Privacy Policy
Last updated: August 2026
BeanHub Australia Pty Ltd (ACN 694 445 344) ("BeanHub", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website beanhub.com.au and our services.
We have adopted the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). A copy of the Australian Privacy Principles may be obtained from the website of The Office of the Australian Information Commissioner at www.oaic.gov.au.
Information We Collect
We may collect the following types of personal information:
Account Information
- Name and email address
- Password (encrypted)
- Account preferences
Shipping & Contact Details
- Delivery address
- Phone number (for delivery notifications)
Order & Purchase Data
- Order history and transaction details
- Products purchased and quantities
- Delivery preferences
Payment Information
Payment processing is handled securely by Stripe. We do not store your credit card numbers, CVV, or other sensitive payment details on our servers. We may retain the last four digits of your card and card type for order reference purposes.
Communications
- Support enquiries and correspondence
- Product reviews and feedback
- Newsletter subscription preferences
Usage Data
- Pages visited, clicks, and browsing behaviour (via our analytics — see Sections 3 and 4)
- Search queries on our platform
- Device and browser information
- Approximate location (country/state) derived from your IP address — we configure our analytics so the IP address itself is discarded and not stored with your activity
- Referring website and campaign link parameters (how you found us)
- Session replays — recordings of how a page was used (see "Analytics & Session Replay" in Section 3)
You can switch usage analytics off at any time with the toggle in Section 4.
How We Use Your Information
We use your personal information to:
- Process and fulfill your orders
- Send order confirmations, shipping updates, and delivery notifications
- Provide customer support and respond to enquiries
- Improve our website, products, and services
- Personalise your shopping experience
- Send marketing communications (with your consent)
- Detect and prevent fraud
- Comply with legal obligations
You may unsubscribe from marketing communications at any time by clicking the "unsubscribe" link in our emails or by contacting us.
Third-Party Sharing
We may share your personal information with the following third parties to provide our services:
Coffee Roasters (Merchants)
When you place an order, we share your shipping details (name and address) with the relevant coffee roaster(s) so they can fulfill and ship your order directly to you. Your order is created in the roaster's own store system (Shopify or WooCommerce, both US-based platforms), so your name and delivery address are stored there as well as with us. Roasters may only use these details to fulfil your order.
Payment Processor (Stripe)
Stripe securely processes all payments. Their use of your data is governed by their Privacy Policy.
Shipping Carriers
Delivery information is shared with shipping carriers (such as Australia Post, Sendle, or courier services) to deliver your orders.
Analytics & Session Replay (PostHog)
We use PostHog to understand how visitors use our website — pages visited, clicks, searches, and actions like adding to cart or checking out. If you sign in, this activity is linked to your account so we can understand the full journey. PostHog may also record sessions: a replay of how a page was used. Everything you type into any form field is masked in recordings and never leaves your browser, and we mask personal details displayed on screen. We configure PostHog to discard your IP address (only approximate country/state is kept). PostHog stores this data in the United States. You can opt out of all of this with the toggle in Section 4.
Hosting & Performance (Vercel)
Our website is hosted by Vercel (United States), so all traffic passes through their infrastructure. We also use Vercel's aggregate analytics and performance monitoring, covered by the same opt-out in Section 4.
Search (Algolia)
Product search is powered by Algolia (United States). When you search or filter in the shop, your query is sent directly from your browser to Algolia to return results.
Address Autocomplete (Google)
Address autocomplete at checkout uses Google Maps services (United States); the address text you type is sent to Google to suggest completions.
Email (Resend)
We use Resend (United States) to send transactional emails (order confirmations, shipping updates) and marketing communications (with your consent). Your email address and name are shared with Resend solely to deliver these communications.
Operations & Reliability
We use BetterStack (United States/European Union) for error tracking and logs — error reports can include technical details like your device information; Upstash (United States) for rate limiting and background job queues, which can carry order details while your order is processed; and Slack (United States) for internal alerts — if you use the contact form or send feedback, your message and contact details are relayed to our internal Slack so we can respond.
We will not sell, rent, or trade your personal information to third parties for their marketing purposes.
Cookies & Tracking
We use cookies and similar browser storage for two purposes:
- Essential & functional: keeping you signed in, remembering your cart and coffee queue, your display and theme preferences, your country (for the shipping notice), an anonymous voting token for our public roadmap, and the record of your analytics choice below. These are required for the site to work and are always on.
- Analytics: PostHog and Vercel Analytics cookies/storage as described in Section 3, used to understand how the site is used, including session replay. Analytics runs by default; Australian law does not require prior consent for it, and we instead give you a real, persistent opt-out:
Analytics are on in this browser
Controls PostHog analytics and session replay, and Vercel Analytics. Your choice is saved for a year and only applies to this browser.
Your choice is stored in a cookie for one year and applies to this browser. You can also reach this toggle any time via "Cookies" in the website footer.
Data Security
We take reasonable steps to protect your personal information from misuse, loss, unauthorised access, modification, and disclosure. This includes:
- Encryption of data in transit (HTTPS/TLS)
- Secure storage with access controls
- Regular security reviews
- Staff training on data protection
International Data Transfers
Some of our third-party service providers operate outside of Australia. When we share your personal information with these providers, your data may be transferred to and stored in countries including the United States.
Before disclosing personal information to overseas recipients, we take reasonable steps to ensure they comply with the Australian Privacy Principles or are subject to a law or binding scheme that provides comparable privacy protections.
Our service providers and their locations:
- Stripe (payment processing) — United States
- PostHog (analytics & session replay) — United States
- Supabase (database & authentication) — Australia/United States
- Vercel (website hosting & performance analytics) — United States
- Algolia (product search) — United States
- Resend (email delivery) — United States
- Upstash (rate limiting & job queues) — United States
- BetterStack (error tracking & logs) — United States/European Union
- Google (address autocomplete at checkout) — United States
- Slack (internal alerts for contact/feedback messages) — United States
- Shopify / WooCommerce (the store systems of the roasters who fulfil your order) — United States/global
Data Retention
We retain your personal information for as long as necessary to provide our services and comply with legal obligations:
- Order and transaction data: 7 years (for tax and accounting purposes)
- Account information: Until you request deletion or close your account
- Marketing preferences: Until you unsubscribe
When your data is no longer needed, we will securely delete or de-identify it.
Your Rights
Under the Privacy Act, you have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your personal information (subject to legal retention requirements)
- Complaint: Lodge a complaint with us or the Office of the Australian Information Commissioner
To exercise these rights, please contact us using the details below. We will respond to your request within a reasonable timeframe. We do not charge a fee for access requests.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post any changes on this page with an updated "Last updated" date. We encourage you to review this policy periodically.
Contact Us
If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal information, please contact us at:
Email: support@beanhub.com.au
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.