Privacy Policy

Last updated: 29 September 2026

1. Who we are

theonlineretailer.com.au (“The Online Retailer”, “we”, “us”) is operated by Kyle Aidan Tudor, trading as The Online Retailer, ABN 17 104 423 373, 14 Hehir Street, Belmont WA 6104. This policy explains what personal information we collect, why, who we share it with, and how you can access or correct it or make a complaint. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for customers in New Zealand, the Privacy Act 2020.

Privacy questions and requests: [email protected].

2. What we collect

• Contact and identity details: name, email address, phone number, billing and delivery addresses and, if you give them, a business name and ABN or NZ GST number.
• Order details: what you bought, prices, delivery method, tracking numbers, returns, refunds and our messages with you about them. For age-restricted products, your confirmation that you are 18 or over.
• Payment details: card payments are handled by our payment provider. We receive only limited information such as the card type, the last four digits and the result of payment and fraud checks. We never see or store your full card number.
• Account details: your login, password (stored in encrypted form), saved addresses and your email preferences.
• Your messages: emails and contact-form messages to our customer service team, and what you type into our “Ask us” shopping assistant (see section 5).
• Browsing and device information: IP address, browser and device type, pages visited, the page that referred you, campaign and ad-click identifiers in links, and security records such as failed sign-in attempts (see sections 6 to 8).
• Email engagement: whether our emails were opened and which links were clicked (section 7).
• Marketing preferences: whether and when you opted in to or out of marketing emails.

We do not ask for sensitive information (such as health information). Please do not include it in messages to us.

3. How we collect it

Mostly directly from you: when you order, create an account, contact us or use our assistant. Some information is collected automatically when you use our website or open our emails. We also receive information from our suppliers and couriers (for example dispatch and tracking updates) and from our payment provider (for example the result of fraud checks).

4. Why we use it

• to process your order, pass it to the supplier who dispatches it, and keep you updated about delivery;
• to take payment, issue receipts and tax invoices, process refunds (with adjustment notes) and prevent fraud;
• to answer your questions and handle returns and complaints, including with the help of automated tools (section 5);
• to run and secure your account and our website (for example, limiting repeated failed sign-ins);
• to keep the business and tax records the law requires;
• to contact you about a product safety recall;
• to understand how our website and emails are used, fix problems and improve them (sections 6 and 7);
• to measure and improve our advertising, unless you opt out (section 8); and
• if you have opted in, to send you offers and news (section 9).

If you do not give us the information we need for an order (such as a delivery address), we cannot complete it.

5. Our AI shopping assistant and automated replies

The “Ask us” assistant on our website and some replies to simple email enquiries (such as “where is my order?”) are produced by an artificial-intelligence system that runs on our own servers in Australia; your messages are not sent to an outside AI provider. To answer order questions it looks up the relevant order details. Anything that is not simple is passed to a person, the assistant does not make decisions with legal or similarly significant effects on you, and you can ask for a person at any time.

We do not keep transcripts of assistant conversations. We keep usage records (for example, the type of question, whether it was answered, response time and approximate country) for 90 days, and a short sample of messages the assistant refused to answer for 14 days, to prevent misuse. The assistant sets a cookie (tor_aia_vid, kept for up to 400 days) so it can apply daily question limits. A shortened extract of messages you type, with email addresses and long numbers removed, is also recorded by our analytics (section 6).

Some product descriptions and lifestyle images on our website are created with AI tools from supplier information. That process does not use your personal information.

6. Website analytics

When you use our website we collect information about how you browse and shop: pages and products you view, searches, items added to or removed from your cart, checkout steps, orders and refunds, account sign-in and sign-up, and your use of our shopping assistant. We collect this with our own first-party analytics service, operated on our own systems in Australia (served from theonlineretailer.com.au and shopping.theonlineretailer.com.au), using cookies and similar identifiers (for example __eventn_id) that stay on your device for up to five years, together with your IP address, browser and device details, the page that referred you, and campaign or ad-click identifiers in links (such as utm tags, gclid, fbclid and ttclid, and the _fbp and _fbc cookies). If you are signed in or place an order, we link this activity to your account or order. We use it to run and improve the store, measure sales and marketing, and prevent fraud.

You can switch analytics and advertising measurement off for your browser at any time:

This sets a tor_optout cookie; clearing your cookies removes the choice, so you may need to opt out again. Browsers that send a Global Privacy Control signal are excluded from advertising measurement.

