Last updated: 13 October 2026

This Privacy Policy explains how Bany Jaya trading as The Hunch Trail^TM (ABN 40 337 610 019) of 12A Ferraro Crescent, West Hoxton NSW 2171, Australia (we, our, us) handles personal information. It forms part of our Terms of Service.

1. What we collect, and why

1.1 When you browse the site

We set no cookies. For security, we log which page you viewed, the date and time, which posted link (if any) you followed to get there, the page that referred you here (if any), your browser's User-Agent string, the approximate country, state or province and network (for example, your internet provider) that your IP address belongs to, and a scrambled code made from your IP address (a keyed hash — we never store the address itself). We use this to detect and investigate abuse — not to build a marketing profile of you, and not to identify you by name. See section 2 for exactly what this involves and why.

Our website host. This website is hosted by Amazon Web Services (AWS). Its files are stored in AWS's Asia Pacific (Sydney) region and delivered to you through Amazon CloudFront, AWS's content delivery network, from whichever of its servers around the world is nearest to you. Whenever you load a page, CloudFront receives your IP address and the details of your request so that it can deliver the page, and AWS's security services (AWS WAF and AWS Shield) check each request so that attacks can be blocked. We have not switched on CloudFront's access logs, so we keep no record of your visit through the hosting service itself; AWS may keep short-lived security records of its own, which we do not export or keep. AWS does this as our processor, under its GDPR Data Processing Addendum. Our lawful basis is our legitimate interest in delivering this website to you and keeping it secure.

1.2 When you use the enquiry form

We collect the name, email address and message you type in.

The form sends them to Amazon Web Services (AWS), in its Asia Pacific (Sydney) region, in Australia. There an automated function checks the message, saves a copy of it, and emails it to our mailbox using Amazon Simple Email Service (SES); that mailbox is hosted by Purelymail (see section 5). The saved copy is a safety net in case the email goes astray, and it is deleted automatically 180 days after it is saved. We do not store your IP address with your message. AWS does this as our processor, under its GDPR Data Processing Addendum: it handles your message on our instructions and does not use it for its own purposes. Our lawful basis is our legitimate interest in receiving and answering enquiries, or the steps necessary to enter into a contract at your request.

This form is not a confidential channel, and neither is email@hunchtrail.com. Messages sent either way may in future be read by a staff member, and the confidentiality obligation in clause B13 of the Terms does not apply to them. Please do not send information about a specific artwork through this form or to email@hunchtrail.com. Artwork information should be sent only after you have paid the Quotation Fee, and only to the email address we then contact you from (your Engagement Address), where it is covered by clause B13. That route is available only to clients in the places we serve.

1.3 When you pay the Quotation Fee

Payment is handled by Stripe. Stripe collects your card details directly — we never see or hold your card number. We receive from Stripe your name, email address, telephone number, billing address (including the billing country), the amount, the date, a transaction reference, and the answers you gave to the three checkout questions (whether you want us to start work before your cancellation period ends, your acknowledgement of that right, and where you are contracting from and in what capacity) and, if you chose to give one, your VAT number. We use the email address to contact you about your quote: we email you personally from our own address — your Engagement Address — and everything about your engagement should be sent only to that address. We use the telephone number in one situation only: to contact you about your own order where we cannot reach you by email, or where we need to reach you urgently. We do not operate an inbound telephone line — see section 11.

Stripe's two roles, in the words of its Data Processing Agreement. Stripe keeps the record of your order for us — it is the main place that record is held — and it also uses your data for purposes of its own. Section 2 of Stripe's Data Processing Agreement with us (last updated 28 September 2026), in which “User” means us, describes those two roles in these words:

• As our processor: “When Stripe Processes Personal Data as a Data Processor, it is acting as a Data Processor on behalf of User, the Data Controller.” “The purposes of Stripe's Processing of Personal Data in its capacity as a Data Processor are to: service the Stripe platform; and provide, and provide access to, Stripe's products and services.”
• As an independent controller: “When Stripe Processes Personal Data as a Data Controller it: has the sole and exclusive authority to determine the purposes and means of Processing Personal Data it receives from or through User”. “The purposes of Stripe's Processing of Personal Data in its capacity as a Data Controller when providing Stripe's products and services are to: determine and utilise third parties (banks and payment method providers); monitor, prevent and detect fraudulent transactions and other fraudulent activity on the Stripe platform; monitor, prevent and mitigate financial loss, security risks and other harm; implement, maintain and perform internal processes that enable Stripe to provide its products and services, including relationship management, billing and invoicing; comply with Law, including applicable anti-money laundering screening and know-your-customer obligations, and Financial Provider and Governmental Authority requirements and requests; and analyse, improve and develop Stripe's products and services.”

