Privacy policy

Skinova Diary is an Australian online store selling Korean and Japanese skincare. In this policy, "we" and "us" mean Skinova Diary. You can reach us at support@skinovadiary.com or by post at .

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988. As a small business we may not be legally required to, but we choose to follow them.

• When you order: your name, email address, delivery address, the items you bought and the order total. Your card details go directly to Stripe and aren't stored on, or visible to, our systems.
• When you create an account: your name, email address and a password (stored only in hashed form). If you continue with Google, we receive your name and email address from Google.
• When you subscribe to our newsletter: your email address.
• When you contact us: your name, email address and what you tell us, including any photos you send.
• When you use the site: technical information such as your browser, device, pages visited and approximate location, collected by cookies and similar tools (see below), and your IP address, which we use briefly to limit repeated sign-in or sign-up attempts.

We don't ask for sensitive information such as health details. If you send us information about a skin reaction, we use it only to look into your request.

Mostly directly from you, when you order, create an account, subscribe or email us. Some information is collected automatically through cookies, tags and server logs when you use the site, and some comes from Google if you choose to sign in with Google.

• to process, deliver and support your orders, including emailing confirmations, shipping updates, email verification and password resets
• to show your order history in your account
• to answer your questions and handle returns and complaints
• to keep the store safe and prevent fraud and abuse
• to understand how the site is used and to measure and improve our advertising (see below)
• to keep the business and tax records the law requires
• if you subscribed: to send you our newsletter

We don't sell your personal information.

We use service providers that run the store for us. They may handle your information only to do that job:

• Stripe: card payments
• Resend: sending our emails
• Google: sign-in (only if you choose Google), and analytics and advertising tools (see below)
• Vercel: hosting
• Prisma Postgres: our database
• Upstash: short-term caching and rate limiting
• Cloudinary: hosting product images (no personal information is intended to be sent)
• Our delivery carrier: to deliver your order, so it receives your name, address and contact details
• Meta and TikTok: advertising and measurement tools (see below)

We may also share information where the law requires or allows it, for example to a regulator or to protect against fraud.

Some of these providers store or process information outside Australia. Where they do, we take reasonable steps to make sure they handle it in line with the APPs. This includes the United States. A provider's own privacy policy also applies to what it does.

We use or may use these tools on our storefront. A tool only loads when we've turned it on:

• Google Analytics 4, to see how visitors use the site (pages viewed, what's added to cart, purchases).
• Google Ads, to measure whether our ads lead to purchases.
• Meta pixel (Facebook and Instagram), to measure ads and build audiences.
• TikTok pixel, to measure ads and build audiences.

These tools use cookies or similar identifiers and send information such as the pages you view and the items you buy to Google, Meta and TikTok. They aren't used on our admin pages.

You can opt out: use the controls in your Google account's ad settings and Google's Analytics opt-out options, your Meta ad preferences, and your TikTok ad settings; block or clear cookies in your browser; or turn on "Do Not Track" or privacy tools that block trackers. Email us if you need help.

• Needed to run the store: cookies that keep you signed in, keep checkout working, and (briefly) handle Google sign-in. Your cart is saved in your own browser.
• Welcome code: if you open the link in our welcome email, a cookie called welcome_code remembers your 10% code for 30 days so it can be applied at checkout. It holds the code only and isn't used for advertising.
• Analytics and advertising cookies: the tools above, when switched on.

You can block or delete cookies in your browser settings, but parts of the store (such as staying signed in) may not work.

We only send you marketing emails if you subscribed or otherwise agreed. Every marketing email will have an unsubscribe link, and you can also email us. We'll action your request within 5 business days. We still send emails about your orders and account, because those are needed to run your order.

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account. Email support@skinovadiary.com. We'll reply within 1-2 business days and may ask you to confirm who you are first. If we can't give you access or can't make a change, we'll tell you why in writing. Deleting your account doesn't delete order records we need to keep (see below).

We keep order and payment records for as long as the law requires us to keep business and tax records. Newsletter details are kept until you unsubscribe. Account details are kept until you ask us to delete your account.

We take reasonable steps to protect your information: passwords are stored in hashed form, card details never reach our systems, access to our admin tools is password-protected, and our providers use their own safeguards. No online system is perfectly safe, so if you notice anything odd, tell us. If a data breach is likely to cause serious harm, we'll tell you and the OAIC as the law requires.

Our store and newsletter are for people aged 18 and over. We don't knowingly collect information from anyone under 18. If you think we have, email us and we'll delete it.

If you're concerned about how we handled your personal information, email support@skinovadiary.com first. We'll reply within 1-2 business days and try to fix it. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).

If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you on the site.