Privacy Policy

1. Introduction

Poorab Solutions operates the Poorab Store platform, which lets independent businesses run online stores and manage products, orders, payments, bookings, pickup and delivery.

In this policy, we, us and our refer to Poorab Solutions as operator of the platform. You refers to customers, website visitors, registered users, and the business owners and staff who use our merchant tools.

It explains how personal information is collected, used, stored and disclosed when you use our websites, mobile applications, the stores we host, and related services.

Each store on the platform is an independent business. Where a store decides for itself how to use customer information — for example its own marketing — that store is responsible for those activities and may have its own privacy policy.

2. Information We Collect

What we hold depends on which features you use. The categories below reflect what our systems actually record.

2.1 Identity and contact information

• First and last name.
• Mobile or telephone number. This is required to hold an account, because it is how accounts are identified.
• Email address.
• Profile photo, if you add one.
• Whether your email has been verified, and when.
• If you sign in with Google, your Google account identifier, and the name and email address Google returns. We request only the openid email profile scopes — we do not receive your Google password, contacts, or any other Google data.
• Anything you include when you contact a store or our support team.

2.2 Address and location information

• Delivery and billing addresses, including any you save to your account for reuse.
• Suburb, city, state, postcode and country.
• Delivery instructions and notes you add to an order.
• Pickup choice and, for table service, the table you ordered from.
• Your device's location, only if you grant permission when choosing an address or finding nearby stores. See section 11.

Addresses you type or select are sent to Google Maps Platform to be completed, validated, converted to coordinates and used to measure delivery distance. We store the resulting address. We do not keep a continuous history of your device's location.

2.3 Account and security information

• Your password, stored only as a bcrypt hash. We cannot read it, and neither can our staff.
• One-time verification codes, stored only as a hash and automatically discarded after ten minutes. The code itself is never saved in readable form.
• Sign-in sessions: a hashed session token, its expiry, and when it was last used.
• The IP address and browser or device identification string (user agent) recorded with each session.
• Security and activity records of significant actions, which include the action taken, the account that took it, the IP address, the user agent and the data submitted with the request.
• Counts of recent sign-in and verification attempts, used to block guessing attacks.

2.4 Orders, transactions and bookings

• The name, phone number, email address and delivery address given for the order — which may differ from your account details.
• Items ordered, quantities, options, prices, discounts, taxes and fees.
• Order number, timestamps, status and full order history.
• Pickup or delivery choice, requested time, and delivery instructions.
• Bookings and reservations: date, time, party size, pickup or delivery choice, special requests, and any event or pre-order details the store asks for.
• Refunds, cancellations, disputes, order issues and support records, including notes staff add.
• Reviews and ratings you submit, and your favourites.
• Searches you run while signed in, stored against your account.
• A per-store summary of your activity: how many orders you have placed, total amount spent, first and last order dates, and counts of which delivery and payment methods you used. This drives loyalty programmes and store reporting.
• Your shopping cart, including items left in it, so it is still there when you return.

2.5 Payment information

Card payments are processed by Stripe. Your card number and security code are entered into Stripe's own payment fields and sent directly to Stripe — they never reach our servers and we never store them.

What we receive back from Stripe and do store against the order is:

• The card brand (for example Visa or Mastercard) and the last four digits only.
• Whether a digital wallet such as Apple Pay or Google Pay was used.
• The payment method type — card, Afterpay, Zip, or cash at the counter.
• Stripe's payment reference, the amount, the fee breakdown and the payment status.
• For part payments taken in person, the staff member who took each payment.

Stripe handles your card details as an independent controller under its own privacy policy, including for fraud prevention.

Merchants who set up direct debit for their platform subscription have their mandate and payment method held by Stripe; we store Stripe's reference for it and a description of the method, such as the brand and last four digits.

