Privacy policy
Last updated 26 October 2026
WHOOSA (whoosa.com) is operated by Christopher Mayo trading as Whoosa (sole trader), ABN 20 607 341 074, of PO Box 333, Freshwater NSW 2096, Australia. Email hello@whoosa.com.
This policy explains how WHOOSA collects, uses, shares and protects personal information. It applies to whoosa.com and orders made through it.
What we collect
- Order details: name, email, phone (if given), shipping and billing address, items bought, order history. Payment card details are collected by Stripe, not us.
- Notify me and newsletter sign-ups: email address and the product or list you signed up for.
- Messages: what you send us by email.
- Device and usage data: IP address, browser and device type, pages viewed, referring site, and cookie identifiers. Analytics and advertising cookies are used only if you accept them.
- We do not ask for sensitive information such as details about your body or wellbeing. Please do not send it to us.
Why we use it
- To take payment, fulfil and deliver orders, handle returns and refunds, and answer questions.
- To send order and service emails.
- To send marketing emails, only if you opt in. Every marketing email has an unsubscribe link, and we act on it within 5 business days.
- To understand how the site is used and to measure and improve advertising, only with your consent.
- To stop fraud, keep the site secure and meet legal, tax and accounting duties.
Cookies and similar technology
Strictly necessary storage (your cart, your cookie choice, security) is always on. Google Analytics, Google Ads, Meta and TikTok tags are set to "denied" by default using Google Consent Mode v2 and only store cookies after you click Accept. You can change your choice at any time on our Cookie settings page or with the "Cookie settings" link in the footer. If you decline, Google may still receive cookieless pings without identifiers for aggregate modelling.
Who we share it with
We do not sell your personal information for money. We share it with service providers that help us run the business, listed below, under contracts or terms that limit how they use it. We may also share information if the law requires it, or with a buyer if the business is sold.
| Provider | What they do | Where |
|---|---|---|
| Stripe | Payment processing (card details go to Stripe; we never see or store full card numbers), stopping fraud | United States and other countries |
| Cloudflare | Website hosting, security and order database (Cloudflare Workers and D1) | United States and global network |
| Google (Tag Manager, Analytics 4, and later Google Ads and Merchant Center) | Site analytics and advertising measurement, only with your consent | United States |
| Meta (Facebook/Instagram Pixel and Conversions API), planned | Advertising measurement and audiences, only with your consent | United States |
| TikTok (TikTok Shop and pixel), planned | Marketplace sales and advertising measurement | Varies by store region (may include Singapore, the United States or the United Kingdom) |
| Faire, planned | Wholesale orders from retailers | United States |
| Our email service provider | Sending order emails and, if you opt in, marketing emails | United States |
| Australia Post and international carriers | Delivering orders | Australia and destination country |
How long we keep it
Order and tax records: 7 years (Australian tax law). Marketing list: until you unsubscribe. Notify-me requests: until we tell you the product is available, or 24 months. Analytics data: 14 months.
Security
We use HTTPS, access controls, and providers with strong security. No system is perfectly secure; if a data breach is likely to cause you serious harm, we will tell you and the regulator as the law requires.
Children
Our site is not aimed at children under 16 and we do not knowingly collect their information.
Australian Privacy Principles
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Overseas disclosure
Some providers above store or process information outside Australia, mainly in the United States (Stripe, Google, Cloudflare, Meta), and also other countries where they operate. We take reasonable steps so they handle it consistently with the APPs.
Access, correction and complaints
You can ask to access or correct the personal information we hold about you by emailing hello@whoosa.com. We will respond within 30 days. If you have a complaint about privacy, email us first; we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).
Spam Act
We only send marketing emails with your consent. Each one identifies WHOOSA and includes a working unsubscribe link.
Customers in the US, UK and EU: see the privacy page for your country for the extra rights that apply to you.
UK and EU (UK GDPR, EU GDPR and PECR)
The controller is Christopher Mayo trading as Whoosa (sole trader) (details above). Our legal bases are: contract (processing orders), legal obligation (tax records), legitimate interests (security, stopping fraud, answering questions, service emails), and consent (analytics and advertising cookies, marketing emails). You can withdraw consent at any time without affecting earlier processing.
International transfers: we are based in Australia, so your information is transferred to Australia and to providers in the US. We rely on the providers' Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US / UK-US Data Privacy Framework where the provider is certified.
Your rights: access, rectification, erasure, restriction, portability, objection (including an absolute right to object to direct marketing), and withdrawing consent. Email hello@whoosa.com; we respond within one month. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your EU data protection authority.
US privacy rights (California CCPA/CPRA and other state laws)
This section applies to residents of California, and of other US states with similar privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon).
Categories collected in the last 12 months: identifiers (name, email, address, IP address, cookie IDs); customer records (order and shipping details); commercial information (purchases); internet activity (pages viewed, ad interactions); approximate location from IP. Sources: you, your device, and our service providers. Purposes are listed above. We do not collect sensitive personal information as defined by the CCPA, and we do not use it to infer characteristics about you.
Selling and sharing: we do not sell personal information for money. If you accept advertising cookies, our use of Google, Meta and TikTok advertising tags may count as "sharing" for cross-context behavioural advertising, or a "sale" or "targeted advertising" under some state laws. We do not knowingly sell or share information of consumers under 16.
Do Not Sell or Share My Personal Information: you can opt out at any time on our Cookie settings page (choose Decline), or by emailing hello@whoosa.com with the subject "Do not sell or share". We also accept a Global Privacy Control (GPC) browser signal as a valid opt-out of sale, sharing and targeted advertising for that browser.
Your rights: to know and access the personal information we hold, to delete it, to correct it, to opt out of sale, sharing and targeted advertising, to limit use of sensitive information (we do not use it), and not to be discriminated against for using these rights. Email hello@whoosa.com. We will verify your request by matching it to information we hold (such as your order email) and respond within 45 days. An authorised agent may make a request with your signed permission. If we refuse a request, you can appeal by replying to our decision; if you remain unhappy, you can contact your state Attorney General.
We keep personal information for the periods in "How long we keep it" above.