Mine Privacy Policy

1. About Mine

Mine Technologies Pty Ltd (ABN 24 693 393 127, ACN 693 393 127) (Mine, we, us or our) operates a privacy-focused audience insights platform.

Mine allows eligible members to connect with participating brands, privately match eligible Shopify purchases and receive member earnings when applicable requirements are satisfied.

Mine provides participating brands with aggregated, statistical or modelled audience and purchase-outcome insights. Mine does not provide brands through the service with a member’s name, email address, Mine account identity, protected matching code, individual match status or individual purchase history.

This policy explains how we manage personal information across Mine’s website, member service, brand platform, administration tools, Shopify integration and related support services.

2. Who this policy applies to

This policy applies to personal information about:

• Mine members and people creating a member account;
• brand representatives and people creating or operating a brand account;
• customers of participating Shopify stores whose order information is supplied to Mine (Store Customers);
• people who visit Mine’s websites or contact Mine; and
• other people whose information is lawfully provided to or generated by Mine.

Mine’s initial member service is intended for adults who ordinarily reside in Australia. Mine does not knowingly offer member accounts to children.

A person may sometimes interact with Mine without identifying themselves, such as by reading public website content. Identification is required where reasonably necessary to create an account, operate private matching, calculate earnings, process payments, respond to a privacy request or provide secure support.

3. What personal information we collect

3.1 Member account and profile information

We may collect:

• login and recovery email addresses;
• authentication identifiers and account status;
• date of birth and country of residence;
• Australian state or territory, including a choice not to disclose it;
• self-reported gender, including a choice not to disclose it;
• onboarding completion and eligibility records;
• account creation, verification, login and closure dates;
• password-reset and account-recovery records; and
• information supplied for identity, residency, account-ownership or eligibility checks.

Passwords are handled through Mine’s authentication provider. Mine does not intend to store readable passwords in its ordinary application databases.

State or territory and gender information is used to prepare aggregated audience insights. Mine does not provide these details to a brand as an individual member profile.

3.2 Consent and legal-acceptance information

We collect evidence of:

• acceptance of the Member Terms or Brand Platform Terms;
• acknowledgement of this Privacy Policy;
• the required member consent to private Shopify purchase matching;
• the separate express promotional-email consent presented during member onboarding, and any later changes or withdrawals;
• the wording and version presented;
• the acceptance date and time; and
• technical or audit information reasonably required to demonstrate the acceptance.

Private purchase matching is required to participate as a Mine member. Express consent to promotional payment emails is separately presented and is required to complete member onboarding. After onboarding, a member may withdraw promotional-email consent without closing or suspending their account or affecting their eligibility for member earnings.

3.3 Brand-audience and qualification information

We may collect or generate:

• brands with which a member has connected;
• whether a connection is Waiting to join, Active, Removed or another clearly explained state;
• how and when the connection started, changed or ended;
• brand audience-capacity and activation information;
• the time or proportion of a month for which the connection was Active;
• whether the member reached the applicable 20% monthly Active threshold;
• duplicate-connection and reconnection checks;
• qualification outcomes and the rule version applied; and
• related billing, earning, review and fraud-prevention information.

3.4 Earnings and payment information

We may collect or generate:

• Pending and Available earning amounts and statuses;
• the brand, month and qualification record connected to an amount;
• reasons why an amount is Pending, removed, corrected or reversed;
• brand payment and allocation records;
• Available balances and withdrawal amounts;
• withdrawal status, dates and transaction references;
• failed-withdrawal and reconciliation information;
• Stripe connected-account status and payout capability; and
• billing, invoicing, tax, accounting, dispute and audit records.

Members may need to provide identity, contact, banking or other verification information directly to Stripe. Stripe may provide Mine with account status, capability, transaction and verification-status information. Mine does not ordinarily receive complete payment-card or bank-account credentials from Stripe.

3.5 Brand and representative information

We may collect:

• brand and business name;
• representative name, role, work email and contact details;
• authentication and authority records;
• business website, Shopify store and integration identifiers;
• audience settings, Active user cap and audience-state counts;
• billing contact, subscription and payment status;
• limited payment-method information, such as card type and last four digits;
• dashboard, reporting and configuration choices;
• brand legal-acceptance and marketing-preference records;
• account closure and integration-disconnection records; and
• support, security and audit records.

3.6 Shopify purchase and private-matching information

A participating brand may connect its Shopify store to Mine. Purchase Data means order, payment, refund, cancellation and related commerce information supplied through that authorised connection.

Purchase Data may include:

• Shopify shop, customer, order, refund and event identifiers;
• the customer email address associated with an order;
• order, payment, processing, update, cancellation and refund dates;
• order total, refund amount, net amount and currency;
• payment, cancellation, source and test-order status; and
• limited order, store or customer metadata needed for deduplication, reconciliation, security, fraud prevention, privacy compliance or outcome measurement.

For the initial feature, Mine does not ordinarily require or intend to retain customer names, phone numbers, street addresses, shipping details, complete payment-card details, product-level line items or shipping instructions.

Mine uses a secret-keyed HMAC-SHA-256 process to create a non-readable matching code from a normalised email address:

• Mine retrieves the member’s verified sign-in email from its authentication system;
• Mine normalises the email, including by trimming spaces and converting it to lowercase;
• Mine generates and stores the protected member matching code, key version, consent version and related internal identifiers;
• when an eligible order is received, Mine may transiently process and normalise the order email and generate the corresponding code;
• Mine compares the protected codes to identify a match; and
• Mine intends to discard the raw order email promptly after matching, except where limited temporary processing is reasonably required for security, reconciliation, privacy compliance or another disclosed lawful purpose.

The protected matching code, pseudonymous identifiers and matched purchase records remain personal information where Mine can reasonably connect or use them in relation to an individual. They are not treated as anonymous merely because the readable email is not displayed.

Mine may generate pseudonymous or aggregated information including match status, purchaser counts, net revenue, purchase rate, repeat-purchase rate, average order value, purchase frequency, conversion timing, refunds, observed change, modelled uplift, Audience Return, Audience ROI and evidence or confidence information.

Private matching may be incomplete or inaccurate because of guest checkout, different or shared email addresses, missing or delayed records, refunds, cancellations, offline purchases, technical failures or Shopify limitations.

3.7 Website, technical and security information

When a person uses Mine’s websites or services, we may collect:

• IP address and approximate location derived from it;
• browser, device, operating-system and language information;
• dates, times, pages, functions and links accessed;
• referring pages and campaign parameters;
• session, cookie or similar identifiers used for authentication, preferences, security or analytics;
• server, application, webhook, integration and audit logs;
• failed login, rate-limit, error and diagnostic information; and
• suspected fraud, misuse or security-event information.

Mine does not use a device-wide VPN, Packet Tunnel or DNS service to monitor member internet activity. Mine does not collect a member’s general browsing history through the member service.

3.8 Communications, support and marketing information

We may collect messages, attachments and contact details provided through support, complaints, privacy requests, surveys, forms or other communications. We may also record communication delivery, opening, click, unsubscribe and preference information where permitted.

4. How we collect personal information

We may collect personal information:

• directly from members, brand representatives, Store Customers and website visitors;
• when an account is created, verified, used, recovered or closed;
• when a member connects with or leaves a brand audience;
• from Shopify stores through authorised APIs, webhooks, reconciliation and permitted historical imports;
• from Stripe and other payment providers;
• from Mine’s authentication, database, hosting, email and security providers;
• from automated service operation, including audience-state, qualification, billing and fraud-prevention processes;
• when a person contacts Mine or responds to a communication; and
• where required or authorised by law.

Where Mine receives personal information indirectly, including Purchase Data from a participating store, Mine handles it for the purposes described in this policy and applicable arrangements with the brand and Shopify.

5. How we use personal information

We may use personal information to:

• create, verify, secure, support and close accounts;
• confirm age, Australian residency, identity, authority and eligibility;
• record legal acceptance and consent evidence;
• create and manage brand-audience connections and states;
• calculate monthly Active time and earning qualification;
• display and explain Pending and Available earnings;
• bill brands, allocate cleared funds and process withdrawals;
• operate Shopify integrations, APIs, webhooks and reconciliation;
• create and compare protected email matching codes;
• prepare aggregated, statistical or modelled audience and purchase-outcome insights;
• prepare aggregated age-band, gender and state or territory distributions;
• measure purchase rates, revenue, refunds, repeat purchasing, audience return and related outcomes;
• respond to support, access, correction, deletion and complaint requests;
• send essential service communications;
• send marketing where consented or otherwise permitted by law;
• monitor, troubleshoot, secure and improve Mine;
• prevent fraud, duplication, manipulation and misuse;
• conduct auditing, research, testing and business planning using appropriately protected information; and
• comply with legal, accounting, tax, regulatory, Shopify and contractual requirements.

