Privacy policy

Who we are

Atsume is an online trading card shop, ABN 57 880 380 382. You can contact us about privacy at hello@atsume.com.au.

What we collect and why

When you order

You pay on a secure checkout page run by Stripe, our payment provider. Stripe collects your name, email address, delivery address and payment details. Your card details go to Stripe only: we never see or store them. We receive your name, email, delivery address, phone number if you give one, and what you ordered, so we can post your order, send you tracking and help with any problem. We keep these order details in our own database (Cloudflare D1).

When you sell to us, write to us, sign up for emails or ask to be notified

The sell form, the contact form, the email sign-up and the Notify me forms are handled by our own Cloudflare Worker, not by a separate form service. What you type is saved in Cloudflare D1, a database, and the photos you attach to a sell submission are saved in Cloudflare R2, private file storage. What is saved includes your name and email address, the items you want to sell, your photos, your message and any notes. We also get an email telling us about each submission. We use what you send to reply to you, make an offer, or send the emails you asked for. D1 and R2 are set up with an Oceania location hint, which is a preference and not a guarantee of where the data is kept.

When you send a sell submission, we email you a confirmation with a copy of your list. That email is sent through Resend, an email service based in the United States. Resend keeps email data for 30 days, according to its pricing page.

To keep out spam, these forms use Cloudflare Turnstile, which checks that a person is filling in the form. We also keep a scrambled (hashed) form of your IP address with each submission, never the address itself, so the same connection cannot send more than a few submissions an hour.

Your cart and wishlist

Your cart and wishlist are saved in your own browser on your device. They are not sent to us while you shop. When you go to checkout, the items in your cart (not who you are) are sent to our server so it can check prices and stock and open the Stripe checkout.

Visiting the site

We do not use analytics, advertising or tracking cookies.

Our website is hosted by Cloudflare. Like any web host, Cloudflare processes technical information such as your IP address to deliver pages and protect the site from attacks.

How we use it

• To take payment for, pack and post your order, and to help with returns and refunds.
• To reply to your messages, and to make offers on cards you ask us to buy.
• To send emails you asked for, such as new stock alerts. You can unsubscribe at any time with the link in the email or by emailing us.
• To keep the records of sales the law requires.

We do not sell your personal information, and we do not share it with anyone except the services below, or where the law requires it.

Services that handle information for us

• Stripe: payments and checkout. Stripe's own privacy policy applies to the checkout page: stripe.com/privacy.
• Cloudflare: hosts the website, runs our forms, stores order details and what the forms collect (D1 and R2) and provides the Turnstile spam check.
• Resend: sends you the confirmation email after you send a sell submission, and the email with your tracking number when your order is posted.
• Australia Post: receives your name and delivery address to deliver your order.

Some of these services may store information outside Australia.

How long we keep it

We keep order records for five years, because Australian tax law requires businesses to keep sales records for that long. Sell form submissions, contact messages and email sign-ups are kept until you ask us to delete them, or until we no longer need them.

Seller photos are deleted 12 months after we close the submission. A sell submission you start but do not send is deleted, with any photos, after 7 days. The 12 months is a period we chose, not one the law sets.

Seeing, correcting or deleting your information

Email hello@atsume.com.au to ask what we hold about you, to correct it, or to have it deleted. We will delete anything we are not required to keep by law.

If you are not happy with how we handled a privacy question, tell us first so we can fix it. You can also contact the Office of the Australian Information Commissioner at oaic.gov.au.