Privacy Policy

This privacy policy is provided by STOREFULFIL PTY LTD (ACN 701 718 649, ABN 98 701 718 649), a proprietary company limited by shares registered in Queensland, Australia on 25 August 2026, operating under the StoreFulfil™ brand. You can contact us regarding privacy or data matters by emailing info@storefulfil.com.

This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have in relation to it when using our public site, Knowledge Library, and merchant platform.

We process personal data in the following distinct ways:

• Website assistant and meetings. When you open the assistant, a conversation token is stored in your browser session to keep your conversation private. Messages you send and recent conversation context are processed by our AI provider, OpenAI through Replit AI Integrations, together with public product reference material. Our team can review conversations and take over replies. Please do not share passwords, API keys or private customer information. Meeting requests collect your name, email address, selected time and time zone. Resend delivers an email verification code before a meeting is confirmed or an alternative time request is submitted. Verified prospect details are retained for follow-up, not automatically subscribed to marketing. Conversations and past meeting records are retained for up to 90 days and removed during service housekeeping; future bookings remain until their meeting date has passed. Ending a chat clears its messages and revokes its browser token, but does not cancel an existing meeting or erase its booking details. Contact us to request deletion of retained contact or meeting information. Hashed network identifiers and short-lived counters protect this service against abuse.
• Enquiries. For a general website enquiry, you provide your name, email address and message, and may add a company name. For a 3PL quote enquiry, you provide your company or brand name, email address and approximate monthly order range. You may also add your name, brand website, phone number, ecommerce platform, SKU count, storage needs, requested services and a message about what you ship. A hidden, empty "website" honeypot field is included for bot detection (real visitors should leave it empty; it is not an additional visible field). Enquiries are stored by us before best-effort notification delivery via Resend to our configured internal contact mailbox (currently info@storefulfil.com). We use this to follow up and respond to your enquiry.
• Abuse prevention & security. When you request the security check on the contact form, our server observes your IP address and you submit security signals. We use this to apply rate limits and verify that submissions are from humans. This bot check is provided by Cloudflare.
• Platform accounts. For clients using the app, we process contact details, login credentials, and role information to authenticate and authorise users.
• Fulfilment operations (Processor). We process order, inventory, and return data on behalf of our clients. In this context, we act strictly as a data processor; the client is the data controller. We only use this data to provide the contracted service to that specific client.
• Optional analytics and advertising measurement. If you allow Google Analytics, the public marketing site uses GA4 to measure visits and pages viewed. If you separately allow Google Ads, it measures visits from advertising. We do not send details you enter in an enquiry form to either tag. The Knowledge Library and merchant platform do not load these marketing tags.

As a data controller for the public website, our stated position on processing activities is based on the following:

• Legitimate interests: We have a legitimate interest in answering requested business enquiries and protecting the public form from abuse and automated attacks. We do not reuse these details for unsolicited marketing.
• Necessary storage: Language and session storage is limited to carrying out the visitor's explicit request to remember a language or banner choice and is not used for tracking.
• Consent: We load Google Analytics and Google Ads only for the purposes you separately allow. You can decline or withdraw either at any time using the controls below. This does not undo information already sent to Google.

The public marketing site stores your separate Google Analytics and Google Ads choices in your browser. Neither destination is configured before you allow it. After permission, Google may set cookies or similar identifiers for the purpose you selected. The Knowledge Library does not load these tags. The live Replit-hosted production edge currently adds a separate platform-managed cookie named GAESA to responses. StoreFulfil code does not create, read, or use that cookie, and the public Replit documentation available to us on 21 August 2026 did not explain its purpose. The Knowledge Library uses no application storage.

• sf-marketing-locale: Written when you continue from the first-visit site preferences panel or choose a language from the navigation. It remembers your selected language across visits until cleared.
• sf-lang-banner-dismissed: A legacy session-only key from the former language banner. The current site neither reads nor writes it; the clear button below removes it.
• sf-locale: A legacy key neither read nor written by the current site. It is mentioned here only as historical data that the clear button below removes.
• sf-google-ads-consent: Remembers your choice to allow or decline Google Ads until you change or clear it. If browser storage is unavailable, your choice applies only to the current page.
• sf-google-analytics-consent: Separately remembers your choice to allow or decline Google Analytics until you change or clear it. An existing Ads choice never grants Analytics permission.
• GAESA: Added by the production hosting edge rather than by StoreFulfil code. It was observed with an expiry about 30 days after issue and may be reissued by the host on later responses. The clear control below does not claim to manage provider infrastructure cookies.

No new service workers or caches are registered on this site. A temporary retirement script at the previous URL exists solely so browsers with already-installed legacy workers can safely delete their StoreFulfil caches and unregister automatically in the background. New visitors do not install it. The Clear local data button below remains an immediate manual control (it unregisters only the exact legacy StoreFulfil worker and preserves any unrelated same-origin registrations or caches you may have).

We only share personal data with service providers to operate our platform. These named providers may process data outside your country; processing locations and safeguards depend entirely on their current provider configuration and terms.

• Cloudflare: Provides the Turnstile bot-challenge for our contact form. Cloudflare Turnstile collects client IP, TLS fingerprint, User-Agent, site key and origin. Cloudflare says it acts as processor for website protection and controller when using signals to improve Turnstile. Our server sends the token and may send remote IP to siteverify. Standard widget config requires no cookies/localStorage and pre-clearance is not enabled. Turnstile is loaded only after your explicit request. Removing the widget unloads it but cannot undo signals already processed. (Cloudflare Turnstile Privacy)
• Resend: Delivers notification emails generated from your enquiries. Enquiries are stored by us before best-effort Resend notification delivery. (Resend Privacy)
• Replit: Hosts our application infrastructure and databases. Live production responses currently identify a Google frontend and add the hosting-managed GAESA cookie described above. Google is listed by Replit as an infrastructure subprocessor; our separate optional Google tags are described below. The selected project geography and account-level contractual evidence are maintained separately from this public notice. (Replit Privacy)
• Google Ads: Only after you allow the tag on our marketing site, Google may receive information about your visit and use advertising cookies or similar technology to measure ad traffic. Google's processing and international transfers are governed by its terms and privacy policy. (Google Privacy Policy)
• Google Analytics: Only after you separately allow Analytics on our marketing site, Google may receive information about the pages you visit and use cookies or similar technology to measure site usage. Google's processing and international transfers are governed by its terms and privacy policy. (Google Privacy Policy)

We do not sell personal data.

Our active data retention practices for public site visitors are: the current configured schedule redacts enquiry IP and deletes stale rate-limit rows after 30 days, and deletes enquiry rows after 730 days when the automated policy runs; an authorised controller review or legal hold can pause automation and will be documented.

• Platform data: Client operations data is subject to the client's separate controller retention limits.

You have rights, subject to applicable law and circumstances, to access, correct, delete, restrict processing of, object to processing of, or request portability of your personal data. To exercise these rights, please contact us at info@storefulfil.com. If you are unsatisfied with our response, you may lodge a complaint with your local data protection authority.

Google Analytics and Google Ads load only for the purposes you allow. You may withdraw either permission under Analytics and advertising choices above. The clear control removes browser-stored language, analytics and advertising choices, while Turnstile is used for form submission only after an explicit request. The purpose and legal classification of the hosting-managed GAESA cookie remains a provider-evidence item; this notice does not describe it as an application cookie or make an unsupported necessity claim.