This Privacy Policy explains how we collect, use, store, disclose and protect your personal information when you use the VanDough Bakery app and website at app.vandoughbakery.com.au (the "Service"), including our loyalty program (Crust Points).
We are an Australian business and handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Service you agree to this Policy.
You provide directly (at sign-up / onboarding):
Generated as you use the Service:
We do NOT collect or store full card numbers. Card payments are handled directly by our payment processor (see section 4).
We use trusted third-party providers to run the Service. They only receive the data needed for their function:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Application database, authentication, hosting | Account, order and loyalty data |
| Stripe | Card payment processing | Payment details you enter go directly to Stripe; we receive only a payment result |
| Square | Point-of-sale, menu and pricing source of truth | Order / transaction data |
| ClickSend | SMS notifications ("order ready") | Your phone number + message |
| "Sign in with Google" (optional login method) | Your Google account email for authentication |
We do not currently use any separate analytics or email-marketing provider.
Some providers (e.g. Supabase, Stripe, Google) may store or process data on servers outside Australia (including the United States). Where this happens we take reasonable steps to ensure your information is handled consistently with the APPs.
We do not sell your personal information. We may disclose information if required by law, or to protect our rights, users or the public.
We keep your information for as long as your account is active and as needed to provide the Service and meet legal, tax and accounting obligations (for example, financial and transaction records may be retained for around 7 years as required by Australian tax law).
When you delete your account, we archive and de-identify your personal information rather than immediately erasing all records, because we must retain transaction/sales history for legal and accounting purposes. Archived records are stripped of personal identifiers where practicable.
Under the APPs you may:
To exercise any of these, contact us (section 10). If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
We use industry-standard measures (encryption in transit, access controls, reputable processors) to protect your information. No system is perfectly secure; we cannot guarantee absolute security but we take reasonable steps to protect it.
The Service uses your browser's local storage and similar technologies to keep you signed in and remember your selected store and cart. These are necessary for the Service to function. We do not use non-essential or advertising cookies.
The Service is intended for general audiences and is not directed at children under 16. We do not knowingly collect personal information from children without appropriate consent.
We may update this Policy from time to time. Material changes will be notified via the Service or by email. The "Last updated" date shows the current version.
Darra Bakehouse Pty Ltd (ACN 622 683 229) trading as VanDough Bakery
39 Railway Parade, Darra QLD 4076, Australia
Email: hello@vandoughbakery.com.au