Privacy Policy

What VapeVic holds about you, why, where it is stored, who else handles it, and how to see, correct or delete it. We never sell or rent any of it.

This page is written for the Privacy Act 1988 and the Australian Privacy Principles.

What we collect

When you order: your name, email address, phone number, shipping address, the items you chose, the order totals and any note you add at checkout. If you upload a transfer receipt, the image is kept with your order record.
When you sign in: the email address you sign in with. Sign-in works by a one-time link emailed to that address, so there is no password for us to store. Every order is filed under an account for its email address, holding the name and phone number from the order, and signing in simply opens that account. If you save delivery addresses to it, we hold those too.
When you browse: standard server logs (IP address, pages requested, browser type), a record of how you found the site, and Google Analytics, which counts visits and the pages read. The cookies and browser storage behind these are listed at the bottom of this page.
When you contact us: whatever you send us by email or WhatsApp, kept so we can deal with the order or question it relates to.
When you leave a review: the name you choose to show and the text you write, linked to the order it came from so we can confirm it was a real purchase.

Why we hold it

To pack and deliver your order, to cancel any order we believe was placed by or for a minor, to answer questions and sort out replacements, to email you about the order as it moves along (placed, paid, shipped or cancelled) and text you when it ships if you gave us an Australian mobile, to see which pages and links bring orders in, and to keep the accounting records Australian law requires. We send no marketing email unless you have asked for it.

Who else sees it

Australia Post receives your name, address and phone number so the parcel can reach you.
Our packing team works from an order-management workspace. Each order is saved first in our database, which is hosted in Sydney, and then copied into that workspace, along with any receipt images.
Our other stores: VapeVic is one of several online stores under common ownership. Orders from all of them go into one shared order system, and your order may be matched to an existing customer record held there.
Fastmail delivers our order and sign-in emails, and Twilio sends the shipping text to Australian mobile numbers.
Our backups hold copies of the order records so they can be restored if something goes wrong.
Google Analytics receives the page visits it counts, but not your order details or the private links to your order.
Google Maps is sent the street address you type at checkout or when saving an address to your account, so it can suggest matching Australian addresses. It does not receive your name, email or phone number.
WhatsApp carries any messages you send us there.
Our bookkeeping sees the order and payment, not your browsing.

We do not sell or rent your details to anyone.

Information held outside Australia

Our order database is in Sydney, but several of the services listed above store or process personal information outside Australia: the order-management workspace, our backups, Fastmail, Twilio, Google Analytics and Google Maps. This means some of your information is held overseas. We use these services only for the purposes described on this page.

How long we keep it

Order records, including any receipt images, are kept for as long as we need them for accounting, tax and after-sales purposes. Saved addresses stay on your account until you remove them or ask us to delete the account.

Your choices

Email orders@vapevic.com to see what we hold about you, correct it, or have it deleted. We will action deletion within a reasonable time, except where we are legally required to keep an order record, in which case we tell you what we have kept and why. If you believe we have mishandled your information you can complain to us first and, if you are not satisfied, to the Office of the Australian Information Commissioner.

Cookies and browser storage

Sign-in cookie: set only when you sign in, to keep your session open.
shop_attr cookie: kept for 30 days. It records the page you first landed on, the site that referred you and any campaign (UTM) tags in the link, and it is sent with your order so we know where the order came from. Because it travels with your order, it is not anonymous. Your most recent visit's details are also kept in the browser's session storage until the tab is closed.
Local storage: your cart and your age confirmation are kept in your own browser.
Google Analytics 4 sets its own cookies to count visits and the pages read. That data is pseudonymous, and we do not tie it to your name.

Clearing this site's cookies and data in your browser removes all of the above; you will then be asked to confirm your age again, and your cart will start empty.