Privacy policy
Last updated 26 October 2026
WHOOSA (whoosa.com) is operated by Christopher Mayo trading as Whoosa (sole trader), ABN 20 607 341 074, of PO Box 333, Freshwater NSW 2096, Australia. Email hello@whoosa.com.
This policy explains how WHOOSA collects, uses, shares and protects personal information. It applies to whoosa.com and orders made through it.
What we collect
- Order details: name, email, phone (if given), shipping and billing address, items bought, order history. Payment card details are collected by Stripe, not us.
- Notify me and newsletter sign-ups: email address and the product or list you signed up for.
- Messages: what you send us by email.
- Device and usage data: IP address, browser and device type, pages viewed, referring site, and cookie identifiers. Analytics and advertising cookies are used only if you accept them.
- We do not ask for sensitive information such as details about your body or wellbeing. Please do not send it to us.
Why we use it
- To take payment, fulfil and deliver orders, handle returns and refunds, and answer questions.
- To send order and service emails.
- To send marketing emails, only if you opt in. Every marketing email has an unsubscribe link, and we act on it within 5 business days.
- To understand how the site is used and to measure and improve advertising, only with your consent.
- To stop fraud, keep the site secure and meet legal, tax and accounting duties.
Cookies and similar technology
Strictly necessary storage (your cart, your cookie choice, security) is always on. Google Analytics, Google Ads, Meta and TikTok tags are set to "denied" by default using Google Consent Mode v2 and only store cookies after you click Accept. You can change your choice at any time on our Cookie settings page or with the "Cookie settings" link in the footer. If you decline, Google may still receive cookieless pings without identifiers for aggregate modelling.
Who we share it with
We do not sell your personal information for money. We share it with service providers that help us run the business, listed below, under contracts or terms that limit how they use it. We may also share information if the law requires it, or with a buyer if the business is sold.
| Provider | What they do | Where |
|---|---|---|
| Stripe | Payment processing (card details go to Stripe; we never see or store full card numbers), stopping fraud | United States and other countries |
| Cloudflare | Website hosting, security and order database (Cloudflare Workers and D1) | United States and global network |
| Google (Tag Manager, Analytics 4, and later Google Ads and Merchant Center) | Site analytics and advertising measurement, only with your consent | United States |
| Meta (Facebook/Instagram Pixel and Conversions API), planned | Advertising measurement and audiences, only with your consent | United States |
| TikTok (TikTok Shop and pixel), planned | Marketplace sales and advertising measurement | Varies by store region (may include Singapore, the United States or the United Kingdom) |
| Faire, planned | Wholesale orders from retailers | United States |
| Our email service provider | Sending order emails and, if you opt in, marketing emails | United States |
| Australia Post and international carriers | Delivering orders | Australia and destination country |
How long we keep it
Order and tax records: 7 years (Australian tax law). Marketing list: until you unsubscribe. Notify-me requests: until we tell you the product is available, or 24 months. Analytics data: 14 months.
Security
We use HTTPS, access controls, and providers with strong security. No system is perfectly secure; if a data breach is likely to cause you serious harm, we will tell you and the regulator as the law requires.
Children
Our site is not aimed at children under 16 and we do not knowingly collect their information.
UK and EU (UK GDPR, EU GDPR and PECR)
The controller is Christopher Mayo trading as Whoosa (sole trader) (details above). Our legal bases are: contract (processing orders), legal obligation (tax records), legitimate interests (security, stopping fraud, answering questions, service emails), and consent (analytics and advertising cookies, marketing emails). You can withdraw consent at any time without affecting earlier processing.
International transfers: we are based in Australia, so your information is transferred to Australia and to providers in the US. We rely on the providers' Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US / UK-US Data Privacy Framework where the provider is certified.
Your rights: access, rectification, erasure, restriction, portability, objection (including an absolute right to object to direct marketing), and withdrawing consent. Email hello@whoosa.com; we respond within one month. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your EU data protection authority.
Marketing emails (PECR)
We send marketing emails only if you opt in, or if you bought from us and did not opt out of similar-product emails when we offered the chance. Every email has an unsubscribe link.