Privacy Policy

1. Introduction

Minted ("we", "our", or "us") operates the Minted marketplace at mintedbuysell.com.au. We are committed to protecting your privacy and handling your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where you access Minted from the European Economic Area or the United Kingdom, we also respect your rights under the GDPR / UK GDPR.

By using Minted, you consent to the practices described in this Privacy Policy.

2. Information We Collect

Information you provide:

• Account information: name, email address, password (stored hashed), location
• Profile information: profile photo, bio, store details
• Listing information: photos, descriptions, prices and shipping details of items you sell
• Transaction information: purchase history, shipping addresses, order records
• Communications: messages with other users, support enquiries
• Payment information: processed entirely by Stripe — we never receive or store your card number
• Payout details: BSB and account number or PayPal email, used solely to pay you your sale proceeds

Information collected automatically:

• Device information: device type, operating system, browser type
• Usage data: pages viewed, listings viewed, searches, features used
• Approximate location: derived from your IP address, used to suggest your display currency and region
• Cookies and local storage: to keep you signed in and remember preferences (see section 8)
• Push notification tokens: only if you opt in to notifications

3. How We Use Your Information

• Create and manage your account
• Process purchases, hold and release seller funds, and process payouts
• Enable messaging between buyers and sellers (delivered in real time)
• Send transactional emails (order confirmations, receipts, shipping updates, password resets)
• Send push notifications and marketing emails — only with your consent, and you can opt out any time
• Generate shipping quotes and labels for your orders
• Display prices in your local currency (using live exchange rates)
• Detect and prevent fraud, abuse and security incidents
• Comply with legal obligations, including tax and consumer law

4. Third Parties We Share Data With

We never sell your personal information. We share only what is necessary with these service providers to operate Minted:

• Stripe (payments) — receives your payment details directly; PCI-DSS Level 1 certified
• Amazon Web Services (AWS S3, Sydney region) — stores listing photos and images
• Resend — delivers our transactional and marketing emails
• OneSignal — delivers push notifications you have opted into
• Shippit / EasyPost — receive delivery name and address to generate shipping quotes and labels
• Sellers you buy from — receive your delivery name and address to fulfil your order

Some providers store data outside Australia (e.g. the United States). We only use providers with appropriate security and contractual safeguards, as required by APP 8.

5. Your Rights

You can, at any time:

• Access & export your personal data — use "Download My Data" on the Manage Data page
• Correct your details — edit them in your Profile
• Delete your account and data — via the Delete Account page, or request specific data deletion via Manage Data
• Opt out of marketing emails (unsubscribe link) and push notifications (device settings)
• Complain — contact us first; you may also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

EEA/UK users additionally have GDPR rights to restriction, objection and data portability — the export and deletion tools above satisfy these, or contact us directly.

6. Data Retention

• Account data: kept while your account is active
• Transaction and payout records: kept up to 7 years as required by Australian tax law, even after account deletion
• Messages: kept while both accounts exist
• When you delete your account, personal data not legally required to be retained is removed

7. Security

• All traffic is encrypted with HTTPS/TLS
• Passwords are stored hashed, never in plain text
• Card details never touch our servers (handled by Stripe)
• Administrative access is authenticated and rate-limited

If a data breach occurs that is likely to result in serious harm, we will notify affected users and the OAIC in accordance with the Notifiable Data Breaches scheme.

8. Cookies & Local Storage

We use a small number of cookies and browser local storage entries:

• Essential: keeping you signed in, remembering your session and cart/checkout state
• Preferences: your chosen display currency and dismissed banners
• Notifications: OneSignal stores a token if you enable push notifications

We do not use third-party advertising or cross-site tracking cookies.

9. Children

Minted is not directed at children under 16. We do not knowingly collect personal information from children. Adult-category listings are gated behind an age confirmation.

10. Changes & Contact

We may update this policy from time to time; the "Last updated" date above will change and material changes will be notified in-app.

Questions or privacy requests: contact us via the in-app support chat or at admin@mintedbuysell.com.au.