2.6 Business and merchant information

If you run or work for a store on the platform, we also hold:

• Business and trading names, business address, contact details and opening hours.
• Store domain, branch details, branding and configuration.
• Staff accounts, their assigned roles and what each role is permitted to do.
• Products, inventory, stock movements, pricing, sales, analytics and payout records.
• Payout details submitted for settlement, and onboarding information required by Stripe.
• Mail server credentials, if the store chooses to send its own email; these are stored encrypted.
• Subscription, invoice and payment records for the store's use of the platform.

2.7 Device, network and technical information

• IP address.
• Browser type and version, or app version.
• Device type and operating system; for mobile, whether it is iOS or Android.
• Pages requested, timestamps and server logs.
• Session identifiers and diagnostic or error information.
• Failed sign-in attempts and other security events.

2.8 Cookies and similar technologies

We use a small number of cookies that the service cannot work without. They are set by us, marked HTTP-only where possible so page scripts cannot read them, and are not used for advertising:

• token and refresh_token — keep you signed in.
• logged_in — lets the interface know a session exists.
• mfa_verified_… — records that you completed a verification code step.
• active_store — remembers which store you are shopping in on a shared domain.

We also use your browser's local and session storage for things like your cart and display preferences.

Advertising measurement. Our public store and marketplace pages load the Meta (Facebook) pixel. It is not loaded on signed-in dashboard, admin, settings or profile pages. The pixel reports page views and a small number of actions — starting checkout, completing a purchase, creating an account, submitting a store application, and following a sign-up link. The only order detail sent is the total amount and currency; no name, email, phone number, address or item list is sent. Meta does, however, receive the page address, your IP address, your browser details and its own cookie identifier, and may combine that with information it already holds about you.

You can block this with browser privacy settings, an ad or tracker blocker, or by adjusting your Meta ad preferences. Blocking it does not affect your ability to order.

2.9 Communications

We keep the messages, feedback and support requests you send, and records of the transactional emails and SMS messages we send you about your orders.

2.10 Files you upload

Where a feature lets you upload an image — a profile photo, or product and branding images for merchants — we store that file and process it to produce resized versions. We do not access your photo library, contacts, microphone, camera roll or other device content beyond the file you choose.

3. How We Collect Information

• Directly from you, when you create an account, place an order, make a booking, write a review or contact us.
• Automatically, when you use our websites or apps — through server logs, cookies and the technical information described above.
• From the store fulfilling your order, including notes its staff add.
• From our payment, delivery, mapping, messaging and hosting providers, where they are involved in your transaction. For example, a delivery provider reports the driver's progress back to us.
• From Google, if you choose to sign in with your Google account.

4. How We Use Personal Information

We use personal information to:

1. Create and maintain customer and merchant accounts.
2. Verify your identity, sign you in and protect your account.
3. Process orders, payments, refunds and cancellations.
4. Arrange pickup and delivery, and provide delivery tracking.
5. Manage bookings, reservations, catering and pre-orders.
6. Send order confirmations, receipts, delivery updates and important account or security notices.
7. Provide customer support and resolve disputes.
8. Operate loyalty programmes, referral schemes, discounts and rewards.
9. Run store dashboards, inventory, reporting and business analytics for the store you ordered from.
10. Detect and prevent fraud, unauthorised access, spam and abuse — including rate-limiting sign-in attempts by IP address.
11. Keep the platform secure, reliable and performing well, and diagnose faults.
12. Measure the effectiveness of our advertising, as described in section 2.8.
13. Meet legal, tax, accounting and record-keeping obligations.
14. Send marketing messages where permitted, with a way to opt out.
15. Enforce our terms and protect our legal rights.

We will not use your personal information for a materially different purpose without telling you, or obtaining your consent where the law requires it.

5. How We Share Personal Information

5.1 The store you order from

When you place an order or make a booking, the relevant store receives what it needs to fulfil it: your name, phone number, email address, order details and, for delivery, your address and instructions. It can also see your order history and loyalty status with that store.

Poorab Store hosts many independent businesses. A store's staff can only see information belonging to their own store, according to the role they have been given. One store cannot browse another store's customers or orders. Our own administrators can access platform-wide records where it is necessary to operate, support and secure the service.

