Privacy Policy

Version: privacy-1.1.1-2026-10-05-r22
Effective: 1 October 2026

This Privacy Policy explains how Ohara collects, uses, stores, discloses and protects your personal information, and how you can access or correct it or make a complaint. In short: we collect only what we need to run your account, sell you cards, post them to you and keep accurate records — such as your email address, a one-way password hash (the password is processed transiently for registration and sign-in, not stored in plaintext), the IP address and time when you accepted our terms, delivery addresses you give us, and the history of your top-ups, openings, buy-backs and postage. Your payment card details are entered with and held by our payment processor, not by us. We use your information to provide Ohara, keep it secure and fair, meet our legal obligations and, only if you agree, to send you marketing. We share it only with the service providers who help us (such as our payment processor, carrier and hosting providers), some of whom are overseas, and where the law requires. We keep it only as long as we need it, then delete or de-identify it. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we will tell you and the Office of the Australian Information Commissioner (OAIC) if a data breach is likely to cause you serious harm.

Draft for review. This document is a draft prepared for review and must be reviewed by an Australian legal practitioner before it is relied on.

Launch blocker: Legal identity incomplete. All unresolved fields are registered in unresolved.json; owner/counsel must resolve them before paid launch.

Current build: Ohara remains a demo/test service. No real money is collected and no real cards are sold or posted. Proposed paid-service procedures in this draft (including refunds on closure, support response times, spending controls and retention) require the bracketed owner decisions and implementation before launch. Account and privacy obligations still apply to information actually collected.

1. About this policy

1.1 Who we are. Ohara is operated by UNRESOLVED: OPERATOR_LEGAL_NAME (ABN UNRESOLVED: ABN) of UNRESOLVED: REGISTERED_ADDRESS ("Ohara", "we", "us", "our").

1.2 Our commitment. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). UNRESOLVED: PRIVACY_ACT_COVERAGE (if the operator would otherwise fall within the small business exemption, confirm whether it will opt in under section 6EA of the Privacy Act; see the R8 legal review register. Either way, this policy commits Ohara to handling personal information in accordance with the APPs.)

1.3 What this policy covers. This policy applies to personal information we collect through Ohara (our website, applications and related services), through customer support, and through promotions we run. "Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

1.4 Collection notice. This policy also serves as our notice about collection. Where we collect personal information for a purpose not described here (for example, a particular promotion), we will tell you at the time.

2. The personal information we collect

2.1 Account information. Your email address; a bcrypt hash of your password (our server receives the password transiently to hash or check it, but does not store it in plaintext); your account status and settings; your declared birth date, country of residence and confirmation that you are in Australia. These are declarations; the current build does not independently verify identity, age or location.

2.2 Your acceptance of our terms. When you create your account, and whenever you accept a new version of our terms, we record which documents and versions you accepted, the date and time, and the IP address from which you accepted. We also record against each opening the version of the terms that applied.

2.3 Sign-in, security and device information. Session identifiers (stored in cookies), IP addresses, browser and device information, sign-in times, and security events (for example, rate-limit events). The current account build has no email verification or password-reset service. See the Data Handling Note for the records actually stored.

2.4 Transaction and account history. Details of your berry top-ups (amount, time, status and the reference our payment processor gives us); your berry ledger (every top-up, opening, refund and buy-back, with your running balance); your openings (the pack, revision, price, time, result and the physical card allocated to you, with a fingerprint of the odds you were shown); the cards in your vault; your buy-backs; and your postage requests (cards, quote, fee, carrier, tracking number and status).

2.5 Delivery details. The name, street address, suburb, state and postcode you give us for a postage request. The address is saved with that request.

2.6 Payment information. Your card or other payment details are entered directly with our payment processor, which holds them. We do not receive or store your full card number. We receive and keep limited information from the processor, such as a payment reference or token, the payment status, and information the processor provides about whether a payment is suspected to be fraudulent. The current Stripe test integration stores the Checkout Session reference and URL, amount, currency, rail, timestamps and status on the top-up record. It sends Stripe the internal customer and top-up identifiers. It does not persist card brand, last four digits, full card details or webhook bodies.

2.7 Age and identity verification. If we need to verify your age or identity, we may use a third-party verification service. UNRESOLVED: AGE_VERIFICATION_METHOD (describe the method and provider, and whether any identity document or sensitive information is collected, once chosen.)

2.8 Communications. Messages you send us, complaints, notes of calls, and your marketing preferences (including any consent you have given or withdrawn).

2.9 Responsible purchasing records. Any limit, break or self-exclusion you ask for or that we apply, and related notes.

2.10 Promotions. If you enter a promotion, the information the promotion asks for (for example, your name, social media handle and contact details), and, if you win, the information needed to deliver your prize.

2.11 Sensitive information. We do not intend to collect sensitive information (such as health information or information about racial or ethnic origin). If we ever need to, we will ask for your consent unless the law permits otherwise.

