Data Handling Note

Version: data-handling-1.0.1-2026-10-05-r22
Effective: 1 October 2026

Draft for review. This note describes the current demo and account build,
and identifies retention decisions still required before paid launch. It must
be reviewed by an Australian legal practitioner before it is relied on.

1. Who is responsible

Ohara is operated by UNRESOLVED: OPERATOR_LEGAL_NAME (ABN UNRESOLVED: ABN) of
UNRESOLVED: REGISTERED_ADDRESS. Contact UNRESOLVED: PRIVACY_CONTACT_EMAIL for access, correction, retention or privacy questions. This note explains the Privacy Policy; it does not override that policy or rights under applicable law.

The operator's Privacy Act coverage or opt-in is still to be confirmed:
UNRESOLVED: PRIVACY_ACT_COVERAGE. Small-business status alone does not settle coverage; exceptions can apply. The policy's voluntary commitments remain relevant even where a statutory exemption applies. See the OAIC small-business guidance.

2. What this build actually keeps

Information	Purpose and current handling	Retention decision or mechanism
Email, account ID, declared birth date and country	Registration, eligibility and account ownership. Age and residence are self-declared; no ID documents are collected by this build.	While needed for the account, then UNRESOLVED: ACCOUNT_RETENTION_PERIOD, subject to a documented legal hold.
Password hash	bcrypt is used to verify sign-in. The plaintext password is processed transiently and is not stored or logged by the application.	Remove or invalidate when access is terminated; account-erasure workflow is not yet implemented.
Customer session	A random token is held in an HttpOnly, SameSite cookie; only its hash and expiry are stored on the server. HTTPS deployments must enable Secure cookies.	Valid for 24 hours; sign-out deletes that session. Expiry prevents access but does not itself delete the database row. Expired-row cleanup is outstanding.
Accepted documents	Document versions, SHA-256 fingerprints, full document text, customer ID, UTC acceptance time and direct connection IP. Required agreements are distinguished from informational documents.	Evidence of the agreement: UNRESOLVED: ACCEPTANCE_RETENTION_PERIOD. Immutable in normal operation; eventual privacy disposal must include embedded acceptance copies in opening records.
Wallet and card transactions	Top-up references/status, berry movements, running balances, openings, odds/revision snapshots, card allocations, buy-back values and postage records.	UNRESOLVED: FINANCIAL_RECORD_RETENTION_PERIOD with its legal basis and start date documented. Do not retain all account identifiers indefinitely merely because a ledger is append-only.
Delivery details	Name and Australian address supplied with a postage request, plus shipment/tracking records.	UNRESOLVED: DELIVERY_RETENTION_PERIOD; retain only what remains necessary after delivery, complaints and any legal hold. No real address should be entered in the demo.
Payment-provider data	In Stripe test mode: Session reference and checkout URL, amount, AUD currency, timestamps and status. Internal customer/top-up IDs are sent to Stripe. No full card number, CVC, card last-four or raw webhook body is persisted by this integration.	Keep transaction evidence under the financial schedule. The provider has its own separate obligations and privacy policy. Test mode requires test payment details.
Security and operational records	In-memory request buckets use account/email-derived keys and direct connection IPs. Operational metrics and an append-only audit trail record application events. The application does not promise a complete record of every sign-in or every read.	UNRESOLVED: SECURITY_LOG_RETENTION_PERIOD for persisted logs. Inventory hosting/proxy logs separately before deployment. Rate-bucket memory is not a durable customer database.
Browser storage	Essential session/demo cookies; local display preferences; a pending top-up reference in session storage so a network retry does not create a second payment.	Sign-out invalidates the server session; browser controls can clear local storage. The pending top-up key is removed once the server confirms a top-up record.
Support, marketing and promotions	Records supplied through any support service or separately entered promotion. This build has no email delivery, marketing or promotion-entry system.	Configure UNRESOLVED: SUPPORT_RETENTION_PERIOD and the promotion-specific lawful period before those services operate.
Backups and exports	Database and operational backups can contain the same personal information as the originals.	UNRESOLVED: BACKUP_RETENTION_PERIOD, access restrictions and a tested expiry/restore procedure are required.

3. Retention is based on purpose and law

The operator must fill each period above, name its trigger (for example, completion of a transaction), and document any exception. Tax and corporate retention duties are not an instruction to keep every piece of personal information forever. Most tax records must generally be retained for five years, with exceptions; companies' financial records generally require at least seven years after the transactions are completed. The operator's structure and record type matter. See ATO record-keeping guidance and ASIC company records.

Under APP 11, an entity covered by the APPs must take reasonable steps to destroy or de-identify personal information no longer needed for a permitted purpose, unless an applicable retention exception applies. Removing an email alone is not necessarily de-identification: account IDs, addresses, IPs and transaction links may still identify someone. See OAIC APP 11 guidance.

Current limitation: the application protects the transaction and consent history against ordinary editing, but does not yet implement a scheduled purge, account erasure or validated de-identification process. The operator must implement and test that process, including backups and accepted snapshots, before relying on the proposed retention schedule. Closing an account is not automatic deletion. An outstanding dispute may justify a specific documented hold, reviewed regularly; it is not a blanket exemption for all data.

4. Access and disclosures

Access is limited to the operator and service providers who need the information. This repository does not establish a production hosting, backup, email or carrier contract. Complete UNRESOLVED: HOSTING_PROVIDER_AND_REGION, UNRESOLVED: EMAIL_SERVICE_PROVIDER,
UNRESOLVED: CARRIER_NAME, UNRESOLVED: PAYMENT_PROCESSOR_LEGAL_NAME,
UNRESOLVED: PAYMENT_PROCESSOR_DATA_COUNTRIES and UNRESOLVED: TECHNOLOGY_PROVIDER_DATA_COUNTRIES in the Privacy Policy before deploying those services. Local database files are not encrypted by the application; disk encryption, backup protection and HTTPS are deployment responsibilities and must be verified, not assumed.

Stripe Checkout is hosted by Stripe. Its privacy policy describes its processing. Ohara's test integration does not establish an approved live merchant relationship. No independent age/identity provider is configured; any later deployment requires the specific notice UNRESOLVED: AGE_VERIFICATION_METHOD.

5. Your requests and incidents

Ask UNRESOLVED: PRIVACY_CONTACT_EMAIL for access or correction and identify the relevant account without sending a password or full payment card number. We will use a proportionate identity check, explain any lawful refusal and provide complaint information under the Privacy Policy. Do not send identity documents unless a specific, secure process has first been agreed.

Report suspected account or data compromise to UNRESOLVED: SECURITY_CONTACT_EMAIL. The operator must investigate suspected breaches promptly, assess whether the Notifiable Data Breaches scheme applies and notify affected people and the OAIC when required. See the OAIC breach guidance.

This note is supplied with the other documents at signup. Its version and fingerprint are recorded with the acceptance event, as an informational document. Accepting it does not waive privacy rights or consent to unrelated marketing.

Version data-handling-1.0.0-2026-10-01. Effective 1 October 2026.