5.2 Delivery providers

When a delivery is arranged, the provider receives the recipient's name and phone number, the delivery address and instructions, the pickup location and an order reference, so the driver can complete the drop-off. We receive delivery status and the driver's name, phone number and location back from them for tracking.

Depending on what the store has enabled, the provider may be Shipday (which may in turn dispatch through DoorDash or Uber Eats), DoorDash, Uber Direct, or the store's own drivers. Each third-party provider handles that information under its own privacy policy.

5.3 Payment providers

Payment and subscription information is shared with Stripe, as described in section 2.5.

5.4 Service providers

We use the following providers to run the platform. Each one is listed because personal information actually passes through it:

• Vercel — website and application hosting.
• MongoDB Atlas — the main database.
• A managed Redis service — short-lived data such as verification codes, sessions and rate-limit counters.
• Amazon Web Services (S3) — storage of uploaded images and files.
• Google Maps Platform — address autocomplete, validation, geocoding and delivery distance.
• Google — sign-in with Google, and the mail service that delivers our transactional email.
• Twilio — SMS notifications about your order.
• Expo — delivery of push notifications to our mobile apps.
• Meta Platforms — advertising measurement on public pages only, as described in section 2.8.

Where a store sends email using its own mail server, that email is delivered by whichever provider the store has configured rather than by us.

5.5 Legal and security disclosures

We may disclose information where reasonably necessary to comply with the law or a lawful request, to enforce our terms, to investigate suspected fraud, to protect someone's safety, or to protect the security of our services.

5.6 Business changes

If the business is merged, acquired, restructured or sold, information may be transferred as part of that transaction, subject to privacy law.

5.7 We do not sell your personal information

We do not sell personal information, and we do not share your name, email address, phone number or address with advertising networks. The one advertising technology we use is the Meta pixel described in section 2.8, which receives page and device information rather than your contact details.

6. International Data Transfers

Several of our providers operate outside Australia, so your information may be stored or processed overseas — including in the United States, where Stripe, Vercel, Amazon Web Services, Google, Twilio, Expo, Shipday and Meta are based or operate infrastructure.

Where we disclose personal information overseas we take the steps required of us by Australian privacy law, including Australian Privacy Principle 8. Contact us at admin@poorabstore.com.au if you would like more detail about where your information is handled.

7. Data Storage and Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. The measures in place include:

• Encrypted connections (HTTPS) for traffic to our websites and apps.
• Passwords stored only as bcrypt hashes, never in readable form.
• Verification codes stored only as hashes, and expiring after ten minutes.
• Session tokens stored as hashes, with expiry and the ability to revoke a session.
• A second verification step by email when signing in.
• Role-based permissions, so staff only reach what their role allows, and each store's data stays scoped to that store.
• Limits on repeated sign-in and verification attempts, to frustrate guessing.
• Activity logging of significant changes, so access can be reviewed.
• Card details handled by Stripe rather than by us, so there is no card number here to lose.
• Stored mail credentials kept encrypted.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach occurs that is likely to cause serious harm, we will act in line with the Notifiable Data Breaches scheme.

8. Data Retention and Deletion

We keep personal information only as long as we reasonably need it for the purposes in this policy — providing the service, supporting you, keeping the platform secure, resolving disputes, and meeting accounting, tax and other legal obligations. Some records, such as completed transactions, must be kept for a set period by law.

Short-lived items expire automatically: verification codes after ten minutes, and sign-in sessions at their expiry.

Deleting your account. You can delete your account yourself, at any time, from Delete your account — also reachable from your profile in our websites and apps. You will be asked to confirm it is you, and the account is locked and signed out everywhere immediately.

The deletion itself takes effect 30 days later. During those 30 days you can sign in and cancel it, which restores everything. After that it cannot be undone. If you would rather we did it for you, email admin@poorabstore.com.au from the address on your account.

