Privacy policy

1. Who handles information

CartArchitect is operated by Creeley Digital Systems (ABN 59 135 305 460). Creeley Digital Systems handles information needed to operate the shop-building platform. Each seller also handles information for its own business and must provide an appropriate customer privacy notice. CartArchitect follows this policy regardless of whether a particular small-business exemption may apply and recommends obtaining advice about obligations specific to your business.

2. Information handled by the product

The implementation uses account identifiers and sign-in details, shop and product information, uploaded images, draft and published content, AI job records, purchase and payment-status references, order information and technical security records. What is collected depends on the feature used.

Product photos can contain personal information or embedded metadata. Upload only what is needed. Do not include customer lists, sensitive information or unrelated personal material in prompts or product images. The media pipeline is designed to produce sanitised source images; this is not a guarantee that the depicted content itself contains no personal information.

3. Purposes and collection choices

Information is used to save and publish the requested shop, process authorised builds, manage subscriptions and orders, communicate about service issues, reconcile payments, prevent abuse and respond to requests. Some features cannot work if their necessary information is not supplied.

Optional promotion tools prepare copy or initiate a user-controlled share action. Preparing text does not itself send marketing. Separate marketing consent and unsubscribe handling must be implemented before an automated marketing service is enabled.

4. Service providers and overseas handling

The application is hosted on Railway and uses managed database and media storage for account, shop and uploaded-image records. Accounts use email and password; Resend delivers account emails. OpenAI processes the material submitted for an optional Creative AI Build. Stripe provides any activated payment checkout. These providers may process information outside Australia under their own infrastructure and contractual arrangements; Australian-only storage is not promised.

CartArchitect reviews additional analytics, email, support or advertising providers before enabling them and updates this notice when their handling materially changes the information given here.

5. Public and private content

Publishing intentionally makes the chosen shop content available to visitors and potentially search engines. Do not publish private information. Account access and private media must remain controlled separately from public storefront content. Third-party search engines and recipients may retain copies after material is removed from the service.

Activated payment entry uses Stripe-hosted or embedded provider controls. CartArchitect stores payment-status and reconciliation references rather than asking users to put card details into product content or support messages.

6. Security and retention

Reasonable technical and organisational safeguards are required, including access control, secure transport, incident handling and ongoing review. No platform can promise absolute security. Live hosting, network protection and backup arrangements must be verified independently of local code tests; this policy does not claim that a tested backup and recovery service is in place.

Keep information only for service needs, legitimate recordkeeping or legal obligations, and then remove or de-identify it using a documented process. The implementation has separate media-retention and payment-reconciliation rules; a complete category-by-category retention schedule, backup expiry and post-cancellation process remain to be approved. No invented universal deletion deadline is stated here.

7. Access, correction and privacy concerns

To request access to or correction of your information, ask about deletion or raise a privacy concern, email Info@creeleydigital.com.au, call 1300 386 247 or write to PO Box 357, Narellan NSW 2567. