Privacy Policy

Last updated: July 29, 2026

Heirloom Fur ("we", "us", or "our") operates the website heirloomfur.com.au (the "Site"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Site or place an order with us, including when you upload photographs for the purpose of creating personalised keepsakes.

Please read this policy carefully. If you disagree with its terms, please discontinue use of the Site.

1. Information We Collect

We collect information you provide directly to us, including:

  • Name, email address, shipping and billing address
  • Payment information (processed securely by Shopify Payments / Stripe — we never store card details)
  • Order history and correspondence
  • Pet photographs uploaded during the ordering process for personalisation purposes
  • Engraving text instructions submitted with your order

We also collect certain information automatically, including IP address, browser type, pages visited, and referring URLs, via Shopify's standard analytics tools and cookies.

2. Customer-Uploaded Photographs — Special Notice

This section applies specifically to photos you upload when placing a personalised keepsake order. We treat these photos with the highest level of care and confidentiality.

What we collect: When you upload a pet photo, we collect the image file and store a secure URL reference against your order.

Why we collect it: Your photo is collected solely to enable our artisans to create an accurate engraved portrait on your keepsake. It has no other purpose.

How it is stored: Photos are uploaded to Cloudinary, Inc. (USA), an industry-standard cloud media platform that uses TLS encryption in transit and AES-256 encryption at rest. Cloudinary is GDPR-compliant and holds ISO 27001 certification. Files are stored in a private, access-controlled folder and are not publicly listed or indexed.

Who can access your photo:

  • Our fulfilment team — solely to produce your order
  • Our engraving artisan partners — solely to create your keepsake
  • No one else. We do not sell, license, publish, or share your photos with any third party for any marketing, advertising, AI training, or commercial purpose whatsoever.

Retention and deletion: Your photo will be permanently and irreversibly deleted from Cloudinary within 90 days of your order being marked as fulfilled. If you request deletion sooner, we will action it within 5 business days. See Section 7 for how to request deletion.

Marketing use: We will never use your photo in marketing, social media, or any public-facing content without obtaining your separate, explicit, written consent in advance.

Your rights over your photo: You retain full ownership of your photograph at all times. By uploading, you grant Heirloom Fur a limited, non-exclusive licence to use the image solely for the purposes described above, for the duration of your order plus the 90-day retention period.

3. How We Use Your Information

  • To process and fulfil your orders
  • To communicate with you about your order status
  • To respond to customer service enquiries
  • To comply with legal obligations
  • To improve our Site and services (using anonymised, aggregated data only)

We do not use your personal data for automated decision-making or profiling.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

  • Contract performance — processing your order and delivering your product
  • Consent — for uploading and processing your pet photograph (you may withdraw consent at any time)
  • Legitimate interests — fraud prevention, site security, and improving our services
  • Legal obligation — retaining transaction records as required by tax law

5. Sharing of Information

We share personal data only with:

  • Shopify Inc. — our e-commerce platform provider (data processed under Shopify's DPA)
  • Cloudinary, Inc. — secure image storage for uploaded pet photos
  • Shipping carriers — name and address only, for delivery
  • Payment processors — Shopify Payments / Stripe (no card data stored by us)

All third-party processors are bound by data processing agreements and may not use your data for any purpose beyond providing services to us.

6. Cookies

We use essential cookies to operate the store (session, cart, and security cookies) and optional analytics cookies. You can manage cookies through your browser settings. Refusing optional cookies will not affect your ability to shop on our Site.

7. Your Rights

Depending on your location, you may have the following rights:

  • Access — request a copy of the personal data we hold about you
  • Rectification — request correction of inaccurate data
  • Erasure — request deletion of your data, including uploaded photos
  • Restriction — request we limit processing of your data
  • Portability — receive your data in a portable format
  • Objection — object to processing based on legitimate interests
  • Withdraw consent — for photo uploads, at any time, without affecting orders already fulfilled
  • CCPA (California residents) — you have the right to know, delete, and opt-out of sale of personal information. We do not sell personal information.

To exercise any of these rights, please contact us using the details in Section 9. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data is transmitted over HTTPS. Payment data is handled exclusively by PCI-DSS-compliant processors. Uploaded photos are stored in access-controlled, encrypted cloud storage.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you as required by applicable law.

9. Contact Us

For any privacy-related questions, requests, or concerns, including requests to delete your uploaded photo, please contact us:

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when the most recent changes were made. We encourage you to review this page periodically. Continued use of our Site after changes constitutes acceptance of the updated policy.