Privacy Policy

Effective 11 August 2026

What we collect, why we collect it, and the controls you have.

In short

Key points

We only collect what we need to run your account and process payments
Card details go straight to Stripe (PCI-DSS Level 1) and are never received by us; we keep only the card brand, last four digits and issuing country against your order
We do not sell your data and do not use account data to train AI models
You can access, correct, port, or delete your data. Write to support@supa.place
We comply with the Australian Privacy Act and the Notifiable Data Breaches scheme
You must be 18 to use supa.place; the service is not directed to anyone under 18

Who We Are

supa.place is operated by Noah Harvard Biesse, trading as SUPA PLACE, ABN 44 590 119 237, an Australian sole trader. In this policy “supa.place”, “we” and “us” mean that business, and it is the data controller for the personal information described here. Where the EU or UK GDPR applies, it is the controller for the purposes of those regulations.

Contact. support@supa.place reaches us for any privacy question, request or complaint, and is the fastest route. Our registered business address and phone number are published under “Business identification” in the footer of every page.

We have not appointed a data protection officer, and are not required to: we do not carry out large-scale monitoring or process special categories of data at scale. Privacy requests are handled directly by the business owner.

Information We Collect

To provide our service, we collect the information you give us: your name and email for account creation, profile details, content you upload, and messages you send to other users on the platform. When you make a purchase, we collect the billing country you select and, if you provide one, a business tax or VAT identification number, so we can calculate any tax due and issue a valid tax invoice. Card details are entered directly into the secure fields hosted by our payment provider and are never received or stored by us. What the provider does return to us, and what we keep against your order, is limited to: the card brand and last four digits (so your receipt and purchase history are recognisable), the country that issued the card, and the payment and refund reference numbers the provider assigns. We use the card-issuing country as corroborating evidence of where you are located for consumption-tax purposes, alongside the billing country you select and your IP country, so that our record of where you were located rests on more than your own selection alone. We also collect basic technical information, such as IP address, device, and browser type, that we need to keep the platform secure and reliable.

Legal Basis for Processing

We process personal information on the following bases:

Contract — to run your account, process your payments, and deliver products you purchase.
Consent — where required, for non-essential cookies or optional marketing communications.
Legitimate interests — to operate, secure, and improve the platform, balanced against your privacy.
Legal obligation — to meet tax, anti-fraud, accounting, and information-request requirements.

Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies to you, these are our Article 6 lawful bases.

How We Use Your Information

Your information is used to operate and improve supa.place. This includes processing payments, enabling communication between buyers and sellers, personalising your experience, and protecting the platform from fraud and abuse. We infer your approximate country from your IP address to display prices in your local currency by default, and we use the billing country you confirm at checkout to determine any consumption tax due on your purchase; you can change your currency at any time from Dashboard → Settings. We do not sell your personal data to third parties, and we do not use your account data to train AI models.

Key point

Service Providers and Data Sharing

We share data only with the service providers we need to run the platform:

