Privacy Policy

Who we are

The Hidden Bone is operated by Kristie Amy-Renee Dimitrov, a sole trader, ABN 16 151 100 634. Contact admin@thehiddenbone.com.au for privacy enquiries, access or correction requests, or complaints.

Information we collect

We collect the name, email address, telephone number, delivery address, products and delivery choices you enter for checkout, payment confirmation and fulfilment. Without required information, we may be unable to process or deliver an order. We retain order details, payment references and fulfilment information to administer purchases and resolve problems.

When you browse, our hosting and security services receive technical information such as your IP address, requested pages and browser information. A necessary cart cookie recognises your cart and is configured for up to 30 days. The storefront does not use GA4 or advertising trackers at launch. Security and payment services may use their own necessary technologies.

When you contact us, we receive your correspondence and the information you provide. Please do not send full card numbers or unnecessary sensitive information.

How information is used and shared

We use information to operate and secure the store, calculate delivery options, confirm payments, fulfil orders, provide support and meet applicable legal obligations. We disclose relevant information to the services described below and where required or authorised by law.

Cloudflare hosts and protects the website. Its D1 database and R2 storage support the store. Store administration uses Cloudflare Access and records administrative actions.

Stripe hosts checkout and processes payment credentials. THB does not store your full card number. We receive payment references and status information for confirmation, refunds and reconciliation.

Transdirect receives dispatch and destination locality information, residential or business classification, and parcel dimensions and weights for courier quotations. The quote integration does not send your name, email, phone or street address and does not book freight. When we manually arrange courier delivery, the recipient contact and address details needed for that delivery are supplied to Transdirect and the selected courier.

Google Address Validation receives entered address information when validation is used. Locality approval uses suburb, postcode, state and country. Our application does not retain raw Google validation responses or coordinates. Local delivery eligibility uses an approved locality list, not a distance calculation.

Resend sends transactional order emails containing order and delivery information to customers and authorised store operators. THB records sending and delivery events. Order emails do not subscribe you to marketing. Google Workspace hosts our customer correspondence. Local deliveries are made by the store operator using the information needed to deliver your order.

Overseas processing

Our providers operate internationally, so information may be processed or stored outside Australia. Resend documents storage in the United States. Stripe describes processing in countries including the United States and India. Cloudflare and Google use international infrastructure and service providers. Transdirect also uses service providers to support its operations.

We have not established a complete account-specific list of overseas processing locations for every service. Locations can depend on the service, account settings and provider arrangements; we do not promise Australian-only storage. Contact us for the information available about a particular service. Provider privacy information is linked below.

Security, retention and disposal

Administrative access is restricted to authorised operators. Provider credentials are kept separately from public pages. No online service can guarantee absolute security.

The application schedules removal of unsubmitted delivery details from active carts after 24 hours, with exceptions for carts linked to orders being prepared, open or under review. Shipping quotes become eligible for cleanup 24 hours after expiry, and rate-limit records one hour after expiry. Cleanup may occur later. These processes do not delete paid-order snapshots.

Transaction, inventory, audit and email records do not have a general automatic deletion schedule in the application. We assess retention and disposal against operational needs, applicable record-keeping obligations and unresolved claims. Copies held by providers or in backups may remain subject to their retention processes. We do not promise immediate or unconditional erasure of historical transactions.

Access, correction and complaints

Email admin@thehiddenbone.com.au to request access to or correction of your information, ask about retention, or raise a privacy concern. Explain the issue and include enough information to identify the relevant order or correspondence. We may need to verify your identity before disclosing information or making changes.

The store operator reviews requests, considers applicable obligations and explains the outcome or any limitation. Accurate transaction history may need to be retained even where contact information requires correction. If a concern remains unresolved, you can contact the Office of the Australian Information Commissioner for guidance about whether it can consider your complaint. This policy does not exclude rights available under applicable law.

Policy updates

The effective date identifies the published version. We review this policy when our information handling changes. External services have their own privacy policies; those policies do not replace this explanation of THB’s handling.