentry, store or process data in the United States and other countries. Where personal data is disclosed overseas, we take reasonable steps to ensure the recipient handles it in accordance with the Australian Privacy Principles.

7. Data Retention

We retain personal data for the following periods:

• Order and recipient data: 7 years from the date of the order (required for Australian tax record-keeping obligations under the Tax Administration Act 1953)
• Brand account data and uploaded assets (logos, product images): retained while the account is active, deleted within 30 days of account closure on request
• After retention periods expire, data is permanently deleted from our systems

8. Data Security

We take reasonable steps to protect personal data including:

• All data is encrypted at rest and in transit (TLS/HTTPS)
• Database backups are encrypted (managed by Supabase)
• Access to personal data is limited to authorised personnel only
• Row-level security policies restrict data access by brand

9. Your Rights

Under the Australian Privacy Act 1988 and the Australian Privacy Principles, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or out of date data
• Request deletion of your data (subject to legal retention requirements)
• Withdraw consent where processing is based on consent
• Know how your data is being used and shared

To exercise any of these rights, contact us at hello@ozmuro.com. We will respond within 30 days.

10. Cookies and Technical Data

We use essential cookies only - for authentication sessions and security (CSRF protection). We do not use advertising or tracking cookies.

For security and error monitoring we may automatically collect limited technical information such as IP address, browser type, and device information when you use the platform.

11. Children

The platform is intended for individuals aged 18 years or older. We do not knowingly collect personal information from anyone under 18, except where a gift recipient's details are provided by a buyer for delivery purposes. If you believe we hold personal information about a person under 18 in error, contact us at hello@ozmuro.com and we will delete it.

12. Business Transfers

If Ozmuro is involved in a merger, acquisition, reorganisation, or sale of assets, personal data may form part of the transferred assets. Any successor will remain bound by this Privacy Policy or one that is at least as protective.

13. Third Party Links

Our platform may link to third party services (e.g. Shopify, Stripe). We are not responsible for the privacy practices of those services and encourage you to review their privacy policies directly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify brand administrators of material changes by email. Continued use of the platform after changes constitutes acceptance of the updated policy.

15. Complaints

If you believe we have handled your personal data incorrectly, please contact us first at hello@ozmuro.com. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

16. Governing Law

This Privacy Policy is governed by the laws of Victoria, Australia and the Australian Privacy Act 1988 (Cth).