Stripe — card and wallet payment processing, fraud screening, and refunds. Stripe receives your card details directly from your browser, along with your email address and billing country, and acts as an independent controller for its own fraud-prevention and regulatory purposes. Stripe is a United States company and also operates through local entities including Stripe Payments Australia Pty Ltd.
Airwallex — the accounts that hold settled funds, currency conversion, and payments out to sellers. Airwallex receives seller payout details (bank account and account-holder name); it does not receive buyer card details.
Klarna, Apple Pay, Google Pay and Link — alternative ways to pay, offered at checkout alongside the card form depending on your device, browser and country. These run inside the payment sheet, so if you choose one you deal with that provider directly: it receives the payment details you give it, the order amount and currency, and the email and billing address you supply in its sheet, and it hands back to us only what we need to fulfil the order. Each acts as an independent controller for its own purposes, and Klarna additionally assesses you for the credit it is providing. If you never select one of these, it receives nothing about you. supa.place is not a party to your agreement with any of them.
Didit — identity verification for sellers only, which is required before a seller's listings can be published. When you register as a seller, Didit collects your legal name, date of birth, residential address and a government-issued photo ID, and takes a live selfie to match against that ID. It uses these to confirm the document is genuine, that you are the person it belongs to, and to screen your name against international sanctions and politically-exposed-person lists, which we are required to check before paying anyone out. supa.place receives the verification outcome, the verified name, country and date of birth, and a reference to the session; we do not receive or store your ID document image or your selfie, which stay with Didit under its own retention schedule. Buyers are never asked to verify identity, and Didit receives nothing about buyers.
Google Cloud / Firebase — application hosting, authentication, database (Firestore), and file storage.
Resend — transactional email delivery (receipts, verification, password resets, refund notifications).
PostHog — product analytics (pageviews, feature-usage events, and JavaScript error reports) to help us understand how the site is used and diagnose bugs. Session recordings, autocapture, and surveys are disabled.
Google AI (Gemini) — powering the “Ask Supa” assistant on our Help page (see AI Processing below).
EU VIES (European Commission) — if you enter an EU business VAT number at checkout to claim reverse-charge (B2B) treatment, we send that VAT number and your country to the EU Commission's VIES service solely to confirm the number is valid.
HM Revenue & Customs (UK) — if you enter a UK VAT registration number at checkout to claim reverse-charge (B2B) treatment, we send that number to HMRC's VAT-number checking service solely to confirm it is valid. We also report and remit the UK VAT we collect to HMRC under Making Tax Digital; those returns carry VAT totals for the period, not your individual purchase details.

Where we act as the merchant of record for consumption tax (VAT), we report and remit the tax we collect to the relevant tax authorities — the EU member states (through the EU One Stop Shop) and, for UK supplies, HMRC. These filings report VAT aggregated by country and rate, not your individual purchase details; the underlying transaction and tax-invoice records are retained to meet our tax obligations (see Data Retention). When you list a public profile or leave a public review, that information is visible to other users. We may also share information when required by law, regulation, or valid legal process, or to protect the rights, safety, and integrity of supa.place and its users.

AI Processing

The “Ask Supa” assistant on our Help page is an AI service powered by Google Gemini. The questions and conversation history you submit during a session are sent to Google to generate a response. We do not retain those conversations after your session ends, and they are not used to train Google's models under the service tier we use. Please do not share account credentials, payment details, or sensitive personal information with the assistant; for those, use the human contact form on the same page.

International Data Transfers

Some of the service providers listed above process data outside Australia, including in the United States, the European Union and the United Kingdom. Payment data in particular is processed by Stripe in the United States, and settlement and payout data by Airwallex in the jurisdictions where it holds our accounts. Where we act as the merchant of record for consumption tax (VAT), a limited amount of transaction and VAT-number data may also be shared with EU tax authorities, the EU VAT-validation service (VIES), and HM Revenue & Customs in the United Kingdom, to charge the correct tax and validate business VAT numbers. When personal information is transferred internationally, we rely on the safeguards required by the Australian Privacy Act and, where applicable, the GDPR Standard Contractual Clauses or equivalent mechanisms approved by the relevant authorities.

Data Retention

We keep personal data only for as long as we need it. As a guide:

Account information — while your account is active, plus up to 12 months after deletion to handle disputes and legal requests.
Purchase, refund, payout, and tax-invoice records — 10 years, to meet Australian tax and accounting rules and, where we act as merchant of record, EU VAT record-keeping obligations (the EU One Stop Shop record-keeping period). The same 10 years comfortably covers the UK's 6-year VAT record-keeping requirement.
Support correspondence — up to 24 months.
Server and security logs — up to 12 months.
“Ask Supa” chat content — not retained after the session ends.

After these periods, data is deleted or irreversibly de-identified.

Key point

Security

We take the security of your data seriously. All payment processing is handled by Stripe, a PCI-DSS Level 1 provider. Internally we use access controls, encryption in transit, Firebase App Check to protect API endpoints, and monitoring to guard against unauthorised access. While no online service can be perfectly secure, we apply industry-standard protections and review them regularly.

Your Rights and Choices

You have the right to:

access the personal information we hold about you;
correct or update inaccurate information;
delete your account and associated data, available in Dashboard → Settings → Account → Delete account, or by writing to support@supa.place;
restrict or object to certain processing;
receive your data in a portable format;
withdraw consent where you previously gave it; and
lodge a complaint with the Office of the Australian Information Commissioner (OAIC), or a relevant supervisory authority outside Australia.

