Privacy policy
Last updated 5 November 2026
This policy explains what personal information we ("Dark Day Ready", "we") collect through darkdayready.com and our emails, why, who sees it, and your rights. We are an Australian business. Whether or not the Privacy Act 1988 (Cth) binds us at our current size, we follow the Australian Privacy Principles (APPs), and this policy is written to them.
What we collect
- If you sign up for the 72-Hour Plan or kit news: your email address, the date and page you signed up on, and confirmation that you clicked the double opt-in link.
- If you buy a kit: your name, email, delivery address, phone number for the courier, what you bought and when. Payment is taken by Stripe on Stripe's pages; we never see or store your card number. Stripe gives us the last four digits, card type and country for fraud checks and refunds.
- If you email us: what you write and your address.
- Automatically: standard server logs (IP address, browser, pages requested, time) kept by our hosting provider for security for up to 30 days. If the Meta Pixel is switched on, Meta sets cookies and receives page-view and purchase events; see the cookie policy. If you buy while the Pixel is on, our server also sends Meta the purchase value, which kit you bought, the order's checkout id and a one-way hashed (SHA-256) copy of your email address and phone number, for ad measurement only. We never send Meta your name, delivery address or card details.
We do not collect anything else, we never ask for dates of birth, identity documents or bank details, and we do not buy data about you from anyone.
Why
To send what you asked for, fulfil and deliver orders, handle returns and consumer-guarantee claims, keep tax records, prevent fraud, measure our advertising, and send kit news and the quarterly maintenance reminder if you opted in. The legal bases are: performing our contract with you, our legitimate interests in running and protecting the business, your consent for marketing, and legal obligations (tax, consumer law).
Who we share it with
| Provider | What for | Where data is held |
|---|---|---|
| Stripe Payments Australia | Payments, receipts, fraud screening | Australia and United States |
| Vercel | Website hosting, server logs, a private note when an order needs a person to look at it (your name, suburb, state and kit, never your street address, email, phone or card), and, before our email service is switched on, a private list of plan sign-ups (email, date, page) | Australia, Sydney region (logs may be processed in the US) |
| Klaviyo | Email list, sending emails, measuring opens and clicks | United States |
| Our fulfilment partner (China) and its courier line | Packing and shipping your kit; your name, delivery address, phone number and order contents | China |
| The Australian carrier that delivers the parcel | Last-mile delivery; your name, address and phone | Australia |
| Meta Platforms | Ad measurement via the Meta Pixel and, for purchases, a report from our server (purchase value, kit, checkout id, hashed email and phone), only when enabled | United States and others |
| Our accountant and, if ever required, lawyers, insurers or regulators | Tax, disputes, legal obligations | Australia |
Because the kits are packed and shipped from China, your delivery details are disclosed to our fulfilment partner in China for the sole purpose of shipping your order. Because Klaviyo, Stripe and Meta are US companies, some information is also disclosed to the United States. We choose providers that commit contractually to protect it, and we do not sell personal information to anyone, ever.
How long we keep it
Order records for seven years (tax law). Marketing email addresses until you unsubscribe or 24 months of no opens, whichever is first, then deleted. Sign-ups held on Vercel before Klaviyo is connected are moved to Klaviyo and then deleted from Vercel. Order-problem notes held on Vercel are deleted once the order is sorted out. Support emails for two years. Server logs 30 days.
Security
The site is served only over HTTPS with HSTS, a strict Content Security Policy, and no third-party scripts other than the Meta Pixel when enabled. Payment pages are Stripe's. Access to Klaviyo and Stripe is limited to named people with two-factor authentication. If a data breach is likely to cause you serious harm we will tell you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires. Security researchers can reach us via security.txt.
Marketing emails
You only get them if you ticked the box or signed up for the plan, and confirmed by email. Every one has an unsubscribe link that works within five business days (usually instantly), as the Spam Act 2003 requires. Order and shipping emails are not marketing and are sent regardless.
Automated decisions
Stripe's fraud screening may automatically decline a payment. No other decision about you is automated. From 10 December 2026 the Privacy Act requires us to say this here, and we do.
Your rights
Ask us for a copy of what we hold about you, ask us to correct or delete it, or withdraw marketing consent, by emailing hello@darkdayready.com. We answer within 30 days. If you are unhappy with our answer you can complain to the OAIC at oaic.gov.au.
Children
The site is for adults. We do not knowingly collect information from anyone under 18.
Changes
We will change the date at the top and, for anything material, email subscribers.