Mine does not intend to sell member contact details or provide brands with lists identifying Mine members.

Mine does not intend to use Purchase Data or protected matching information to target advertising to an individual Store Customer or to make an individual decision producing legal or similarly significant effects about that person.

6. Automated processing

Mine uses computer programs and rules to perform or assist with service decisions. These processes may use account, consent, audience-state, timing, qualification, purchase-matching, billing, payment, technical and security information.

Automated processes may:

• route a connection to Waiting to join or Active based on a brand’s audience capacity;
• calculate whether a member has been Active for at least 20% of a calendar month;
• create, lock, remove or change the status of a Pending amount;
• make an earning Available after qualification and cleared brand funding;
• prevent more than one standard earning for the same member, brand and month;
• match protected codes and generate aggregated outcomes;
• identify duplicate, unusual, fraudulent or technically invalid activity; and
• queue, delay or block a transaction or account action for review.

Mine’s automated processes may affect audience participation, Pending amounts, earnings or withdrawals. A member may request human review of an audience status, qualification, payment or related decision by contacting Mine.

7. Information brands receive

Mine does not provide a participating brand through the service with:

• a member’s name, email address, contact details or Mine account identity;
• the protected member matching code;
• the member’s consent record;
• an individual match result;
• an individual purchase value, product, frequency or history;
• a member-level export linking Mine participation with Shopify orders; or
• the member’s general browsing history.

A brand separately holds information about customers and orders from its own store. Mine does not tell the brand which of those customers are Mine members or which individual store records Mine matched.

Brands may receive aggregated audience information such as Active, Waiting and qualified-member counts; age-band, gender and state or territory distributions; audience trends; billing counts; purchase coverage; purchaser counts; observed net revenue; refunds; purchase rate; repeat-purchase rate; average order value; purchase frequency; observed sales change; estimated uplift; Audience Return; Audience ROI; and methodology, measurement-period, evidence-state or confidence information.

Commerce outcomes may create inference risk because a brand already holds its own order records. Mine applies aggregation, access controls and suppression rules intended to reduce the risk of singling out or re-identifying an individual. Mine may suppress small cohorts, narrow cells, overlapping comparisons, filters or exports, delay results or apply a higher reporting threshold where reasonably required.

An observed change describes what Mine measured during stated periods. Modelled uplift, incremental revenue, Audience Return and Audience ROI are estimates based on disclosed methodologies and do not establish that Mine or a member earning caused a purchase.

Brands are required not to:

• identify or attempt to re-identify a member;
• combine Mine insights with other information to identify a member;
• infer whether a particular member purchased, what they purchased, when they purchased or how much they spent;
• use filters, overlapping cohorts, exports or comparison techniques to infer an individual match or purchase;
• single out members using Mine results; or
• use Mine insights for prohibited individual-level decisions.

References to anonymous insights in Mine marketing mean brand-facing insights that do not contain direct member identifiers or individual match records. They do not mean that all information held by Mine is anonymous. Pseudonymous information remains personal information where Mine can reasonably connect it to an individual.

8. Who we disclose personal information to

8.1 Participating brands

We provide brands with the aggregated information described in section 7. Where a Store Customer makes a valid privacy request through a store or Shopify, Mine may provide the brand with information reasonably required to respond to that request.

8.2 Service providers

We may use service providers including:

• Supabase for authentication, databases, storage and server functions;
• Shopify for store authorisation, APIs, webhooks, source Purchase Data and privacy-request handling;
• Stripe for brand billing, identity verification, connected payout accounts and withdrawals;
• Resend and related email infrastructure for account and communication delivery;
• DigitalOcean and other hosting, deployment and content-delivery providers;
• security, monitoring, analytics, development and technical providers; and
• accountants, lawyers, auditors and other professional advisers.

These providers may process personal information on our behalf, make information available to Mine at a brand’s direction or act under their own legal and privacy obligations.