We will respond to verified requests within 30 days. Some statutory and tax records (see Data Retention) cannot be deleted before their retention period expires, but those records are not used for any purpose other than the legal one for which they are kept.

Key point

Data Breach Notification

If a data breach occurs that is likely to result in serious harm to affected users, we will notify those users and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme of the Australian Privacy Act 1988. Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, in line with Article 33.

Age Requirement and Minors

You must be at least 18 years old to use supa.place, as set out in our Terms of Service. The service is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we become aware that an account belongs to someone under 18 we close it and delete the personal information held for it, other than any record we are legally required to keep. If you believe a minor has provided us with personal information, please contact support@supa.place and we will delete it.

Cookies and Tracking

We use cookies and similar technologies in two categories. Strictly necessary technologies keep you signed in, remember preferences like your currency, secure your downloads and protect the site; they cannot be switched off without breaking it. Analytics (PostHog) is optional and stays off until you accept it on the consent banner shown on your first visit. You can change your choice at any time via the Cookie preferences link in the site footer, or control cookies directly through your browser settings.

The complete list of what we set, and why:

Name	Type	Purpose	Retained
gc	Cookie, strictly necessary	Stores the two-letter country code we derive from your IP address, so prices can default to your local currency without re-detecting it on every page.	30 days
guestDlToken	Cookie, strictly necessary	Proves a guest download link belongs to you, so you can download what you bought without an account. Server-only (HttpOnly) and scoped to the download endpoint.	1 hour
dlBind	Cookie, strictly necessary	Binds an in-progress file download to the browser that requested it, so a download link cannot be reused elsewhere. Server-only (HttpOnly).	10 minutes
Firebase authentication	Browser storage, strictly necessary	Keeps you signed in between visits and refreshes your session token. Set by Firebase Authentication, our sign-in provider.	Until you sign out
cart, recipientEmail	Browser storage, strictly necessary	Remembers what is in your cart and the email you last used at checkout, so neither is lost if you navigate away or reload.	Until cleared
cookieConsent	Browser storage, strictly necessary	Records your cookie choice and when you made it, so we do not ask again on every visit and analytics stays off unless you accepted it.	Until cleared
theme, accentColor, notificationSettings, currency	Browser storage, strictly necessary	Remembers display preferences you set: light or dark mode, accent colour, notification and toast behaviour, and your chosen display currency.	Until cleared
ph_*_posthog	Cookie, analytics (optional)	PostHog product analytics: counts pageviews and feature usage against a random identifier so we can see what is used and diagnose errors. Set only after you accept analytics. Session recording, autocapture and surveys are disabled.	12 months

Several of the entries above are browser storage rather than cookies: they stay on your device and are never transmitted to us. We list them here anyway, because the distinction matters less to you than knowing what is stored. Your cookie choice itself is recorded in browser storage rather than a cookie, so it is not sent to our servers; clearing your browser storage will make the consent banner appear again.

Payment pages load fields hosted by Stripe, and the payment providers named above set their own cookies inside those fields to process the payment and detect fraud. Those are governed by the provider's own privacy notice, not this one.

Automated Decision-Making

Some decisions on supa.place are made automatically, without a person looking at them first. We do not use automated processing to profile you, and none of the processes below produces a legal effect on you within the meaning of Article 22 of the GDPR; each one is either reversible on request or reviewed by a person when you ask. Where a decision affects you, you can always contact support@supa.place to have a person review it, put your point of view, and contest the outcome.

Fraud screening on payments. Stripe scores each payment attempt using the card details, the amount, the country, and device and network signals, and may decline a payment on that basis. The decision is Stripe's, made under its own fraud-prevention responsibilities. A declined payment does not create an account record against you and you can simply try another payment method or contact us.
Identity verification for sellers. Didit checks your ID document and selfie automatically and returns a pass, fail, or refer outcome, and screens your name against sanctions and politically-exposed-person lists. A failed or referred check does not automatically close anything: it means a person reviews it, and you can send us further documents.
Payout risk reserve. If refunds and chargebacks on your sales exceed a published threshold over a rolling 90-day window, part of your withdrawable balance is automatically held back at a published rate. This is computed from your own sales and refund history only. It delays access to funds and never takes them, and it falls away on its own as the rate comes down. The thresholds are set out in the Fee Disclosure.
Refund escalation. A refund request a seller has not decided within 14 days is escalated automatically to supa.place. The escalation is automated; the decision that follows it is made by a person.
Abuse limits. Rate limits on downloads, messages and requests are applied automatically to protect the platform. Hitting one is temporary and clears by itself.