When Stripe acts as a controller, its own privacy policy applies, including any automated fraud and sanctions controls it operates. Stripe also sends us an automatic email notification of each successful payment, which carries some of these details; it arrives in the same protected mailbox described in section 5.

Our lawful basis is performance of a contract with you, and compliance with our legal obligations (tax records, and sanctions screening under clause B11 of the Terms).

1.4 When you engage us for an Art Review

We collect: your full legal name, postal address, email address, telephone number, country of residence, the photographs and information you supply about the artwork, and the signed Services Agreement. The engagement is conducted by email, only through your Engagement Address; the telephone number is used only to contact you about your own engagement where we cannot reach you by email, or where we need to reach you urgently.

We use this only to perform the engagement, to meet our legal obligations, and to keep the records Australian tax law requires. Our lawful basis is performance of a contract and compliance with legal obligations.

This information is subject to the confidentiality obligation in clause B13 of the Terms, which is permanent for your identity (including your address), the materials you send us up until we deliver your Report (or until the engagement ends without one), and the fact that you engaged us at all. The contents of your Report are confidential for five (5) years.

1.5 Sanctions screening

Before accepting an engagement or the Service Fee, and promptly after a Quotation Fee is paid and before any work begins, we check your name and the name of any payer against the Australian Government's DFAT Consolidated List, the United States OFAC Specially Designated Nationals list (and, where the dealing warrants it, the OFAC Sectoral Sanctions Identifications list), the UK OFSI consolidated list and the EU consolidated list, and record the date, the lists checked and the result. Our lawful basis is compliance with a legal obligation. We screen against designated persons only — we do not screen, filter or refuse on the basis of nationality, residence or origin.

1.6 What we never collect

We do not collect, and will not ask for, identity documents, photographs or scans of identity documents, biometric information, health information, personal government identifiers such as passport, driver licence, tax file or social security numbers, or any other sensitive or special-category information. If you send any, we will delete it and tell you we have.

One exception: product-safety reports. If you tell us that our book has hurt someone or made them ill, the law in several countries requires us to report it to a product-safety regulator, often within a day or two. In that case only, we keep the minimum details a report needs: what happened, the kind of injury or illness and whether a doctor or nurse treated it, the injured person's age group (never a date of birth), the country, and which copy of the book was involved. We ask before passing anyone's name or contact details to a regulator. We share these details only with the regulator; with our insurer, if we have one; and, where the law requires it or it is needed to stop a safety risk, with the businesses that made or supplied that copy — without the person's name or contact details. We keep them in encrypted storage, for the period set out in section 4. Our lawful basis is compliance with our legal obligation to report; because these details are health information, we collect them only where a report requires them, or with your explicit consent.

2. Cookies, analytics and tracking

This website sets no cookies at all — not essential ones, not analytics ones, not any. It stores nothing in your browser's local storage or session storage. The logging script described below reads a few settings your browser already reports — whether automation software is driving it, its window size and its User-Agent string — only to decide whether to send anything, and stores nothing on your device. It loads no third-party fonts. It carries no advertising, no remarketing tags and no tracking pixels. There is no cookie-consent banner because nothing is stored on your device — the logging described immediately below does not involve your device storing anything; it does involve a code made from your IP address, which is why we explain it in full rather than folding it into a cookie notice that would not apply to it anyway.

