Privacy. One email field.

Last updated 25 July 2026

Who we are

Polymade Store is operated by Inverto Pty Ltd (ABN 90 651 108 566), a company registered in Australia. In this policy, "we", "us", and "Polymade Store" refer to Inverto Pty Ltd trading as Polymade. This policy covers polymade.store only.

What we collect

There are no accounts and no passwords. We collect two things: what you give us when you buy a pack, and what you give us if you join the new-pack list.

When you buy a pack

• Your email address, which you type at checkout and confirm on Stripe's payment page. It is the only identifier we have for a purchase: it is where the download link goes, and it is how you ask for a new one later.
• An order record: which pack, the amount and currency charged, the time of payment, Stripe's own identifiers for the session and the payment, and whether we have delivered your download and when. We keep this for as long as your licence lasts, which is indefinitely, because your right to re-download the pack you bought does not expire and because Australian tax law requires us to keep records of sales for five years.
• A download token, a random string generated at purchase. It is not derived from your email or your order, it is a key that unlocks your download, and anyone holding it can use it until it expires.
• Where you came from, as a website name only: "google.com", or "chatgpt.com", or nothing at all if you typed our address or used a bookmark. Your browser tells every site this. We keep the site name and discard the rest of the address, because the rest can contain whatever you typed into a search box and we have no use for it. It tells us whether search is working, and nothing about you. It is stored on the order and never linked to anything else.

We never see your card. Payment is handled entirely by Stripe on Stripe's own pages; card numbers never reach this site or our servers. Stripe processes that payment as its own data controller under Stripe's privacy policy. We receive only the result: paid or not, the amount, and the email you confirmed.

Pack files are stored with Cloudflare (R2) and delivered to you by a time-limited direct link, so the download comes from Cloudflare rather than through our servers. Delivery email is sent by Resend.

When you join the new-pack list

• Your email address, so we can tell you when a new pack lists.
• A consent record for each signup: the exact consent wording you were shown (currently "Email me when packs launch. Unsubscribe anytime."), the timestamp, the page you signed up from, and your IP address. We keep this to demonstrate that consent was given, as Australian spam law expects.

That is the whole list. Buying a pack does not put you on the new-pack list: the two are separate acts, and the consent box is what distinguishes them. This site sets no cookies of its own and loads no advertising or tracking code. It counts page views using Cloudflare Web Analytics, which is cookieless: no cookie, no identifier, nothing stored in your browser, and no way to recognise you on a second visit or follow you anywhere else. It tells us how many views a page got on a day, not who you are. What we hold for a purchase is the order record, the download token and the referring site name described above, and nothing more: no card details, no browsing history, and no profile of you.

One clarification, because "where you came from" and "tracking" can sound like the same thing. Nothing here follows you between visits, the page counter included. The referring site name is read once when you arrive, kept in your browser's own memory for that tab only, sent to us if and only if you actually buy something, and forgotten when you close the tab. It sets no cookie, it stores no identifier, and it is not readable by anyone else.

• One bot check, loaded only if you submit the form. When you press the join button, the page loads Cloudflare Turnstile to confirm you are a person rather than a script. Cloudflare receives your IP address and basic details about your browser for that check, and it may store a short-lived token in your browser for it. It is not advertising, it is not analytics, and it is not used to profile you. If you never submit the form, none of that code loads at all.

How we use it

• To email you when a new pack lists, for as long as you stay subscribed.
• To keep proof of consent for the emails we send.
• To respond if you contact us.

We don't use your address for anything else, and we don't sell or share it for other people's marketing.

Who we share it with

A small number of service providers touch this data in the course of running the site: our hosting provider (which serves these pages) and the transactional email provider that sends our email. That's all. We don't share personal information with anyone else, except where the law requires it.

Retention

We keep your email address and consent record until you unsubscribe or the list is closed. Every email we send carries a one-click unsubscribe link. If you ask us to delete your details, we do, and we confirm it.

An order record (what you bought, when, and the download link issued for it) is kept for as long as your licence lasts, which is indefinitely: your right to re-download a pack you paid for does not expire, and we cannot honour it without the record. Australian tax law separately requires us to keep records of sales for five years, so five years is the floor rather than the limit.

Your rights

Under the Australian Privacy Act you can ask to see, correct, or delete the personal information we hold about you. Email support@polymade.com.au and we'll action it. If you're not satisfied with how we handle a privacy concern, you can complain to the Office of the Australian Information Commissioner (OAIC).

Changes to this policy

If what we collect changes, this page changes first, with the date at the top updated. The store's data practices will never outrun what this page says.

Contact

Privacy questions and requests: support@polymade.com.au.