Privacy policy

Effective date 21 September 2026

This policy explains how we handle personal information when you visit getloafie.com, make a purchase, contact us or interact with our advertising. We are an Australian business selling to US customers. Shopify hosts our store, and our Meta and TikTok integrations use Maximum data sharing subject to the choices described below.

1. Who we are and how to contact us

Tayyab Sheikh, trading as Get Loafie under the brand The Loafie, is responsible for our handling of personal information where applicable.
Email: hello@getloafie.com
Telephone: +61 494 693 418
Privacy correspondence: 14 Gemmill Crescent, Mooroopna VIC 3629, Australia

Optional advertising consent is not required to purchase. You can make a general enquiry anonymously or using a pseudonym where practical.

2. Information we collect and why

We collect information you give us, information generated when you use the store, and information received from Shopify, payment providers, our New Jersey warehouse, carriers and advertising partners.

Category	Examples	Main purposes
Contact and account information	Name, email, phone, delivery and billing addresses, customer ID and preferences	Orders, accounts, support, marketing and permitted advertising matching
Shopping information	Products viewed, searches, cart activity, purchases, order value, returns and refunds	Fulfilment, service, analytics and advertising events
Device activity and location	IP address, browser, device, cookie or advertising IDs, pages, event times and approximate location	Store operation, security, analytics and advertising
Payment and security information	Payment status, transaction references, limited payment details and fraud indicators	Payments, refunds, fraud prevention and disputes
Communications and content	Support messages, return photographs, reviews and feedback	Customer service, claims and requested publication
Inferences	Product interests and audience segments derived from shopping and advertising activity	Personalisation, analytics and relevant advertising

 

We also use information for tax and accounting records, legal claims, compliance and store protection. Order information is required to process and deliver a purchase. Payment credentials are processed by Shopify and the payment provider you select; we use the transaction details they make available. Do not send full card numbers, security codes or passwords in support messages.

3. Who receives information

We disclose relevant information to Shopify and providers supporting payments, fraud prevention, communications, support, analytics, fulfilment, delivery and returns. Our New Jersey warehouse and carriers receive the order and contact details needed to fulfil and deliver purchases. Providers receive information relevant to their role, subject to contractual restrictions where required.

Meta and TikTok receive permitted identifiers, shopping events, device activity, approximate location and audience information for the purposes in section 5. Some advertising partners process information independently under their own policies. We may also disclose information to advisers, insurers, authorities or courts where lawful and reasonably necessary, during a business sale or reorganisation with appropriate protections, at your direction, or with valid consent.

4. Shopify

Shopify provides our ecommerce infrastructure and processes information about visits, purchases and other store interactions. We use Shopify enhanced services supported by Shopify Network Intelligence. These services may combine interactions with our store, other merchants and Shopify to personalise experiences, improve services and support advertising. Shopify is responsible for its independent processing and related rights requests. See the Shopify Consumer Privacy Policy and Shopify Privacy Portal for details.

5. Meta and TikTok Maximum data sharing

Meta Maximum data sharing uses Meta Pixel and Conversions API. Depending on the event, information and privacy choices, Meta may receive name, email, phone and location details; IP address, browser and cookie identifiers; page views, searches, cart, checkout and purchase events; and product, order value and currency information.

TikTok Maximum data sharing uses TikTok Pixel, Events API, Advanced Matching and relevant Shopify connections. TikTok may receive shopping events, product and order details, IP address, browser and device information, cookie or advertising identifiers, and matching identifiers such as email and phone number.

We use these integrations to measure conversions, attribute purchases, improve campaigns, build audiences and show relevant advertising. Matching identifiers may be hashed, but matchable hashed data is not anonymous. Browser blockers may not stop server-to-server events. We do not intentionally send passwords, full payment credentials, private support messages or sensitive information to advertising platforms.

6. Cookies and privacy choices

We use essential technologies for checkout, security and requested sessions, and optional technologies for preferences, analytics and advertising. Where prior consent is required, optional tracking starts only after consent. Use Cookie preferences on our website to adjust or withdraw optional consent where available.

US visitors can opt out of advertising sale, sharing and targeted advertising through Your Privacy Choices in our website footer or by emailing hello@getloafie.com. These disclosures can be treated as a sale, sharing for cross-context behavioural advertising or targeted advertising under some US privacy laws even when no money changes hands. An opt-out does not stop order fulfilment, security, legal processing or all advertising.