Page-view and security logging. Each time a page on this site loads, your browser sends us which page it was, the tag from the link you followed here, if any (for example ?src=yt for a link we posted on YouTube), and the page that referred you here, if any. Our server adds the date and time the request arrived and your browser's User-Agent string. It then looks up the approximate location of your IP address, which arrives with every request — the country, the state or province, and the network it belongs to (for example your internet provider, or a data centre) — and stores those, before turning the address into a scrambled code (a keyed hash). The address itself is never stored. We use this to detect and investigate abuse of the site — unusual traffic spikes, patterns of bad server responses, and other signs of automated attack — and to keep the site available and secure. The link tag and the referring page help with that: they are a guide to where abuse is likely to come from, across all the links on social media and elsewhere that point to this site. We do not use it to advertise to you, to personalise anything you see, or to make any decision that affects you. Our lawful basis is legitimate interests (Article 6(1)(f) GDPR/UK GDPR): specifically, network and information security, which Recital 49 of the GDPR names as an example of a legitimate interest. You can object to this processing at any time — see section 6.

What this does and does not let us do. We never store your IP address itself. We store a keyed hash of it instead: a code that is always the same for the same address, so repeated or abusive traffic from one address can be recognised, but which cannot be turned back into the address without a secret key that only we hold. Because we hold that key, this is still personal data — pseudonymised, not anonymous — and we treat it that way. It is not tied to your name, email address or any account — this site has no login, and nothing here asks who you are. If you want to exercise a data-subject right over this data specifically, give us the IP address and the approximate date; we will work out the same code from it and search for matching records; without that, an ordinary rotating or shared IP address is not something we can trace back to a particular person ourselves.

How the location is found. The location is looked up in a database file kept in our own AWS account, so your IP address is never sent to anyone else to do it. It is approximate — often wrong at state or province level, and it shows where a VPN or data centre is rather than where a person is — and we use it only to see where abuse of the site is coming from. We do not record your city or map coordinates. IP Geolocation by DB-IP, used under the Creative Commons Attribution 4.0 International licence.

Retention. Records are deleted automatically 180 days after they are written — see section 4.

Bot filtering. Three checks run in your browser first, to skip obvious automated traffic before anything is sent: whether automation software (rather than a person) appears to be driving the browser, whether the browser reports a real window size, and whether its User-Agent string matches an obvious bot or crawler pattern. These checks run and are discarded locally — a request that fails one is simply never sent. A separate, aggregate rate limit on the endpoint itself protects it from being flooded.

Where this is stored, and by whom. These records are stored in Amazon Web Services' Asia Pacific (Sydney) region, in Australia, under our agreement with Amazon Web Services Australia Pty Ltd, which includes AWS's GDPR Data Processing Addendum. AWS acts as our processor: it stores this data on our instructions and does not use it for its own purposes.

Videos. Video embeds are replaced with a still image and a play button. No request is made to YouTube until you click play. If you do click, YouTube receives your IP address and sets its own cookies, under Google's privacy policy and not ours. We use the youtube-nocookie.com domain, which reduces but does not eliminate that. If you never click, YouTube never hears from you.

Currency conversion. Approximate Australian dollar prices shown on the site are fetched when the site is built, not when you visit it. The figure you see is plain text already in the page. Your browser makes no request to any currency service.

Outbound links. Bookseller links go to third-party sites with their own policies. We place no tracking on those links.

3. Who we share information with

We do not sell, rent, trade or share personal information for marketing. We disclose it only to:

• Stripe — payment processing, and the main record of your order (see section 1.3);
• Amazon Web Services (AWS) — hosts this website, and receives your IP address whenever you load a page (see section 1.1); hosts our page-view and security logging, in Sydney (see section 2); and receives and delivers enquiry form messages, keeping a safety copy of each for 180 days, in Sydney (see section 1.2);
• Purelymail, a service of Add Rabbit LLC in the United States — hosts our email, so it holds the messages you send us, including photographs sent for an Art Review (see section 5);
• for a product-safety report only (section 1.6), the businesses that made or supplied the copy of the book involved, where the law requires it or it is needed to stop a safety risk — without anyone's name or contact details;
• our bank, for receiving payment;
• if you dispute a card payment, your card issuer, through Stripe — the information it asks for to decide the dispute, such as evidence of the order and of its delivery (clause C16(d) of the Terms);
• if a dispute about an Art Review goes to mediation or arbitration, the mediator or arbitrator, only so far as the dispute requires (clauses B23 and B31 of the Terms);
• the European Commission's VIES service, which receives only the VAT number of a business client in Germany or the Netherlands, so that we can check it is valid (clause B27 of the Terms);
• our legal, accounting or insurance advisers, who are themselves under a duty of confidence, and only so far as necessary; and
• a court, regulator or authority, where required by law — in which case we will tell you first if we are lawfully able to.

