Ozmuro

1. About Us

This Privacy Policy applies to Ozmuro Pty Ltd (ABN 46 699 269 862) ("Ozmuro", "we", "us", "our"). Our platform is accessible at ozmuro.com.

For privacy-related enquiries, contact us at hello@ozmuro.com.

Our registered address is 67 Earl Street E, Windsor VIC 3181, Australia.

2. What Data We Collect

We collect the following personal information:

From brand administrators:

Name, email address, and password
Business name, logo, and brand colours
Product information including product names, descriptions, pricing, variants, and product images and photos uploaded to the platform
Stripe payment and payout information (processed by Stripe, not stored by us)
Shopify store domain and access credentials

From gift buyers (corporates placing orders):

First and last name
Company name
Email address
Phone number
Billing address
Order details including scheduled send dates and gift messages

Note: some of the above fields are optional at checkout. Payment details are processed directly by Stripe and are not stored by Ozmuro.

From gift recipients:

First and last name
Email address
Phone number (optional)
Delivery address (street, suburb, state, postcode)
Delivery notes (optional, e.g. access instructions)
Personal gift message content

3. How We Use Your Data

We use personal data solely for the following purposes:

Creating and managing gift orders on the Ozmuro platform (including multi-recipient orders, scheduled delivery, and eGift claim flows where applicable)
Displaying brand products, logos, and imagery on the Ozmuro storefront and in order communications
Delivering orders to recipients by pushing shipping details to the brand's Shopify store for fulfilment
Sending transactional emails (order confirmations, gift notifications, eGift claim links, and fulfilment notifications)
Contacting buyers or recipients regarding their order where necessary
Processing payments via Stripe
Providing brands with order management and reporting tools

We do not use personal data for marketing, advertising, or any purpose beyond order fulfilment and platform operation.

4. Marketing Communications

4.1 Ozmuro to Brand Administrators

We may send marketing communications to brand administrators including product updates, new feature announcements, and platform news. These communications are sent to the email address provided at registration.

Brand administrators can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us at hello@ozmuro.com. Opting out of marketing communications does not affect transactional emails related to your account and orders.

4.2 Brands Marketing to Buyers

Where a gift buyer explicitly opts in to marketing communications from a brand at the time of placing an order (via an optional, unchecked opt-in checkbox at checkout), the brand may use that buyer's name and email address to send marketing communications.

Brands are responsible for:

Ensuring their marketing communications comply with the Australian Spam Act 2003
Providing a clear and functional unsubscribe mechanism in every marketing email
Not marketing to buyers who have not explicitly opted in
Not using recipient (gift recipient) data for marketing purposes under any circumstances - recipients have not consented to marketing contact

Ozmuro does not send marketing communications to buyers or recipients on behalf of brands.

5. How We Share Your Data

We share personal data only with the following third parties, solely to operate the platform:

Stripe - payment processing (stripe.com/privacy)
Supabase - secure database hosting (supabase.com/privacy)
Resend - transactional email delivery (resend.com/privacy)
Shopify - order fulfilment (shopify.com/legal/privacy) - recipient name, address, email, and phone number is shared with the brand's connected Shopify store to create draft orders for fulfilment
Vercel - platform hosting (vercel.com/legal/privacy-policy)
Google - address validation (Google Address Validation API) (policies.google.com/privacy)

We do not sell personal data to any third party.

6. Data Retention

We retain personal data for the following periods:

Order and recipient data: 7 years from the date of the order (required for Australian tax record-keeping obligations under the Tax Administration Act 1953)
Brand account data and uploaded assets (logos, product images): retained while the account is active, deleted within 30 days of account closure on request
After retention periods expire, data is permanently deleted from our systems

7. Data Security

We take reasonable steps to protect personal data including:

All data is encrypted at rest and in transit (TLS/HTTPS)
Database backups are encrypted (managed by Supabase)
Access to personal data is limited to authorised personnel only
Row-level security policies restrict data access by brand

8. Your Rights

Under the Australian Privacy Act 1988 and the Australian Privacy Principles, you have the right to:

Access the personal data we hold about you
Request correction of inaccurate or out of date data
Request deletion of your data (subject to legal retention requirements)
Withdraw consent where processing is based on consent
Know how your data is being used and shared

To exercise any of these rights, contact us at hello@ozmuro.com. We will respond within 30 days.

9. Cookies

We use essential cookies only - for authentication sessions and security (CSRF protection). We do not use advertising or tracking cookies.

10. Third Party Links

Our platform may link to third party services (e.g. Shopify, Stripe). We are not responsible for the privacy practices of those services and encourage you to review their privacy policies directly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify brand administrators of material changes by email. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Complaints

If you believe we have handled your personal data incorrectly, please contact us first at hello@ozmuro.com. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

13. Governing Law

This Privacy Policy is governed by the laws of Victoria, Australia and the Australian Privacy Act 1988 (Cth).