Privacy.

Your name, email, shipping and billing address, phone, measurements, order history, payment metadata (not the card number itself — that lives with Stripe), and site analytics. Newsletter only if you opt in.

To make the piece, ship the piece, and talk to you about the piece. We send the atelier note only if you've opted in.

No selling lists. No third-party advertising trackers. No facial recognition. No AI training on customer images.

The atelier runs on a small set of careful suppliers. Each handles a single concern, and we list them by name so you can read their policies yourself.

• Stripe

  Payment processing. PCI-DSS Level 1. Stripe-secured.

• Resend

  Transactional and marketing email — order confirmations and the atelier note.

• Cloudflare

  Image hosting and content delivery (CDN).

• Sanity

  The headless CMS where editorial copy lives.

• Microsoft Azure

  Australia East data centres — the application servers and the Postgres database. Data lives in Australia where possible.

Under Australian Privacy Principle 12, you can request a copy of the personal information we hold about you, request a correction, or request deletion. We respond within 30 days as the Act requires. Write to privacy@aratrikkaz.com.

We only send marketing emails — the atelier note — to subscribers who have confirmed their address via double opt-in. You may unsubscribe at any time by clicking the unsubscribe link in any email, or by writing to hello@aratrikkaz.com. We process unsubscribe requests within 5 business days as required by the Spam Act 2003.

We use three categories of cookies:

• Functional

  Session token and cart — always active. These are required for the site to work. They hold no personal information beyond your session identifier.

• Analytics

  Google Analytics 4 (GA4) — collects anonymised page-view and interaction data. Retained for 26 months. Opt out at any time via your browser settings or Google's opt-out tool at tools.google.com/dlpage/gaoptout.

• Marketing

  Meta Pixel and Pinterest Tag — used to measure ad effectiveness and enable retargeting on Instagram, Facebook, and Pinterest. These share data with Meta Platforms Inc. and Pinterest Inc. You can opt out via your ad preferences on those platforms or via the AdChoices tool at youronlinechoices.com.au.

Marketing cookies are only activated after you accept the consent banner. You can change your preference at any time.

We don't sell to under-18s. We don't knowingly collect data from them.

If a breach occurs that's likely to cause serious harm, we notify you and the Office of the Australian Information Commissioner (OAIC) within the timelines set by the Act. Our internal NDB process is documented at /admin/ndb (atelier-internal).

This policy is versioned. Changes are shown here, and the previous version is archived so you can compare.

We keep your information only as long as needed, subject to these statutory minimums:

• Order records

  7 years — required by the Australian Taxation Office under Income Tax Assessment Act 1936 s262A.

• Account PII

  Deleted or anonymised within 30 days of a deletion request. Order records are anonymised in place (customer name and contact details replaced) so we can meet the tax requirement without holding identifiable data.

• Newsletter consent records

  7 years after last contact — kept as evidence of consent under Spam Act 2003 in case a complaint is raised.

• Analytics

  Anonymised within 26 months — the default Google Analytics 4 data retention window.

If you believe we have handled your personal information in a way that does not meet our obligations under the Privacy Act 1988, write to us at privacy@aratrikkaz.com. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

If you are not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Write to Ketki at privacy@aratrikkaz.com or via /contact.