International transfers. We are in Australia, so if you are outside Australia your information will be transferred here. Australia has not received an adequacy decision from the European Commission or the UK Government. When you send us your details or your images, you are giving them directly to us in Australia. Under the European Data Protection Board's guidance on the interplay between Article 3 and Chapter V, that is collection by a controller outside the EU rather than a restricted transfer, so no transfer mechanism applies to it. Stripe operates its own transfer arrangements for the data it handles for us. Our page-view and security records, and the safety copies of enquiry form messages, are stored with AWS in Australia. The website itself is delivered through CloudFront servers around the world, so the details of each page request are handled briefly at the server nearest you before reaching our files in Sydney, under AWS's GDPR Data Processing Addendum, which includes the European Commission's Standard Contractual Clauses. The main record of an Art Review order is held by Stripe (see section 1.3); we also keep our own copy, in Australia, in an encrypted folder on our own equipment, with an encrypted backup on a physical drive that we keep offsite. The emails we receive — enquiry form messages among them, and the emails that carry an engagement, including your photographs — are held in our email mailboxes, hosted by Purelymail, a service of Add Rabbit LLC, so they are held by a provider based in the United States (see section 5).

Standard Contractual Clauses and transfer risk assessment. Where personal data moves between us and a service provider outside your country, we rely on the transfer arrangements in that provider's own terms — including, where the provider offers them, the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum. We have carried out and documented a transfer impact assessment for each of those flows, considering the laws of the destination country, the nature and volume of the data, and the technical and organisational protections applied to it. A copy of that assessment is available on request to a supervisory authority.

4. How long we keep things

• Enquiry form messages and other emails to us — every enquiry form message, every email sent to email@hunchtrail.com, and our replies: seven (7) years, then deleted, in case an enquirer later becomes a client and either of us needs to refer back to what was said. Emails that become part of an Art Review engagement are kept as described below. The safety copy of an enquiry form message kept by AWS (section 1.2): deleted automatically 180 days after it is saved.
• Client Materials (artwork photographs and information) — our working copies are deleted within 30 days of delivering the Report, or of the engagement otherwise ending.
• Art Review emails, and the two archival copies — every email sent or received in the course of an Art Review engagement, with its attachments, stays in our mailbox, and a second copy of the Report and the Client Materials is kept on our encrypted offsite backup drive. Both are kept indefinitely, in confidence, for as long as our permanent confidentiality duties to you last (clause B13 of the Terms), because we may need to prove what you did, and did not, send us. They are used for nothing else.
• Financial and engagement records — 7 years from the end of the engagement, to cover tax-record (5 years) and limitation-period (6 years) requirements, then deleted.
• Sanctions screening records — seven (7) years, then deleted.
• Complaint records — seven (7) years after the complaint is closed, then deleted.
• Art Review order records — our own copies (the copy we download, its backup, and Stripe's payment notification email) are kept for 7 years from the end of the engagement, to cover tax-record (5 years) and limitation-period (6 years) requirements, after which we delete them. Stripe's own retention applies to the record Stripe holds.
• Page-view and security records (see section 2), including the approximate location and the scrambled code made from your IP address — deleted automatically 180 days after they are written.
• Product-safety incident records (section 1.6) — 10 years after the incident or, if a child was hurt, until 10 years after that child turns 18, because a claim about an injury can be brought long after it happens; then deleted.

4A. Data minimisation — what we ask you not to send

An Art Review needs photographs of an artwork. It does not need photographs of people, and it does not need your files to carry anything about you.