Privacy Contact

For privacy-related questions, requests to exercise your rights, or to report a privacy concern, please contact support@supa.place. For all other support enquiries, use the contact form on our Help page.

Policy Updates

We may update this policy from time to time. We will notify you of any significant changes, but we recommend reviewing it periodically. Your continued use of the platform after changes constitutes acceptance of the updated policy.

Privacy Policy

Effective 11 August 2026

What we collect, why we collect it, and the controls you have.

In short

Key points

We only collect what we need to run your account and process payments
Card details go straight to Stripe (PCI-DSS Level 1) and are never received by us; we keep only the card brand, last four digits and issuing country against your order
We do not sell your data and do not use account data to train AI models
You can access, correct, port, or delete your data. Write to support@supa.place
We comply with the Australian Privacy Act and the Notifiable Data Breaches scheme
You must be 18 to use supa.place; the service is not directed to anyone under 18

Who We Are

Information We Collect

Legal Basis for Processing

We process personal information on the following bases:

Contract — to run your account, process your payments, and deliver products you purchase.
Consent — where required, for non-essential cookies or optional marketing communications.
Legitimate interests — to operate, secure, and improve the platform, balanced against your privacy.
Legal obligation — to meet tax, anti-fraud, accounting, and information-request requirements.

Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies to you, these are our Article 6 lawful bases.

How We Use Your Information

Key point

Service Providers and Data Sharing

We share data only with the service providers we need to run the platform:

Stripe — card and wallet payment processing, fraud screening, and refunds. Stripe receives your card details directly from your browser, along with your email address and billing country, and acts as an independent controller for its own fraud-prevention and regulatory purposes. Stripe is a United States company and also operates through local entities including Stripe Payments Australia Pty Ltd.
Airwallex — the accounts that hold settled funds, currency conversion, and payments out to sellers. Airwallex receives seller payout details (bank account and account-holder name); it does not receive buyer card details.
Klarna, Apple Pay, Google Pay and Link — alternative ways to pay, offered at checkout alongside the card form depending on your device, browser and country. These run inside the payment sheet, so if you choose one you deal with that provider directly: it receives the payment details you give it, the order amount and currency, and the email and billing address you supply in its sheet, and it hands back to us only what we need to fulfil the order. Each acts as an independent controller for its own purposes, and Klarna additionally assesses you for the credit it is providing. If you never select one of these, it receives nothing about you. supa.place is not a party to your agreement with any of them.
Didit — identity verification for sellers only, which is required before a seller's listings can be published. When you register as a seller, Didit collects your legal name, date of birth, residential address and a government-issued photo ID, and takes a live selfie to match against that ID. It uses these to confirm the document is genuine, that you are the person it belongs to, and to screen your name against international sanctions and politically-exposed-person lists, which we are required to check before paying anyone out. supa.place receives the verification outcome, the verified name, country and date of birth, and a reference to the session; we do not receive or store your ID document image or your selfie, which stay with Didit under its own retention schedule. Buyers are never asked to verify identity, and Didit receives nothing about buyers.
Google Cloud / Firebase — application hosting, authentication, database (Firestore), and file storage.
Resend — transactional email delivery (receipts, verification, password resets, refund notifications).
PostHog — product analytics (pageviews, feature-usage events, and JavaScript error reports) to help us understand how the site is used and diagnose bugs. Session recordings, autocapture, and surveys are disabled.
Google AI (Gemini) — powering the “Ask Supa” assistant on our Help page (see AI Processing below).
EU VIES (European Commission) — if you enter an EU business VAT number at checkout to claim reverse-charge (B2B) treatment, we send that VAT number and your country to the EU Commission's VIES service solely to confirm the number is valid.
HM Revenue & Customs (UK) — if you enter a UK VAT registration number at checkout to claim reverse-charge (B2B) treatment, we send that number to HMRC's VAT-number checking service solely to confirm it is valid. We also report and remit the UK VAT we collect to HMRC under Making Tax Digital; those returns carry VAT totals for the period, not your individual purchase details.

