Privacy policy

Last updated 11 November 2026

1. Who is responsible

Chimo Labs (an Australian business based in New South Wales) is the entity that collects and controls the personal information described here. Privacy questions and requests go to [email protected].

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What we collect

• Order details — name, email address, delivery address, optional phone number, the items you bought and any note you add at checkout.
• Order history — reference, status, tracking number and correspondence about the order.
• Payment information — handled by Stripe or PayPal. We receive a payment confirmation, the amount, the card brand and the last four digits. We never receive or store your full card number or security code.
• Newsletter email — only if you choose to subscribe.
• Technical data — IP address and user agent recorded by our hosting and security layers, used to keep the site up and to detect abuse.

We do not knowingly collect information from children under 15, and we do not ask for sensitive information (such as health information) at any point.

3. Why we collect it

• To accept, process, pack and deliver your order, and to answer your questions.
• To process payment and prevent fraud.
• To handle returns, refunds and warranty claims.
• To meet tax, accounting and consumer-law record-keeping obligations.
• To send the newsletter — only where you asked for it, and only until you unsubscribe.

We do not use your information for automated decision-making that has a legal effect on you, and we do not build advertising profiles.

4. Cookies and local storage

We use no advertising or cross-site tracking cookies. What is stored is strictly functional:

• Cart contents — kept in your browser's local storage so your cart survives a refresh. It never leaves your device until you check out.
• Admin session cookie — only for staff signing into the shop admin.
• Security cookies — set by our hosting and bot-protection layers to tell a real browser from an automated request.

Clearing your browser storage removes the cart. You can browse and buy with cookies limited to first-party functional ones.

5. Who we share it with

Only the parties needed to fulfil your order, and only what each one needs:

• Stripe and PayPal — payment processing and fraud checks.
• Our fulfilment partners — the name, address and items required to pack and dispatch your parcel, and your email so tracking can be sent.
• Carriers — name, address and phone number for delivery.
• Hosting and email providers — infrastructure and transactional email.
• Professional advisers and authorities — where required by law (for example the ATO), or to establish or defend a legal claim.

We never sell, rent or trade personal information.

6. Sending information overseas

Some of the providers above store or process data outside Australia, including in the United States (Stripe, PayPal and our email and hosting providers), and our fulfilment partners may dispatch parcels from outside Australia. Where information is disclosed overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs, and we share only what is necessary for the purpose described above.

7. How long we keep it

• Order and payment records: 7 years, because Australian tax law requires it.
• Support correspondence: up to 2 years after the matter is closed.
• Newsletter subscription: until you unsubscribe, plus a suppression record so we don't re-add you.
• Server and security logs: typically 30–90 days.

When a retention period ends we delete or de-identify the information.

8. Keeping it secure

The site is served over HTTPS. Card data is tokenised by the payment processor, so it never reaches our servers. Access to order data is limited to the people who need it, protected by password, on infrastructure we control. We keep dependencies patched and take reasonable steps to detect and respond to unauthorised access.

If a data breach occurs that is likely to result in serious harm, we will assess it under the Notifiable Data Breaches scheme and notify affected individuals and the OAIC where required.

9. Your rights

You can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct information that is wrong, out of date or incomplete;
• delete information we no longer need (subject to the record-keeping obligations above);
• stop sending you marketing email;
• deal with a complaint about how we have handled your information.

Email [email protected] and we will respond within 30 days. We may ask you to verify your identity, and we may need to keep order records where the law requires it even after a deletion request.

10. Marketing

The newsletter is opt-in and every email has a one-click unsubscribe that takes effect immediately. Transactional email about an order you placed (confirmation, dispatch, tracking, refunds) is not marketing and is sent regardless of your marketing preference.

11. Complaints

If you think we have breached the APPs, email us first — most issues are resolved in a single exchange. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Related policies

See also our terms & conditions, shipping policy and returns policy.