2.12 Dealing with us anonymously. You can browse Ohara without an account. Our 18+ eligibility rule is an Ohara rule, not a claim that trading cards are generally age-restricted by law. Transactions require an account to maintain ownership and a consistent ledger; delivery requires accurate delivery details. We do not require a legal name merely to browse or register with an email address, and will allow anonymity or a pseudonym where lawful and practicable.

3. How we collect personal information

3.1 From you. When you create an account, top up, open packs, request postage, sell cards back, contact us or enter a promotion.

3.2 Automatically. When you use Ohara, our systems record technical information (such as IP addresses, session cookies and security events), as described in clause 2.3 and clause 9.

3.3 From third parties. From our payment processor (payment status and fraud signals), from a verification provider (the result of an age or identity check), from our carrier (delivery status), and from regulators or law enforcement agencies where the law allows.

3.4 Unsolicited information. If we receive personal information we did not ask for and could not have collected under the APPs, we will destroy or de-identify it as soon as practicable, where lawful and reasonable to do so.

4. Why we collect, use and disclose personal information

4.1 We collect, use and disclose personal information to:

(a) create, manage and secure your account, and confirm that you are eligible (including that you are 18 or over and live in Australia);
(b) take payments for berry top-ups and postage, and give refunds;
(c) carry out openings, record their results and keep accurate transaction records of every opening, berry movement and buy-back for the necessary retention period;
(d) hold your cards, deliver them to you, and handle lost or damaged parcels;
(e) process buy-backs;
(f) provide customer support, handle complaints and resolve disputes (including card issuer disputes);
(g) detect, prevent and investigate fraud, payment abuse, automated misuse (such as bots), security incidents and breaches of our terms;
(h) provide the spending limits, breaks and self-exclusion described in our Terms of Service, and act where we are concerned about harm;
(i) comply with our legal obligations, including tax and record-keeping laws, consumer law, and lawful requests from regulators, courts and law enforcement;
(j) run promotions you enter;
(k) understand how Ohara is used and improve it (using de-identified or aggregated information where we can); and
(l) if you have agreed, send you marketing (see clause 8).

4.2 If you do not give us information. If you do not provide information we ask for, we may not be able to open your account, verify your eligibility, take a payment, deliver your cards or respond to your request.

4.3 Other uses. We will not use or disclose your personal information for any other purpose unless you consent, you would reasonably expect it and the purpose is related to one of the purposes above, or the law requires or permits it.

5.1 We disclose personal information only as needed for the purposes in clause 4, to:

(a) our payment processor, UNRESOLVED: PAYMENT_PROCESSOR_LEGAL_NAME, and any other payment provider you choose to use at checkout, to process payments, refunds and disputes and to help prevent fraud;
(b) our carrier, UNRESOLVED: CARRIER_NAME, to deliver your cards (your name, delivery address and, if needed for delivery, your email address);
(c) our technology providers, including hosting (UNRESOLVED: HOSTING_PROVIDER_AND_REGION), email delivery (UNRESOLVED: EMAIL_SERVICE_PROVIDER) and, if used, analytics (UNRESOLVED: ANALYTICS_PROVIDER_IF_ANY) and verification (UNRESOLVED: AGE_VERIFICATION_PROVIDER_IF_ANY) providers, who handle information on our behalf under contract;
(d) our professional advisers, such as lawyers, accountants and auditors;
(e) regulators, courts, law enforcement and government agencies, where the law requires or authorises it;
(f) your card issuer, where you dispute a payment; and
(g) a business that takes over Ohara, if that happens, so that it can continue to provide the service to you (we will tell you first).

5.2 We do not sell your personal information, and we do not share it with third parties for their own marketing.

6. Overseas disclosure

6.1 Some of the providers listed in clause 5 store or process information outside Australia. In particular:

(a) our payment processor may process and store payment information in UNRESOLVED: PAYMENT_PROCESSOR_DATA_COUNTRIES; and
(b) our technology providers may store or process information in UNRESOLVED: TECHNOLOGY_PROVIDER_DATA_COUNTRIES.

6.2 Before we disclose personal information to a recipient overseas, we take reasonable steps to ensure that the recipient handles it consistently with the APPs (for example, through contractual obligations), and we remain accountable for how it is handled as the Privacy Act requires.

7. How we protect personal information

7.1 We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure. These steps include:

(a) storing only a one-way hash of your password, produced by a password-hashing function designed to resist guessing;
(b) never storing full payment card numbers;
(c) encrypting information in transit to and from Ohara;
(d) limiting access to personal information to staff and providers who need it, and logging access to our administration tools;
(e) keeping an append-only, tamper-evident audit record of important events, which records only the minimum personal information needed (for example, it does not copy delivery addresses); and
(f) choosing providers with appropriate security, and requiring them by contract to protect information.

7.2 No system is completely secure. If you think your account or information has been compromised, contact us immediately (see our Terms of Service, clause 5).