We honour Global Privacy Control for US visitors as an opt-out of relevant sale, sharing and targeted advertising for the browser or device sending it, and apply it more broadly where required. No account is required. Browser controls may affect store functions and may erase saved preferences. Choices may need to be repeated on another browser or device.

7. Marketing messages

Order, delivery, security and return messages are separate from optional marketing. We send promotional email where permitted and with consent where required. Use the unsubscribe link or contact us. We keep a minimal suppression record to honour the request. Email unsubscribe does not automatically change advertising-tracking choices.

If we introduce promotional SMS, we will provide subscription terms and obtain any required separate consent. A phone number supplied for delivery is not SMS marketing consent. We do not disclose SMS consent for another business’s independent text marketing.

8. Retention security and international processing

We keep personal information only as long as reasonably needed for the stated purpose or legal obligations. Order and payment records are retained for fulfilment, returns, warranties, disputes and applicable tax and accounting periods. Account and marketing records remain while the service or lawful marketing basis continues, with necessary closure and suppression records afterwards. Support and privacy-request records are retained to resolve enquiries and demonstrate compliance.

When retention is no longer justified, we delete or appropriately de-identify information, subject to backup cycles and legal holds. We use reasonable technical and organisational safeguards and restrict access to authorised people and providers. No system guarantees complete security. We provide legally required breach notices.

Information is processed in Australia and the United States and may be processed in other countries used by Shopify and our providers. Overseas laws may differ. We take transfer steps required by applicable law, including applicable Australian Privacy Principle 8 measures and relevant contractual or adequacy safeguards for restricted European or UK transfers. Contact us for available details.

9. Privacy rights and requests

Depending on your location and whether the relevant law covers our business, you may request access, correction, deletion, a portable copy, recipient information, restriction or objection; withdraw consent; or opt out of sale, sharing, targeted advertising or certain profiling. Rights concerning sensitive information may also apply.

Email hello@getloafie.com, call us or write to the address in section 1. State what you want and provide enough information to locate the relevant records. We may verify identity using information already held. Authorised agents may act with appropriate authority. We do not charge for an ordinary request or discriminate because you exercised a privacy right.

We respond within applicable legal deadlines. Covered US requests generally receive a response within 45 calendar days or sooner where required; lawful extensions are explained. California requests are acknowledged and completed within the periods required by the CCPA. Applicable opt-outs are implemented as soon as feasible and within any statutory deadline. Australian access or correction requests are generally handled within 30 calendar days. We explain lawful exceptions and any available appeal or regulator complaint route.

10. Regional disclosures

California and other US states

Where the CCPA or another state privacy law applies, the categories in section 2 describe information collected in the preceding 12 months or since launch if shorter. We collect it from you, your device, Shopify and the providers named in this policy for the purposes described above. We disclose relevant categories to service providers and contractors for ecommerce operations.

During that period, advertising disclosures to Shopify, Meta and TikTok may have included identifiers, customer-record information, commercial information, internet activity, approximate geolocation and related inferences. These disclosures may constitute sale or sharing for cross-context behavioural advertising. We do not have actual knowledge that we sell or share the personal information of anyone under 16. Use section 6 to opt out. We use sensitive payment and authentication information only for necessary or otherwise permitted purposes that do not require a right-to-limit control. If this changes, we will provide the required notice and control.

Australia

Where the Privacy Act and Australian Privacy Principles apply, you can request access or correction and complain to us. We aim to acknowledge a privacy complaint within seven days and provide a substantive response within 30 days, explaining any extra time needed. You may complain to the Office of the Australian Information Commissioner where it has jurisdiction.

European Economic Area and United Kingdom

If applicable, we rely on contract for purchases, legal obligations for required records, consent where required, and legitimate interests where lawful and balanced for security and service administration. Applicable rights can include access, correction, erasure, portability, restriction, objection and withdrawal of consent. We generally respond within one month and notify lawful extensions. You may complain to your local supervisory authority or the UK Information Commissioner’s Office.

11. Children automated processing and changes

The store is intended for adults and is not directed to children under 13. We do not knowingly collect their information. Contact us if you believe this has occurred. We do not permit sale, sharing or targeted-advertising use of information we know belongs to a person under 18 and follow any broader legal protection for minors that applies.

Providers may use automated fraud indicators, advertising audiences and recommendations. Contact us for an explanation and human review of an order or account decision we control. External sites have their own notices. We update this policy and its effective date when practices change and provide additional notice or consent where required. Contact us with privacy questions or complaints.