AI Processing

International Data Transfers

Data Retention

We keep personal data only for as long as we need it. As a guide:

Account information — while your account is active, plus up to 12 months after deletion to handle disputes and legal requests.
Purchase, refund, payout, and tax-invoice records — 10 years, to meet Australian tax and accounting rules and, where we act as merchant of record, EU VAT record-keeping obligations (the EU One Stop Shop record-keeping period). The same 10 years comfortably covers the UK's 6-year VAT record-keeping requirement.
Support correspondence — up to 24 months.
Server and security logs — up to 12 months.
“Ask Supa” chat content — not retained after the session ends.

After these periods, data is deleted or irreversibly de-identified.

Key point

Security

Your Rights and Choices

You have the right to:

access the personal information we hold about you;
correct or update inaccurate information;
delete your account and associated data, available in Dashboard → Settings → Account → Delete account, or by writing to support@supa.place;
restrict or object to certain processing;
receive your data in a portable format;
withdraw consent where you previously gave it; and
lodge a complaint with the Office of the Australian Information Commissioner (OAIC), or a relevant supervisory authority outside Australia.

Key point

Data Breach Notification

Age Requirement and Minors

Cookies and Tracking

The complete list of what we set, and why:

Name	Type	Purpose	Retained
gc	Cookie, strictly necessary	Stores the two-letter country code we derive from your IP address, so prices can default to your local currency without re-detecting it on every page.	30 days
guestDlToken	Cookie, strictly necessary	Proves a guest download link belongs to you, so you can download what you bought without an account. Server-only (HttpOnly) and scoped to the download endpoint.	1 hour
dlBind	Cookie, strictly necessary	Binds an in-progress file download to the browser that requested it, so a download link cannot be reused elsewhere. Server-only (HttpOnly).	10 minutes
Firebase authentication	Browser storage, strictly necessary	Keeps you signed in between visits and refreshes your session token. Set by Firebase Authentication, our sign-in provider.	Until you sign out
cart, recipientEmail	Browser storage, strictly necessary	Remembers what is in your cart and the email you last used at checkout, so neither is lost if you navigate away or reload.	Until cleared
cookieConsent	Browser storage, strictly necessary	Records your cookie choice and when you made it, so we do not ask again on every visit and analytics stays off unless you accepted it.	Until cleared
theme, accentColor, notificationSettings, currency	Browser storage, strictly necessary	Remembers display preferences you set: light or dark mode, accent colour, notification and toast behaviour, and your chosen display currency.	Until cleared
ph_*_posthog	Cookie, analytics (optional)	PostHog product analytics: counts pageviews and feature usage against a random identifier so we can see what is used and diagnose errors. Set only after you accept analytics. Session recording, autocapture and surveys are disabled.	12 months

Automated Decision-Making

Fraud screening on payments. Stripe scores each payment attempt using the card details, the amount, the country, and device and network signals, and may decline a payment on that basis. The decision is Stripe's, made under its own fraud-prevention responsibilities. A declined payment does not create an account record against you and you can simply try another payment method or contact us.
Identity verification for sellers. Didit checks your ID document and selfie automatically and returns a pass, fail, or refer outcome, and screens your name against sanctions and politically-exposed-person lists. A failed or referred check does not automatically close anything: it means a person reviews it, and you can send us further documents.
Payout risk reserve. If refunds and chargebacks on your sales exceed a published threshold over a rolling 90-day window, part of your withdrawable balance is automatically held back at a published rate. This is computed from your own sales and refund history only. It delays access to funds and never takes them, and it falls away on its own as the rate comes down. The thresholds are set out in the Fee Disclosure.
Refund escalation. A refund request a seller has not decided within 14 days is escalated automatically to supa.place. The escalation is automated; the decision that follows it is made by a person.
Abuse limits. Rate limits on downloads, messages and requests are applied automatically to protect the platform. Hitting one is temporary and clears by itself.