This policy explains how TapCraft Pty Ltd (ABN 88 612 944 301), trading as TapCraft Studio (“we”, “us”, “our”), handles personal information collected through tapcraft.shop, tapcraftstudio.com, and any TapCraft-operated NFC payload destination.
We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you have a concern about how we've handled your information, you can lodge a complaint with us directly or with the Office of the Australian Information Commissioner.
1. What we collect
We only collect information we genuinely need to quote, ship, or follow up with you.
- Contact details — name, email, business name, postal address — when you fill in a quote, contact, or sample-kit form.
- Project details — what you're making, quantities, deadlines, design files you choose to share with us.
- Tap analytics — when an end-user taps a TapCraft NFC tag and we host the destination URL, we log the timestamp, approximate region (city-level), and device type. We do not collect names, emails, or precise location unless the user voluntarily submits them through a form on the destination page.
- Website analytics — page views, referrer, browser type, screen size. Aggregated and anonymised.
2. What we don't collect
- We don't store payment card details. Stripe handles that and we never see the number.
- We don't buy contact lists, scrape LinkedIn, or import data brokered from third parties.
- We don't use behavioural ad-tracking pixels. No Meta Pixel, no TikTok pixel.
3. Why we collect it
- To respond to your enquiry and quote your job.
- To ship the order and follow up about delivery.
- To send occasional product updates (only if you opted in). Unsubscribe is one click from any email.
- To improve our website, content, and product (aggregated data only).
- To comply with our legal obligations (tax records, dispute resolution).
4. Who we share it with
Only the people we genuinely need to share it with:
- Brevo (email delivery, hosted in EU) — to send transactional and marketing emails.
- Stripe (payments, hosted in US) — for invoicing and card processing.
- Vercel (web hosting, Sydney region) — to serve the website.
- Australia Post / StarTrack — to ship the goods.
- Xero — for accounting, where invoicing requires it.
We do not sell your data. Ever.
5. Where it's stored
Our primary data is stored in Australia (AWS Sydney, ap-southeast-2). Some of the services we use (Brevo, Stripe) store data overseas; we've confirmed they comply with the Australian Privacy Principles or equivalent frameworks (GDPR, SOC 2).
6. How long we keep it
- Quote enquiries we didn't convert: 24 months, then deleted.
- Customer records: 7 years (ATO requirement for tax-relevant records).
- Marketing list: until you unsubscribe.
- Tap analytics: 13 months, then aggregated and anonymised permanently.
7. Your rights
You can:
- Ask what we have on file about you.
- Correct anything that's wrong.
- Ask us to delete you (subject to tax-record retention obligations).
- Withdraw marketing consent at any time.
- Lodge a complaint with us or the OAIC.
To exercise any of these, email privacy@tapcraftstudio.com. We aim to respond within 7 business days.
8. Cookies
We use a small number of strictly-necessary cookies (session, form anti-spam) and a single first-party analytics cookie (Plausible-style) that does not track you across sites or store personal data.
9. Children
Our products and services are not directed at children under 16. We don't knowingly collect personal information from anyone under 16. If you're a parent and believe your child has submitted personal information, email us and we'll delete it.
10. Changes to this policy
If we make material changes, we'll update the “last updated” date at the top and email anyone we hold marketing consent for. The current version always lives at /legal/privacy.
11. Contact
Questions about privacy go to privacy@tapcraftstudio.com. General enquiries: hello@tapcraftstudio.com.