Privacy Policy

1. Information we collect

We may collect the following kinds of personal information:

Account information: your first and last name, email address, password (stored only as a one-way hash), date of birth (required to confirm you are 18 or older), and the handle you choose. You may also add your interests.

Contact and shipping: your name, email address, delivery address, and phone number when you save an address, buy from the shop, or have a piece shipped to you. A phone number is needed to post a piece: it is given to Australia Post so they can contact the person receiving the parcel, and we do not use it for marketing. Each order keeps the delivery details it was placed with.

Payment information: we do not store card numbers. Card payments are processed by Stripe, and card details are entered into Stripe's own secure form. We store the brand, last four digits, and expiry date of a card you save, Stripe's references for you and for that card, and a record of each payment and refund (e.g. amount, status, and date).

Luxury boxes, inventory, and draw records: the luxury boxes you open, the pieces you receive, keep, sell back, or have shipped, your store credit and its history, and the record of each draw that allows it to be verified.

Marketplace: listings you create, offers you make and receive, your wishlist and saved searches, messages you exchange with other members, and members you have blocked.

Status Points: your Status Points, your level, and the activity that earned them (e.g. luxury boxes opened, shop orders, marketplace trades, and setup steps).

Referral and affiliate data: referral codes, which members were referred by whom, referral discounts given and used, and (for affiliates) referred members' qualifying spend for the purpose of calculating commission.

Gifts: if you give a luxury box as a gift, the recipient's email address or handle and any message you write. If someone sends you a gift, we hold your email address for that purpose even if you are not a member.

Spending limits and pauses: the limits and pauses you set, each change to them, and our record of offering them.

Finds and reactions: the pieces you reveal that are shown publicly as finds (see section 3), and your reactions to other members' finds, which are shown publicly with your handle.

Chat: the chat messages you post in chat on the luxury box page, and the chat messages you report to us. Chat messages are public: anyone visiting the Platform can read them, shown with your handle and the time. We keep chat messages after they scroll out of view, so that a complaint about one can be checked. If we remove a chat message, it is hidden from members but we keep a record of it. When you close your account, your chat messages are deleted (see section 6).

Waitlist: if you joined our waitlist before launch, your email address, your consent to launch emails, and the IP address the sign-up came from. If a giveaway is drawn from the waitlist, we record the winner's email address.

Communications: when you send us an enquiry or suggest a piece through the Platform or by email, we keep a record of that correspondence. An enquiry sent through the Platform also records the IP address it came from.

Notifications: the notifications we send you, and your choices about which you receive on the Platform and by email.

Marketing consent: whether you have agreed to receive marketing emails from us, and when you agreed.

Technical data: when you register, sign in, or ask for a password reset, we record the email address used and the IP address of the attempt, so that we can limit repeated attempts. When something goes wrong on the Platform, we log the error, the address of the page, and a reference to your account. Our hosting provider counts page views for us without cookies, and Meta and Klaviyo collect information about your visits through their own scripts and cookies (see sections 3 and 4).

Internal records: our staff's actions on your account (e.g. a refund, an adjustment to your store credit, or a suspension) are recorded with the reason given, for administration, moderation, and compliance purposes.

2. How we use your information

We use your information to:

• Create and manage your account, confirm that you are 18 or older, and authenticate you when you sign in.
• Process orders, payments, and refunds (via Stripe), and ship pieces to you.
• Run luxury box draws and keep the records that allow each draw to be verified.
• Operate the marketplace (listings, offers, and messages), gifts, referrals, Status Points, and spending limits and pauses.
• Send you emails about your account and your activity on the Platform (e.g. email verification, password reset, shipping updates, and gift notices), and the notification emails you have switched on in your account settings. If you joined the waitlist and consented, we send you emails about our launch.
• Send you marketing emails about new pieces and offers, through Klaviyo, if you gave marketing consent by ticking the box when you registered or by switching marketing emails on in your notification preferences. We send marketing emails only to people who gave marketing consent or joined the waitlist and consented to launch emails.
• Measure our advertising on Facebook and Instagram, through Meta (see sections 3 and 4).
• Moderate handles, gift messages, and messages between members, using automated filtering and manual review, to maintain community standards. Our staff can read messages sent through the Platform.
• Prevent fraud and misuse (including attempts to avoid a suspension, a spending limit, or a pause), improve the Platform, and comply with legal obligations.
• Respond to your enquiries and provide support.

3. Disclosure of your information

We may disclose your information to:

Service providers: payment processing and the card and address forms (Stripe), address suggestions inside the address form (Google Maps), hosting and page-view counts (Vercel), our database (Neon), transactional email delivery (Postmark), backup storage (GitHub), advertising measurement (Meta), and marketing email (Klaviyo), who act on our instructions and are bound by confidentiality.

Meta: Meta (the company behind Facebook and Instagram) receives from our server each payment you make for a luxury box, a gift, a shop order, shipping, or a marketplace purchase (its amount, what it was for, and a reference to it), and the page visits and product views its pixel records in your browser (see section 4). With each, we send a hashed (one-way coded) form of your email address and of your account reference if you are signed in, your IP address, your browser's details, and Meta's cookies from your browser. Meta uses this to measure our advertising and show it to people likely to be interested.

