Privacy policy

Last updated 2 November 2026

Who we are

Karmafolk ("we", "us") is an online store based in Australia, operating at karmafolk.com. This policy explains how we handle personal information in line with the Australian Privacy Principles. You can reach us any time through our contact form.

What we collect

• Orders: your name, email, phone number, and shipping and billing addresses, collected at checkout.
• Payments: handled by Stripe. Your card details go straight to Stripe and we never see or store your full card number.
• Messages: your name, email and message when you use our contact form.
• Reviews: your name, suburb or town, rating, review and email. Your email is kept private and only used to check your order and contact you about your review.
• New arrival lists: your email address, if you ask us to let you know when new products land.
• Your bag: the items in your bag are saved in your own browser so they're still there when you come back. This stays on your device.
• Technical information: like most websites, our hosting and security providers process your IP address and basic device information to deliver the site and protect it from abuse.

Shop activity notes

The site may show short notes about real recent activity, such as "Someone in Bondi, NSW just added the Yin-Yang Mat to their bag" or "Sophie in Mosman, NSW bought the Yin-Yang Mat". These only ever describe real activity. Add to bag notes use an approximate location worked out from your connection and never include your name. Purchase notes show only a first name, suburb or town and state, never surnames, addresses, emails or order details. If you'd prefer your purchase not to be shown, let us know through the contact form and we'll remove it.

How we use it

• To process, ship and support your orders, including returns and refunds.
• To reply to your messages and review enquiries.
• To send you new arrival emails, only if you asked for them. You can opt out at any time.
• To keep the site secure and working well, and to meet our legal and tax obligations.

Who we share it with

We share information only with the service providers who help us run the shop, and only what they need:

• Stripe, for secure payments.
• Australia Post, to deliver your order.
• Mailgun, to deliver emails from our website forms.
• Cloudflare and our Australian web host, to deliver and protect the website.

Some of these providers store or process data overseas, including in the United States. We choose providers with strong security and privacy practices. We may also disclose information where required by law.

Cookies and tracking

We don't currently use advertising or analytics cookies. Our security provider may set essential cookies to protect the site, and Stripe sets its own cookies on the checkout page. If we add analytics or advertising tools in future, we'll update this policy.

Keeping it safe

We take reasonable steps to protect your information from misuse, loss and unauthorised access, and we keep it only as long as we need it for the purposes above or as required by law.

Access, correction and complaints

You can ask to see or correct the personal information we hold about you, or ask us to delete it, through our contact form. If you have a privacy concern, tell us and we'll respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

We may update this policy from time to time. The latest version will always be on this page.