Privacy Policy

• Identity and contact: name, email, phone number, delivery address, country.
• Order information: products ordered, quantities, prices, payment method, payment reference, subscription frequency, delivery choice, order notes.
• Payment information: for card payments Stripe processes your card and gives us only a payment status and reference. For bank transfers we hold the payment reference you quote, never your bank login. We do not store full card numbers.
• Attribution information: which partner link or access code unlocked your device, so your orders are attributed to the right partner and priced correctly.
• Account information: if you create an account, your login email and name (authentication is provided by our hosting platform, Base44).
• Usage information: pages viewed, session length, device type and approximate location derived from your IP address, collected through our own lightweight analytics and browser storage.
• Communications: messages you send a partner through a storefront contact form, and emails or SMS you exchange with us.
• Partner information: for partners, additionally your supplier account details, ABN, payout bank details or Stripe account identifiers, storefront content and sales performance.

We collect information directly from you when you order, sign up, subscribe or contact us, and automatically when you use the platform. You can browse a public storefront landing page without giving us any personal information.

• to take, price, attribute, invoice, fulfil and deliver your orders and subscriptions;
• to send transactional messages about your order (confirmation, payment, dispatch, renewals) by email and, with your consent, SMS;
• to let your partner provide customer service and pickup arrangements;
• to run and secure the platform, prevent fraud and misuse, and meet our legal and tax obligations;
• to understand how the platform is used so we can improve it (aggregated, not to profile individuals);
• with your consent, to send marketing about products, specials or events from your partner or us. Every marketing message includes an unsubscribe link or reply instruction.

We do not sell personal information and we do not use it for automated decisions that have a legal or similarly significant effect on you.

• Your partner. The independent partner whose storefront you order through receives your name, contact details, delivery address and order details so they can fulfil the order and support you. Partners must handle this information in accordance with this policy and privacy law, and may only use it for your order and, with your consent, their own communications with you.
• The product supplier. Where a partner places your order with the product supplier for dispatch, the information needed to deliver to you (name, address, contact details, items) is provided to that supplier in Australia or New Zealand under its own privacy policy.
• Service providers that process data on our instructions: Base44 (hosting, database and authentication), Stripe (card payments, where enabled by your partner), Resend (email delivery), Twilio (SMS), and Anthropic or similar AI providers used only to generate branding suggestions for partners (no customer data is sent to them).
• Regulators, courts and law enforcement where the law requires or permits it, and professional advisers under confidentiality.
• A buyer or successor if the platform or a partner's business is sold or restructured, on the condition that this policy continues to apply.

Some of our service providers store or process data outside Australia, principally in the United States (Base44, Stripe, Resend, Twilio) and, for New Zealand customers, in Australia. Before we disclose information overseas we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles, including through contractual terms and the provider's published security commitments. By using the platform you consent to these disclosures.

We use browser local storage and session storage (not third-party advertising cookies) to remember your cart, your currency, the partner storefront you are attributed to and, if you log in, your session. Clearing your browser storage removes these. Our analytics record page views and session duration against a random session identifier; they are used to see how many people use the platform and for how long, and are not combined with your identity for marketing.

You can opt out of marketing at any time by using the unsubscribe link in any email, replying STOP to an SMS, or emailing info@cali-supplements.com. Opting out does not stop transactional messages about orders or subscriptions you have chosen to receive.

We protect personal information with access controls, encryption in transit, role-based permissions for partners and administrators, and hosting providers that maintain independent security certifications. No system is perfectly secure; if a data breach is likely to result in serious harm we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

We keep order and invoice records for at least 7 years to meet Australian tax law, then delete or de-identify them. Account, subscription and attribution data are kept while your account or subscription is active and for a reasonable period afterwards. Analytics data is aggregated or deleted within 24 months.

• Access: ask for a copy of the personal information we hold about you.
• Correction: ask us to fix information that is inaccurate, out of date or incomplete. You can update most details yourself in your account or at checkout.
• Deletion: ask us to delete information we are not legally required to keep.
• Withdraw consent: for SMS or marketing at any time.
• Anonymity: you can browse without identifying yourself; ordering necessarily requires your details.

Email info@cali-supplements.com to make a request. We will verify your identity and respond within 30 days. If we refuse a request we will tell you why and how to complain.

The platform is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

If you think we have mishandled your information, email info@cali-supplements.com with the details. We will acknowledge your complaint within 7 days and aim to resolve it within 30. If you are not satisfied, you can complain to the OAIC at oaic.gov.au or, in New Zealand, to the Office of the Privacy Commissioner at privacy.org.nz.

We may update this policy as the platform changes; the date at the top shows the current version and material changes will be flagged on the site. Questions and requests: info@cali-supplements.com.