Privacy Policy

[LEGAL ENTITY] (ABN [ABN]) runs CartCat. This policy explains what personal information CartCat collects, why, who it goes to, and what you can do about it. It is written against the Australian Privacy Principles. Questions or complaints go to [PRIVACY EMAIL].

1. What we collect

When you create an account

• Your email address, your password (stored only as a one-way hash), your username and display name.
• Optionally, a profile photo, banner, bio and location you choose to show.

When you sign in

• A session record with the IP address and browser or device it was created from, so you can see and end your sessions, and so we can spot abuse.

When you verify a phone number

• Your mobile number. We use it to send verification codes and, for Quicksell, to reach you about a parcel. It is never shown to other members.

When you buy

• Your shipping address, and the order, its payment status and its tracking.
• We do not receive or store your card number. Card details go straight to Stripe (§5).
• If you pay with Apple Pay or Google Pay, your wallet passes your card and shipping address to Stripe. Apple and Google handle that under their own privacy policies.

When you sell

• Your listings, with their photos, condition notes and prices.
• Your sales, the tracking numbers you add, and feedback.
• To pay you, Stripe collects your identity and bank details directly, including the identity check Stripe is legally required to run. We keep only your Stripe account ID and the payout status Stripe reports back.

When you sell to CartCat (Quicksell)

• Your name, return address, phone number, any notes, the parcel's tracking number, and our inspection notes on the games you send.
• How you want to be paid: bank account name, BSB and account number, or a PayPal email. These are encrypted when stored, seen only by the staff who make the payment, and deleted once you're paid. We keep a short summary (for example "Bank transfer, account ending 678").
• [SECOND-HAND DEALER LICENCE]: the law requires a register of every item we buy and who sold it to us: your name, address, phone and email, a record of your identity document (its type and number, the number stored encrypted), what we bought and what we paid. The register is kept for as long as that law requires.

When you connect eBay (optional, sellers only)

• Your eBay user ID and username.
• A sign-in token eBay issues so CartCat can act on your eBay listings. It is encrypted before it is stored, and we never see your eBay password: you sign in on eBay's own site.
• The permissions you granted, and for each copy CartCat lists for you, its eBay listing, offer and SKU IDs and a history of when it last synced.
• For eBay sales of those copies, the eBay order ID and the quantity sold. We don't store the eBay buyer's details.

See §7 for what CartCat does with the connection and what disconnecting does.

When you list from a photo

• The photo you upload, and what was read from it (§6 says how long we keep them).

When you use the site

• Your collection, wantlist, cart, saved settings and notifications.
• Messages and offers you exchange with other members.
• Catalogue corrections and photos you submit, and support requests (including the email address you write from).

When you ask for sold prices

Sold prices cost CartCat money to fetch, so each person gets a daily allowance. We count how many fetches each account causes each day. For visitors who aren't signed in we keep the same count against a scrambled (salted, one-way hashed) form of the IP address, never the address itself, along with its first three parts (for example 203.0.113.x), which shows us where heavy use comes from.

Logs

Our servers keep operational logs: request paths, errors and timings. The logging code is written not to record passwords, tokens or card details.

We don't use advertising trackers or third-party analytics.

2. Why we use it

• To run the marketplace: accounts, listings, checkout, holding and releasing sellers' payments, postage tracking, messages, feedback and disputes.
• To run Quicksell: reviewing your list, sending postage, inspecting and paying you, and keeping the register the law requires.
• To keep CartCat safe: stopping fraud, spam and abuse, rate limits, bot checks, and enforcing the Terms.
• To keep you informed: order, offer, Quicksell and wantlist emails and texts. You can switch the optional ones off in Settings.
• To meet legal obligations: tax, accounting, second-hand dealer and payment-provider requirements.
• To act on eBay for you: only for copies you choose to list there, and only while eBay is connected.

We don't sell personal information, and we don't use it to advertise to you on other sites.

3. What other members can see

• Your username, display name, avatar and any public profile details.
• Your active listings, your feedback, and your collection if you make it public. Purchase prices and dates in your collection are never public.

When you buy, the seller sees your name and shipping address so they can send the item. When you message someone, they see what you send. Your email address and phone number are never shown to other members.