8. Marketing

8.1 Only with your consent. We will send you marketing emails or messages only if you have agreed to receive them. Agreeing to marketing is never a condition of having an account.

8.2 Unsubscribing. Every marketing message will identify us and include a simple, free way to unsubscribe. We will act on your request promptly, and within five business days.

8.3 Breaks and self-exclusion. We will not send you marketing while you are on a break or self-excluded.

8.4 Service messages. Messages about your account, purchases, postage, security and changes to our terms are not marketing, and we will send them while you have an account.

9. Cookies and similar technologies

9.1 Essential cookies. We use cookies that are necessary for Ohara to work, such as cookies that keep you signed in, protect your session and help us detect automated misuse. Ohara will not work properly without them.

9.2 Preferences. We may store your display preferences (such as reveal style and sound settings) on your device.

9.3 Analytics. The current embedded storefront uses no third-party advertising or analytics cookies. It sends first-party operational events to Ohara. Hosted payment pages have their provider's own privacy and cookie disclosures. Any future analytics deployment requires an updated disclosure before use.

9.4 Your choices. You can block or delete cookies through your browser settings, but if you block essential cookies you will not be able to sign in.

10. Automated decisions

10.1 We use automated systems to keep Ohara fair and secure. For example, our systems automatically limit how quickly requests can be made from an account or connection, and our payment processor's systems may automatically decline a payment that appears fraudulent. These systems can temporarily stop an action from going through. If you think an automated decision has affected you unfairly, contact us and a person will review it. The random draw for each opening is not a decision about you: it is made independently of who you are, against the odds published for every customer. UNRESOLVED: ADM_DISCLOSURE (review this clause before 10 December 2026, when new Privacy Act transparency requirements for automated decisions commence; see the R8 legal review register.)

11. How long we keep personal information

11.1 We keep personal information only for as long as we need it for the purposes in clause 4, including to meet legal and record-keeping obligations. When we no longer need it, we take reasonable steps to destroy it or de-identify it.

11.2 Some records must be retained for a legal, accounting or dispute purpose. Append-only transaction storage protects integrity; it does not create a legal right or duty to retain personal information forever. The applicable tax, corporate and other retention periods must be identified for the operator. When identifiable information is no longer needed and no retention exception applies, we must take reasonable steps to destroy it or de-identify it, including linked records and backups. The current application has no automated retention or de-identification job; the Data Handling Note identifies that implementation gap and the decisions required before paid launch.

11.3 Our Data Handling Note sets out how long we keep each kind of information.

12. Accessing and correcting your information

12.1 Access. You can ask for access to the personal information we hold about you by contacting UNRESOLVED: PRIVACY_CONTACT_EMAIL. We will need to verify your identity. We will respond within 30 days. We do not charge for a request, and we will not charge you for giving access unless the request is complex, in which case we will tell you the cost first.

12.2 Correction. Contact us to correct your account information; the current account page does not yet provide self-service profile editing. You can also ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We will respond within 30 days.

12.3 If we refuse. If we refuse to give access or make a correction, we will give the required written notice and complaint information. We may omit reasons only where the applicable law permits it; an organisation's refusal to correct information is subject to APP 13 notice requirements. If we do not agree to correct information, you can ask us to attach a statement to it.

13. Data breaches

13.1 If we suspect a data breach, we will act quickly to contain it and assess it. If a breach is likely to result in serious harm to anyone affected (an "eligible data breach" under the Privacy Act), we will notify the affected individuals and the OAIC as the Notifiable Data Breaches scheme requires, and tell you what you can do to protect yourself.

14. Children

14.1 Ohara is only for people aged 18 or over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will close the account and delete or de-identify the information, except where we must keep it by law (see the Terms of Service, clause 3.6).

15. Complaints

15.1 Complain to us first. If you have a concern about how we have handled your personal information, contact our Privacy Officer at UNRESOLVED: PRIVACY_CONTACT_EMAIL or by post to UNRESOLVED: REGISTERED_ADDRESS. We will acknowledge your complaint promptly, investigate it, and give you a written response within 30 days.

15.2 The OAIC. If you are not satisfied with our response, or we have not responded within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Use the OAIC website's current complaint form and contact details.

16. Changes to this policy

16.1 We may update this policy from time to time. Each version has its own version string. We will publish the new version on Ohara and, if a change is significant, tell you by email before it takes effect. The version in force at any time is the one published on Ohara.

17. Contact us


Privacy Officer	UNRESOLVED: PRIVACY_OFFICER_NAME_OR_TITLE
Email	UNRESOLVED: PRIVACY_CONTACT_EMAIL
Post	UNRESOLVED: REGISTERED_ADDRESS
Operator	UNRESOLVED: OPERATOR_LEGAL_NAME (ABN UNRESOLVED: ABN)

Version privacy-1.1.0-2026-10-01. Effective 1 October 2026.