• Please redact or crop identifiable faces from anything you send us, wherever the artwork itself allows it. Where a face is part of the artwork that is unavoidable and we will work with it; where a face appears incidentally — in a room shot, a reflection, a photograph of a photograph — please remove it before sending.
• Please strip metadata from image files. Camera files routinely carry GPS coordinates, device identifiers and timestamps. We do not want them and do not need them.
• Please do not send documents you were not asked for — provenance files, insurance papers, correspondence, valuations. If we need something we will ask.
• Please do not tell us where any artwork is kept. We do not need to know. If you own the artwork and tell us anyway, that information is treated as part of your confidential Client Materials; if you do not own it, it is not confidential (clause B13 of the Terms).

Image retention. Our working copies of photographs and other Client Materials are deleted within 30 days of delivery of the Report, or of the engagement otherwise ending. Two archival copies are kept in confidence — the emails of the engagement in our mailbox, and a copy on our encrypted offsite backup drive — indefinitely, for as long as our permanent confidentiality duties to you last, because we may need to prove what you did and did not send us (section 4). They are not used for any other purpose. We never use client images for training, promotion, illustration or any published work.

5. How we protect it

We keep effective control of all information and take all precautions reasonably necessary to prevent theft, loss, or unauthorised access, use or disclosure. No system is perfectly secure, and we cannot guarantee the security of information transmitted to us over the internet.

Records of your Quotation Fee order (see section 1.3) are held in three places:

• Stripe — the main record of your order, held by Stripe as our processor (see section 1.3);
• our protected email mailbox — Stripe's automatic notification of your payment arrives in the mailbox described in the next paragraph; and
• our own copy — we download the order details from Stripe and keep them in an access-controlled, encrypted folder on our own equipment, with an encrypted backup on a physical drive that we keep offsite.

Emails and photographs you send to your Engagement Address are held by our email provider, Purelymail, encrypted at rest with a key derived from our mailbox password. For that mailbox, password reset and search indexing are switched off, so the provider cannot read stored messages without our password. Our general address, email@hunchtrail.com, and the mailbox that receives enquiry form messages do not have those protections — one more reason neither is a confidential channel.

6. Your rights

6.1 Everyone

Whoever and wherever you are, you may ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, or delete it. Email email@hunchtrail.com or, if you are an Art Review client, your Engagement Address (the only confidential channel). We respond within 30 days, free of charge. We may need to keep information we are legally required to retain, and will tell you if that applies.

Complaints to us. If you are unhappy with how we have handled your personal information, you can complain to us directly — by email to email@hunchtrail.com or, if you are an Art Review client, your Engagement Address, or by post to the address in section 11. You do not need to use any particular form or wording, and we accept a complaint however it reaches us. We will acknowledge it within three Business Days (and in any case within 30 days), look into it without undue delay, keep you informed of our progress, and tell you the outcome. Complaining to us does not stop you complaining to a regulator at any time — see sections 6.2 to 6.4.

6.2 If you are in the UK, Germany or the Netherlands (UK GDPR / GDPR)

You have the right to: access your data; have it corrected; have it erased; restrict processing; object to processing based on legitimate interests; data portability; and to withdraw consent at any time where we rely on consent. We make no automated decision about you, and do not use your data to build a marketing or behavioural profile of you as an individual — our page-view and security logging (section 2) looks for patterns consistent with automated abuse, not for anything about you personally.

If you are in the United Kingdom, your right to complain to us directly (section 6.1, “Complaints to us”) is also a legal right under section 164A of the Data Protection Act 2018, and the process described there is how we meet it. You may also complain to your national supervisory authority, or to the UK Information Commissioner's Office at ico.org.uk.

Representative. We do not currently maintain an Article 27 representative in the EU or UK, on the basis that our processing of EU and UK personal data is occasional, involves no large-scale special-category data, and is unlikely to result in a risk to your rights. We will appoint representatives in the EU and the UK as our activity in those regions grows. If you consider a representative should already be in place, tell us and we will review the position.

6.3 If you are in Canada (PIPEDA and Quebec Law 25)

You have the right to access and correct your personal information, to know how it is used and disclosed, to withdraw consent subject to legal and contractual restrictions, and to complain to the Office of the Privacy Commissioner of Canada.

