Last updated: 2 May 2026
What we collect
Account: email, optional name and phone. Orders: shipping address and order history. Payments: handled by Stripe — we never see your full card number. Browsing: standard server logs (IP, user agent, request paths) kept for 30 days for security and analytics.
What we do with it
Process your orders, ship your cards, send order updates, and reply when you contact us. That's the full list. We don't sell or share your data with third parties for marketing.
Subprocessors
Stripe (payments), Australia Post (shipping), Resend (transactional email), AWS (hosting), Pokémon TCG API + TCGCSV (price data — no customer data leaves us).
Your rights
Email privacy@mistys.com.au to access, export, or delete your data. Australian Privacy Principles (APP 1–13) apply — we respond within 30 days.