Last updated: 2 November 2026
Who this policy covers
This policy explains how PUFFAU handles personal information collected through this website, orders, accounts, partner activities and customer enquiries.
What we collect and why
We collect the information you provide, such as your name, contact details, delivery address, order details, enquiries and partner account information. Technical information can include IP address, device/browser information, security logs, cookies and referral attribution. We use this to operate the store, fulfil orders, provide support, protect accounts and administer partner commissions. Please do not send sensitive information or card details in messages.
Cookies and marketing
Cookies support the cart, sign-in and referral tracking. Where analytics or advertising tools are enabled, their cookies and device information may help measure visits or campaigns. You can manage cookies in your browser; some store functions may then be unavailable. You may ask us to stop direct marketing.
Sharing and overseas handling
We share information where needed with hosting, payment, delivery, technical and professional service providers, or where required by law. Our current hosting infrastructure is in Iceland. Other provider locations depend on the services used; contact us for current details. Customer addresses and contact details are not published in the partner leaderboard. Partner community earnings are shown only under the participant’s chosen sharing settings.
Security and retention
We use reasonable technical and access controls and keep information for order administration, security and applicable recordkeeping needs. No online system is completely secure. Full card details should be entered only into the approved payment flow, never into a public post or chat.
Your requests and complaints
To request access, correction or deletion, or raise a privacy concern, contact PUFFAU and ask for the privacy contact. We may need to verify identity and retain records required by law. Explain the concern and desired outcome; we aim to respond within 30 days. If unresolved, you may consult the Office of the Australian Information Commissioner, where its jurisdiction applies.
Updates
We may update this policy as our services change. The version on this page applies from its stated update date.