8.3 Authorities and legal recipients

We may disclose personal information where required or authorised by law, in response to valid legal process, to protect safety or rights, to investigate fraud or security incidents, or in connection with a proposed sale, financing, restructure or transfer of Mine’s business subject to appropriate protections.

9. Overseas processing

Mine’s primary Supabase databases are currently hosted in Australia. Some other providers or their subprocessors may process or receive personal information outside Australia.

Likely overseas locations include Canada and the United States, including through Shopify, Stripe, email, hosting, development and support services. Providers and their subprocessors may also process information in other countries in which they operate.

Where practicable, Mine will maintain and update information about likely overseas locations. Where required by applicable law, Mine takes reasonable steps to ensure overseas recipients handle personal information consistently with applicable Australian privacy requirements.

10. Marketing communications

Mine’s member service includes promotional payment emails that identify the participating brand associated with a member payment and may contain promotional brand content and a link to that brand’s website. Express consent to these emails is presented separately during member onboarding and is required to complete account creation.

Mine may send marketing or promotional communications while the person’s recorded consent remains active or where otherwise permitted by law. Mine records later changes and withdrawals and applies them to future promotional sends.

Marketing emails identify the sender and include a simple way to unsubscribe from a particular brand or from all Mine promotional emails without signing in. A person may also withdraw consent by contacting brad@mineinsights.com.au. Mine generally gives effect to an unsubscribe request immediately and, in all cases, within the period required by applicable law.

Withdrawing promotional-email consent does not close or suspend a member’s account or affect their eligibility for member earnings.

Mine may still send essential messages about verification, passwords, audience status, payments, withdrawals, security, legal changes, service interruptions or required account actions after a person opts out of marketing.

11. Security

Mine takes reasonable steps designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Measures may include:

• managed authentication and password hashing;
• email verification and account-recovery controls;
• role-based and row-level database access controls;
• separation of member, brand and administrative access;
• encrypted network connections and provider-managed encryption at rest;
• secret-keyed HMAC matching codes and key versioning;
• restricted service credentials, environment secrets and token controls;
• webhook authentication and replay or deduplication protections;
• logging, monitoring, rate limiting, auditing and review;
• secure payment providers; and
• backup, incident-response and access-revocation procedures.

No internet or storage system is completely secure. Mine cannot guarantee that unauthorised access, loss or misuse will never occur.

If an eligible data breach occurs, Mine will investigate, contain and notify affected people and regulators where required by applicable law.

12. How long we retain information

Mine retains personal information only for as long as reasonably needed to operate the service, calculate and explain earnings, provide historical records, respond to privacy requests, resolve disputes, prevent fraud and meet legal obligations.

Our current retention approach is:

• raw Store Customer email addresses received with Purchase Data are intended to be processed transiently and discarded promptly after the protected matching code is generated;
• complete commerce webhook payloads are retained for the shortest period reasonably required to validate, process, reconcile and secure the event and are ordinarily deleted or reduced to a permitted minimal record within 30 days;
• an unmatched individual order is ordinarily discarded after matching and operational processing, while a minimal unmatched record needed for deduplication, reconciliation, security or privacy compliance is ordinarily retained for no more than 30 days unless a longer period is required by law or a valid privacy request;
• matched pseudonymous purchase records are retained for up to 24 months from the purchase, refund or last material reconciliation date and are then deleted or properly de-identified, unless a shorter period applies after a privacy request or Shopify requirement, or a longer period is required by law;
• Shopify access tokens are retained only while the integration remains authorised and are revoked, deleted or rendered unusable after disconnection as soon as reasonably practicable;
• commerce-integration metadata, webhook receipts, consent evidence, privacy-request records and security audit records are retained for the periods reasonably required to demonstrate authorisation, compliance, security and dispute handling;
• operational audience-state and qualification information is retained while needed to operate the account and may be retained with billing, earning, dispute or fraud records where required;
• billing, earnings, withdrawals, payments, invoices, tax and accounting records are generally retained for seven years;
• member and brand legal-acceptance evidence may be retained for seven years after the relevant account or contractual relationship ends;
• account and profile information is retained while the account is active and may be retained for up to 90 days after closure before deletion or de-identification, unless longer retention is required by law or reasonably needed to resolve a payment, security, fraud or legal issue;
• support, complaint and access-request records are retained for as long as reasonably needed to respond, demonstrate compliance and resolve disputes;
• technical and security logs are retained for periods reasonably needed for security, troubleshooting, fraud prevention and audit;
• marketing preferences and related compliance evidence are retained for as long as needed to respect and demonstrate the person’s choice; and
• properly aggregated and de-identified analytics may be retained indefinitely for reporting and trend analysis.