When it takes effect, we permanently remove:

• Your name, email address, phone number and profile photo.
• Every saved delivery and billing address.
• Any saved payout or bank details.
• Your cart, favourites and search history.
• Loyalty stamps, rewards and referral codes. Unclaimed rewards are forfeited.
• Push notification registrations for your devices.
• Your sign-in sessions and your membership of any shop team.
• The per-store activity summary described in section 2.4.

Records we are obliged to keep are retained with your identity taken out of them rather than deleted — past orders and payments keep their amounts and dates but lose your name, phone number, email address and delivery address; reviews you published remain, shown as left by a deleted customer; and a shop's own accounting and stock history keeps what happened without recording who. Information already held by a payment or delivery provider is governed by that provider's own policy.

If you own a business on the platform, transfer or close it first — a trading business needs an owner who can be billed, paid out and contacted about its customers' orders.

Deleting an account will not necessarily remove: records of completed transactions we are required to keep; information an independent store holds under its own obligations; or information already held by a payment or delivery provider under its own policy. Where we must retain a record, we restrict it to that purpose.

9. Your Privacy Rights

Subject to Australian privacy law, you may:

• Ask for access to the personal information we hold about you.
• Ask us to correct information that is wrong, incomplete or out of date.
• Ask us to delete your account and information, as described in section 8.
• Withdraw consent where we rely on it, such as device location or push notifications.
• Unsubscribe from marketing messages at any time.
• Raise a concern about how we have handled your information.
• Complain to the Office of the Australian Information Commissioner.

To make a request, email admin@poorabstore.com.au. We may ask you to verify your identity, and will respond within the time required by law. We do not charge for access requests in ordinary cases.

10. Marketing Communications

We will always send you the messages needed to run your order and protect your account — order confirmations, receipts, delivery updates, verification codes and security notices. These are part of the service and cannot be switched off while you hold an account.

Promotional messages are sent only where the law permits. Every marketing email carries an unsubscribe link, and you can opt out at any time by using it or by emailing us. Opting out of marketing does not stop the transactional messages above.

11. Location Permissions

Our websites and apps can use your device's location to fill in your address and to find stores near you. Your browser or phone will ask for permission first, and nothing is collected unless you allow it.

Location is used at the moment you ask for it. We keep the address it produces, not a running record of your movements, and you can always type an address in by hand instead. You can withdraw permission at any time in your browser or device settings without losing access to any part of the service.

Separately, when a delivery is in progress we receive the driver's location from the delivery provider so that the order can be tracked. That is the driver's location, not yours.

12. Push Notifications

Our mobile apps can send push notifications about orders, bookings and account activity. If you allow notifications, we store a push token issued by the notification service for your device, together with the platform (iOS or Android) and the app version, so we know where to send a message and can stop sending to a device that no longer exists.

The token identifies a device, not you personally, and is delivered through Expo's push service. You can turn notifications off at any time in your device settings; the same information remains available by email and in your account.

13. Children's Privacy

Our services are intended for people old enough to make their own purchases. We do not knowingly collect personal information from children where doing so would be unlawful, and we do not direct our services or advertising at children.

If you believe a child has given us personal information, contact us at admin@poorabstore.com.au and we will review it and take appropriate action.

14. Third-Party Websites and Services

Our websites and apps link to third-party services — payment pages, delivery tracking, store websites and social media. Those services operate under their own terms and privacy policies, and we are not responsible for how they handle your information. We encourage you to read their policies.

15. Australian Privacy Law and Complaints

We aim to handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

If you have a privacy concern, please raise it with us first at admin@poorabstore.com.au so we can investigate and respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Nothing in this policy excludes or limits rights that cannot lawfully be excluded or limited.

16. Changes to This Policy

We may update this policy as our services, providers or legal obligations change. The current version is always published on this page with the date it last changed, shown at the top.

Where a change materially affects how we handle your information, we will give you notice, and seek your consent where the law requires it.

17. Contact Us

For privacy questions, access or correction requests, deletion requests or complaints:

Please include enough detail for us to understand your request — but never send us passwords, full card numbers or verification codes.