4. Cookies

CartCat uses the cookies it needs to work:

• your sign-in session;
• the preferences you choose: theme, display currency, region, eBay marketplace, and how browse pages are laid out;
• the beta access gate, while it exists;
• a ten-minute pass after the bot check that comes before fetching sold prices, for visitors who aren't signed in.

Cloudflare Turnstile may set its own cookie during the sign-up bot check, or the check before a signed-out visitor's first sold-price fetch.

When you're signed in and looking at a listing you could buy, or at your cart, CartCat loads Stripe's code so checkout opens without waiting. Stripe also uses it to spot fraud: it looks at your browser and device, and how you move through the page. It may run an hCaptcha check and set its own cookies (__stripe_mid, __stripe_sid). Stripe says it uses this only for fraud prevention and security, never advertising. Visitors who aren't signed in don't load Stripe.

We don't use advertising or analytics cookies.

5. Who we share it with

We share personal information only with these services, each for the purpose shown:

Some of these services are outside Australia, mostly in the United States. We use providers whose terms bind them to protect the information, and share it only so they can provide their service to us.

We'll also disclose information when the law requires it, to the police where we believe an item sold to us is stolen, or to protect someone's safety or rights.

6. How long we keep it

While your account is open, we keep what's needed to run it.

When you close your account:

• Deleted: your sign-in methods and sessions, collection, wantlist, cart, saved addresses, phone number, settings and notifications.
• Removed: your active listings. Your email address is replaced.
• Ended: eBay listings CartCat created for you, and the eBay connection.
• Kept: your username, display name and avatar, so that past orders, feedback and conversations still show who they were with.
• Kept as long as the law requires: order, payment and payout records, for accounting, tax and disputes, and the second-hand dealer register. Messages and feedback stay because they are part of other members' records too.

Quicksell payment details are deleted once you're paid.

Photos uploaded to "List from a photo" are kept for 14 days, so a half-finished pile can be completed, and then deleted with what was read from them. The crop of each game you list becomes that listing's photo and stays with it. You can remove a photo sooner from the same page.

Logs are kept for [LOG RETENTION] and then deleted.

7. Your eBay connection

With your permission, and only for copies you choose to list on eBay, CartCat:

• reads your eBay business policies and item locations, so you can pick them;
• creates the eBay listing and keeps its title, photos, price and quantity in step with CartCat;
• ends the eBay listing when the copy sells or you take it off eBay;
• takes a copy that sells on eBay off your CartCat stock.

You can disconnect eBay at any time on Sell → eBay:

• CartCat deletes the stored eBay token and asks eBay to revoke it.
• CartCat stops updating your eBay listings, but does not end them. They stay live on eBay until you end them there.
• CartCat keeps your eBay user ID and the listing IDs, so reconnecting picks up where you left off.

eBay doesn't always revoke a token straight away. To be certain CartCat has no access, also remove CartCat under Third-party app access in your eBay account settings.

If you close your eBay account, eBay tells CartCat, and we erase the eBay user ID, username and token we hold for it.

8. Your choices and rights

Seeing your information. Most of it is in Settings. You can download a copy of what your account holds (profile, settings, saved address, collection, wantlist, listings, orders and Quicksell orders) as one file with "Download my data" in Settings → Your data. For anything else, ask at [PRIVACY EMAIL]; we'll reply within 30 days.

Correcting it. Change it in Settings, or ask us.

Closing your account. In Settings (§6 says what happens).

Complaints. Write to [PRIVACY EMAIL] first. If you're not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9. Security

• Passwords are hashed.
• eBay tokens, Quicksell payment details and identity document numbers are encrypted.
• Card details are handled by Stripe.
• Access to production systems is restricted to the people who need it.

No system is perfectly secure. If a breach is likely to cause you serious harm, we'll tell you and the regulator as the law requires.

10. Children

CartCat is not for anyone under [MIN AGE], and we don't knowingly collect information from them.

11. Changes

If we change this policy in a way that matters, we'll update the effective date and tell signed-in members before the change applies.

[LEGAL ENTITY], [REGISTERED ADDRESS], [PRIVACY EMAIL]