7. Email measurement

Our emails (order, account and marketing emails) contain a small image and tracked links that tell us whether an email was opened and which links were clicked. We use this to check that important emails such as dispatch and tracking emails reach you, to find delivery problems and to see which emails are useful. You can prevent open tracking by turning off automatic image loading in your email app. Records of opens and clicks are kept for up to 24 months.

8. Advertising measurement (Meta and Google)

We may advertise on Meta (Facebook and Instagram) and Google. Once we switch this on, and unless you have opted out (section 6), we send them order and browsing events together with your email address, phone number, name and address in hashed (scrambled) form, so that they can match them to their users, measure whether our ads led to visits and purchases, and help us show relevant ads. These companies may store the data outside Australia, including in the United States, under their own privacy policies. You can also control ads in your Meta and Google account settings.

9. Marketing emails

We send marketing emails (offers, new arrivals, reminders about items left in your cart and review requests) only if you have opted in, for example by ticking the box at checkout or when you create an account. The box is never ticked for you. Every marketing email identifies us and has an unsubscribe link, and we act on unsubscribes promptly. We keep a record of when and how you opted in or out.

10. Who we share information with

We do not sell your personal information. We share it only as needed with:

• the suppliers and warehouses that dispatch your order (your name, delivery address, phone number and the items ordered), and the couriers that deliver it;
• our payment provider, CyberSource (a Visa company), and your card issuer, to process payments, refunds and fraud checks;
• Cloudflare, which delivers and protects our website and helps send our emails;
• Intuit QuickBooks Online, our accounting system, which holds sales records such as your name, order number and amounts;
• Meta and Google, for advertising measurement as described in section 8;
• other service providers who help us run the store, and our professional advisers (such as our accountant and lawyer);
• government agencies, regulators, courts or law enforcement where the law requires or allows it; and
• a buyer of our business, if the business is sold, on condition that they protect your information.

11. Information sent overseas

Our website, order records, analytics and AI assistant are hosted in Australia. Some service providers store or process information outside Australia, mainly in the United States, and may also use other countries in their global networks: Cloudflare, Visa/CyberSource, Intuit QuickBooks Online, and Meta and Google (section 8). Where an item ships from an overseas warehouse, the supplier in that country receives the delivery details for that item. We use established providers with published privacy and security commitments. If you are in New Zealand, your information is held in Australia and, where it is disclosed to other countries, we take reasonable steps to make sure it is protected in ways comparable to the New Zealand Privacy Act.

12. Security

We protect personal information with encrypted connections, access controls, two-factor sign-in for administrator accounts, limits on repeated sign-in attempts, and regular backups, and card data stays with our payment provider. If a data breach is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (and, for New Zealand customers, the New Zealand Privacy Commissioner) as the law requires.

13. How long we keep information

• Orders, receipts, tax invoices and payment records: at least 5 years after the order, as Australian tax law requires.
• Your account: until you ask us to close it (subject to the record-keeping above).
• Customer service emails and contact-form messages: message content is anonymised 24 months after the last activity.
• AI assistant: usage records 90 days; samples of refused messages 14 days; no transcripts.
• Email open and click records: up to 24 months.
• Analytics records: up to 5 years (cookie lifetime up to 5 years).
• Security records such as failed sign-in attempts: up to 90 days.
• Marketing consent records: while you are subscribed and for 2 years afterwards, so we can show when you opted in or out.

When we no longer need information, we delete or de-identify it.

14. Access, correction and deletion

You can see and update most of your details in My Account. You can also ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing [email protected]. We will confirm your identity first. We respond within 30 days and do not charge for making a request. If we cannot do what you ask (for example, because we must keep tax records), we will explain why in writing and tell you how to complain.

15. Complaints

If you are concerned about how we have handled your personal information, email [email protected] with the details. We acknowledge complaints within 5 business days and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909).

16. Children

Our store is not directed at children and we do not knowingly collect personal information from children under 16. You must be 18 or over to buy from us.

17. Changes to this policy

We update this policy when our practices change and change the date at the top. If a change materially affects how we use information we already hold, we will tell you before it applies.

18. Contact

Kyle Aidan Tudor, trading as The Online Retailer
ABN 17 104 423 373
14 Hehir Street
Belmont WA 6104
Privacy and customer service: [email protected]