Privacy policy

This policy explains what VELLAVI (“we”, “us”) collects when you use vellavi.com.au, why we collect it, and what control you have over it. The short version: we collect the minimum needed to process your fashion order and get it to your door, we don’t sell your data, and you can ask us to delete it at any time.

1. What we collect

• Order data — name, email, shipping address and the items you bought. Collected at checkout, stored in our database (hosted on Supabase), and kept for as long as required for accounting and warranty claims.
• Payment data — handled entirely by Stripe. Your card number never touches our servers; we receive only a payment confirmation, the last four digits and the billing country.
• Support messages — anything you send through the contact form or by email, kept so we can follow the conversation.
• Technical data — if you accept analytics cookies, anonymised page views and referral sources. See the cookie policy.

2. What we use it for

• Fulfilling and shipping your orders, and sending order updates.
• Handling returns, refunds and warranty claims.
• Answering support requests.
• Understanding, in aggregate, which products people care about.
• Meeting legal obligations (tax, accounting, consumer law).

We do not sell or rent personal data, and we don’t run third-party advertising trackers.

3. Who we share it with

• Stripe — payment processing (their policy).
• Supabase — database hosting for orders and support messages.
• Vercel — website hosting and delivery.
• Shipping carriers — your name and address, so the parcel arrives.
• Resend or our configured mail provider — your email address and order status, when you select package updates.
• Approved fulfilment partners — the order and delivery details needed to send your items.

Each provider processes data only on our instructions. We share data with authorities only where the law requires it.

4. How long we keep it

Order records are kept for the period required by tax law (typically 6–7 years, depending on jurisdiction). Support conversations are kept for 24 months after the last message. Analytics data is anonymised and holds no personal identifiers.

5. Your rights

Depending on where you live (including under the GDPR and CCPA), you can ask us to access, correct, export or delete the personal data we hold about you, object to processing, withdraw consent for optional cookies, or opt out of package updates at checkout. Email privacy@vellavi.com.au and we’ll respond within 30 days. You also have the right to complain to your local data protection authority.

6. Security

Traffic is encrypted end-to-end (TLS). Databases are access-controlled with row-level security, and payment credentials never reach our infrastructure. No system is perfect; if a breach ever affects your data, we will notify you without undue delay.

7. Children

The store is not directed at children under 16 and we do not knowingly collect their data. If you believe a minor has provided us data, contact us and we will delete it.

8. Changes

If this policy changes materially, we’ll flag it on the site before the change takes effect. The “last updated” date at the top always reflects the current version.

9. Contact

Privacy questions: privacy@vellavi.com.au. Everything else: the contact page.