If you are in Quebec. We do not offer the Art Review service to anyone resident or established in Quebec, and we do not accept Quebec clients — see clause B1 of the Terms of Service. You can still read this site and email us, so we may still hold your personal information, and where we do, the protections in this policy apply to it in full. Under Quebec's Law 25 you additionally have the right to de-indexation and to data portability, and you may complain to the Commission d'accès à l'information du Québec.

This site and everything on it is in English only. There is no French version of this policy, of the Terms of Service or of the Services Agreement, and we are not able to conduct dealings in French. The footer of every page carries a notice in French saying so.

6.4 If you are in Australia

We are a small business operator and are not currently an APP entity under the Privacy Act 1988 (Cth). We do not hold ourselves out as bound by the Australian Privacy Principles. We nonetheless apply the standards described in this policy as a matter of practice, and we will comply with the Australian Privacy Principles if and when they come to apply to us. You may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Separately from the Privacy Act, the statutory tort of serious invasion of privacy applies to us, as it does to any individual or business. Nothing in this policy limits any right you have under it.

7. If something goes wrong — our breach response procedure

A confidentiality incident means any actual or suspected loss, theft, or unauthorised access to, use of or disclosure of personal information or confidential information. If one occurs, we will:

• (a) Contain it immediately on becoming aware, including by securing or disabling the affected system, account or storage.
• (b) Assess within 72 hours what information is affected, whose it is, how the incident occurred, and what risk of harm it presents.
• (c) Notify you promptly, and in any event within 72 hours of becoming aware — telling you what happened, which information is affected, what risk it presents, what we are doing about it, and what you can do to protect yourself. We will do this whether or not the incident is likely to cause you serious harm. Page-view and security records (section 2) hold no contact details, so we cannot contact the people they relate to individually; if an incident affects those records, we will publish a notice on this website instead.
• (d) Notify the relevant regulator where required — including the Commission d'accès à l'information du Québec where a Quebec resident's information is affected and the incident presents a risk of serious injury; the Office of the Australian Information Commissioner where an eligible data breach has occurred; the Office of the Privacy Commissioner of Canada where a breach presents a real risk of significant harm; and the relevant EU or UK supervisory authority within 72 hours where required.
• (e) Record the incident in our register of confidentiality incidents, which we maintain and will produce to a regulator on request.
• (f) Review what happened and take reasonable steps to prevent recurrence.

8. Marketing

We do not operate a marketing mailing list and do not send promotional emails. Every message we send relates to an enquiry you made or an engagement you entered into. If that ever changes, we will obtain your consent first, as required by Canada's Anti-Spam Legislation, the Spam Act 2003 (Cth), the GDPR and the UK Privacy and Electronic Communications Regulations, and every message will carry a working unsubscribe link.

9. Children

Our services are not directed at children, and the Art Review service is available only to persons aged 18 or over. We do not knowingly collect personal information from children. If you believe we have, tell us and we will delete it.

10. Changes to this policy

We may update this policy by publishing a revised version here and updating the date at the top. Changes are not retrospective, and no change affects an engagement already formed — the version in force on the day you paid the Quotation Fee is the version that applies to that engagement, and we will supply a copy on request.

11. How to contact us

For any privacy question, request or complaint:

12. Direct hardcover book orders

This section covers one thing only: buying a copy of the hardcover edition of the picture book Nicky's Secret: A Christmas Story directly from us, through the payment link on this site, for delivery in Australia. It has nothing to do with the Art Review service, and none of the Art Review arrangements described in sections 1 to 11 apply to a hardcover book order. Where this section differs from anything earlier in this policy, this section is the one that applies to hardcover book orders. The terms of sale are in Part C of our Terms of Service.

What we collect, and why. The checkout is hosted by Stripe. It collects, and passes to us:

• Your name — to address the parcel and to identify your order if you contact us.
• Your email address — for your receipt and to answer you; and we give it to Australia Post, which emails you tracking details when your copy is on its way.
• Your telephone number — required by the checkout, and used so the delivery carrier can arrange or attempt delivery. We may also use it to contact you about your own Order where we cannot reach you by email, or where we need to reach you urgently. We do not use it for anything else, and we give it to nobody except the carrier. We still deal with you by email as a matter of course — see section 11.
• Your billing address — to complete the card payment and for our tax records.
• Your delivery address — to deliver the hardcover book. It must be in Australia.
• Your business name and ABN — optional. Enter them only if you want them on your order record. You do not need to, and leaving them blank changes nothing about your order or your rights.
• The order details — what you bought, the amount, the date, the delivery option and a transaction reference.