De-identified means identifiers have been removed and Mine cannot reasonably reconnect the information to an identifiable individual. Merely labelling information as aggregated or pseudonymous does not make it de-identified.

Deletion from active systems may not immediately remove encrypted backup copies. Backups are protected from ordinary use and are deleted or overwritten through routine rotation unless retention is required by law.

Information that is no longer required will be deleted or de-identified where practicable, unless retention is required or authorised by law.

13. Member choices, consent and account closure

Before completing onboarding, a member is shown a specific explanation of private Shopify matching and must affirmatively consent to that processing. Mine records the applicable consent and legal-document versions and acceptance time.

Private matching is required for member participation. A person who does not consent cannot complete member onboarding.

A member may withdraw consent to new private matching by requesting closure of the Mine account. Withdrawal applies prospectively and means the person can no longer use the member service.

A member may separately leave an individual brand audience. Leaving stops new private matching and qualification for that brand prospectively without closing the entire Mine account.

When a member requests account closure, Mine takes steps to:

• disable the member’s private-matching identity for new matching;
• end open brand-audience relationships;
• stop new qualification and Pending amounts;
• process an Available final balance, including an amount below the ordinary A$5 minimum;
• close authentication access; and
• delete or de-identify account and pseudonymous purchase information that is no longer required.

Closure or deletion may be delayed while a withdrawal is processing, identity or authority is verified, a payment, dispute, fraud or security matter remains unresolved, or information must be retained for accounting, tax, legal or regulatory purposes.

Mine ordinarily completes deletion or de-identification of account and profile information within 90 days after closure, subject to the retention exceptions in section 12.

Closing a Mine account does not require a participating brand or Shopify to delete the brand’s own lawful sales, tax or customer records.

14. Commerce integration and Store Customer requests

When a brand closes its Mine account, uninstalls the Shopify app or disconnects its integration, Mine takes steps to:

• stop intentionally collecting new Purchase Data from that integration;
• revoke, delete or render unusable the applicable access token;
• disable related connections and webhooks;
• delete or de-identify Store Customer Purchase Data that is no longer required;
• retain only information permitted under section 12, applicable law, a valid privacy request or a binding Shopify requirement; and
• retain properly de-identified or aggregated outputs where lawful.

Mine receives and responds to Shopify’s mandatory privacy and compliance webhooks, including customer data-access requests, customer deletion or redaction requests and shop deletion or redaction requests.

Mine intends to complete a valid Shopify privacy action within Shopify’s required timeframe, ordinarily within 30 days after receiving the request, unless Mine is legally required or authorised to retain particular information.

A Store Customer may make a privacy request through the relevant Shopify store or contact Mine directly. Mine may need the store identity, order reference, customer email or other limited information reasonably required to locate and verify the record.

15. Access and correction

A person may ask to access personal information Mine holds about them or request correction of information that is inaccurate, incomplete, out of date or misleading.

Requests may be sent to brad@mineinsights.com.au. A person does not need to use a particular form.

Mine may need to verify the requester’s identity before providing access or making changes. Mine may refuse or limit access where permitted by law and, where appropriate, will explain the reason.

Access to pseudonymous matching information may require Mine to recreate or compare a protected code after verifying the requester. Mine will not disclose another person’s information or reveal whether another person is a Mine member.

A person may also request a copy of this policy in another reasonably available form by contacting Mine.

16. Privacy complaints

Privacy questions or complaints may be sent to:

Include enough information for Mine to understand and investigate the issue. Mine will acknowledge and investigate the complaint within a reasonable period and aims to respond within 30 days where practicable.

Where the Privacy Act 1988 (Cth) applies and a person is not satisfied with Mine’s response, they may be entitled to complain to the Office of the Australian Information Commissioner.

17. Changes to this policy

Mine may update this Privacy Policy when the service, technology, providers or legal requirements change.

Mine will publish the updated version and change the effective or updated date.

Where a change is material, Mine may provide notice through the service, website or email. Where required, Mine will ask for renewed consent before continuing the affected processing.

18. Contact