Klaviyo: Klaviyo sends our marketing emails, and receives information only about people who gave marketing consent or joined the waitlist and consented to launch emails: your email address, your handle and level, whether you signed up as a member or on the waitlist, any offer you were promised, which version of the consent you gave, your orders, and the pieces you view, add to your cart, and check out while signed in. If you have not given marketing consent, we send Klaviyo nothing about you.

Carriers: Australia Post receives the name, delivery address, phone number, and email address on your order so that it can deliver your parcel and tell you about it.

Other members and the public: your handle (chosen by you, or generated for you if you did not choose one) is shown on your listings and offers, to members you message, and on your finds. A piece you reveal may be shown publicly as a find, and each reveal has a page showing the piece and the record of its draw, which anyone with the link can view. If you give a gift, the recipient is shown your handle; if you receive one, the giver is told when you claim it and, if you agree, which piece you revealed. Your handle, level, and Collection Points, and the pieces you find, may be shown on a public leaderboard, which you can turn off in your Account. If you win a monthly prize, your handle, your level, and what you won may be shown on the Leaderboard page as last month's winner.

Authorities: when required by law, court order, or to protect our or others' rights and safety.

We do not sell your personal information to third parties for their marketing.

4. Cookies and similar technologies

We use a small number of cookies of our own:

• A sign-in cookie keeps you signed in for up to 7 days. Scripts on the page cannot read it.
• If you arrive through an affiliate's link, a cookie remembers the affiliate's code for 30 days so that the referral can be recorded if you register.
• While the Platform is open by invitation only before launch, a cookie remembers for 90 days that your browser has been admitted.

We also keep a few items in your browser's own storage (e.g. that you have dismissed the cookie notice). These stay on your device.

Our hosting provider, Vercel, counts page views for us. It does this without cookies, and we do not use it to identify you. Stripe may set its own cookies when its payment form loads, to process payments and prevent fraud.

Meta's pixel and Klaviyo's script load on the pages of the Platform. Meta's pixel sets cookies in your browser and tells Meta which pages you visit and which pieces you view, add to your cart, check out, and buy, so that Meta can measure our advertising; the pixel itself sends Meta no name or email address. Klaviyo's script also sets a cookie in your browser; it tells Klaviyo which pieces you view, add to your cart, and check out only if you are signed in and have given marketing consent. We do not use session recording.

You can control cookies through your browser settings; disabling them may affect some features (e.g. staying signed in).

5. Security

We take reasonable steps to protect your personal information from misuse, loss, and unauthorised access (e.g. passwords stored only as one-way hashes, encrypted connections, access controls, two-step sign-in for our staff, and secure hosting). No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

6. Retention

We retain your information for as long as your account is open or as needed to provide services, comply with legal obligations (e.g. tax, consumer law), resolve disputes, and enforce our agreements.

• Records of orders, payments, store credit, referral discounts, commission, and draws are kept for at least 7 years, because we must keep financial records and because a draw must remain verifiable.
• Spending limit and pause records are kept for at least 7 years, because they evidence that we offered and honoured protective controls.
• Error logs are deleted automatically 90 days after they are recorded.
• Records of registration, sign-in, and password reset attempts (email address and IP address) are deleted automatically 24 hours after they are recorded.
• The IP address recorded with an enquiry or a waitlist sign-up is removed automatically 90 days after it is recorded.
• A backup copy of our database is made each night, and each copy is deleted 90 days after it is made. Information we delete may remain in backup copies until then.

When you close your account: we clear your name, email address, date of birth, phone number, address, saved card, handle, interests, and password, and we delete your messages, chat messages, reports of chat messages, blocks, wishlist, saved searches, notifications, and reactions. We keep the records listed above and our staff's record of actions on your account, without your personal details, except that an order keeps the delivery name, email address, and address it was placed with. Stripe keeps its record of you as our customer, with your card removed. If you gave marketing consent, we ask Klaviyo to delete its profile of you. We also keep a one-way coded form of your email address, which cannot be turned back into the address, so that a suspension or a pause cannot be avoided by closing an account and registering again.

Where information is no longer needed for the purpose it was collected for, we delete or de-identify it.

7. Your rights (Australia)

Under the Privacy Act and APPs you may:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or out-of-date information. You can correct most details yourself on your account page.
• Withdraw consent where we rely on it (e.g. marketing emails and launch emails). You can withdraw marketing consent at any time by switching marketing emails off in your notification preferences, or through the unsubscribe link in any marketing email. You can switch notification emails off in your account settings.
• Close your account from your account page, which removes your personal details as described in section 6, subject to our obligation to retain certain records for legal, tax, or dispute resolution purposes.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached your privacy.

To access or correct your information, or to raise a privacy concern, contact us at hello@4keeps.au.

8. Overseas disclosure

Our database is held in Sydney, Australia. Some of our service providers (e.g. Stripe, Google, Vercel, Postmark, GitHub, Meta, and Klaviyo) may store or process data overseas, including in the United States. Where we do disclose personal information overseas, we take reasonable steps to ensure the recipient complies with privacy standards comparable to Australian law, where practicable.

9. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will be revised, and we may notify you of material changes by email or by a notice on the Platform. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

10. Contact us

For any questions about this Privacy Policy or how we handle your information, please contact us at hello@4keeps.au.

4Keeps Luxury Goods Pty Ltd, ACN 702 798 990, ABN 44 702 798 990, Queensland, Australia.