We never see or hold your card number. Stripe collects it directly. Stripe's two roles — as our processor, keeping the record of your order for us, and as an independent controller for purposes of its own — are set out in the words of Stripe's Data Processing Agreement in section 1.3.

Our lawful basis is performance of our contract with you, and compliance with our legal obligations for tax records.

Where hardcover book order records are kept. In four places only: in Stripe; in our own email mailbox (hosted by our email provider, Purelymail, in the United States — see section 5); for the shipping label, in our Australia Post MyPost Business account, which holds your name, delivery address, email address and telephone number (see “Who we give it to” below); and in our own bookkeeping records (kept for tax purposes), which hold your name and order number. Hardcover book orders are not mixed with Art Review order records — those are kept separately, and only for Art Review engagements. Apart from the shipping label and our own bookkeeping records, we do not copy hardcover book order details into any other system, spreadsheet service, CRM, accounting platform or mailing tool. Australia Post also keeps its own record of each shipment, under its own privacy policy and retention rules, so the deletion described below covers only the records we control.

Who we give it to. For a hardcover book order, and in addition to the recipients listed in section 3:

• Australia Post, our delivery carrier — your name, delivery address, email address and telephone number, which we enter in our Australia Post MyPost Business account to create the shipping label: the address and telephone number so the parcel can be delivered, and the email address so that Australia Post can email you tracking details. Nothing else. Australia Post keeps its own record of the shipment, under its own privacy policy and retention rules.
• If you dispute the payment, your card issuer, through Stripe — the information it asks for to decide the dispute, including evidence of dispatch and delivery (clause C16(d) of the Terms).
• If the parcel is a gift, the person receiving it — only if they ask us how we came to have their address, in which case we tell them who placed the order (see “If the parcel is going to someone else” below).

That is the whole list. We do not sell, rent, trade or share hardcover book order information for marketing, and we do not disclose it to anyone else except where section 3 already says we must — our bank, our advisers, or a court, regulator or authority where the law requires it.

If the parcel is going to someone else. You may have the hardcover book delivered to a person other than yourself — as a gift, for example. If you do, we collect that person’s name and address from you rather than from them. We use those details for one purpose only: getting the parcel to them. We give them to the delivery carrier and to nobody else, we do not add that person to any record other than the order itself, we never contact them for any reason of our own, and we do not use their details for any later order. If that person asks us how we came to have their address, we will tell them, and we will tell them who placed the order. If they ask us to remove their details we will do so, except where the seven-year retention rule below requires us to keep the order record (for our tax records, and in case of a claim) — in which case we will say so plainly and tell them when it will be deleted.

How long we keep it. Seven (7) years from the date of the order, to cover tax-record (5 years) and limitation-period (6 years) requirements, after which it is deleted. Stripe's own retention applies to the record Stripe holds.

If the book hurts someone. If you tell us that the Hardcover Book has hurt someone or made them ill, the product-safety exception in section 1.6 applies, including its retention period.

Marketing. None. Buying a hardcover book does not put you on a mailing list, because we do not have one. Every email you receive about a hardcover book order relates to that order — Stripe's receipt, Australia Post's tracking details, or our answer to something you asked. Section 8 applies unchanged.

Age. Hardcover book orders are for buyers aged 18 or over, as section 9 explains for our services generally. We do not knowingly collect personal information from children. The hardcover book is written for children; the transaction is with an adult.

If you are outside Australia. You may buy a hardcover book from anywhere, as long as it is delivered to an Australian address. Your information comes to us in Australia. Section 6 sets out your access, correction, deletion and complaint rights, and the regulator you can approach; those apply to hardcover book orders as they do to everything else, except that we cannot delete an order record before the seven years described above have passed, because we need it for our tax records and in case of a claim.

How to ask for a copy, a correction or a deletion. Email email@hunchtrail.com with the email address you used at the checkout. We acknowledge within three Business Days and respond substantively within 30 days.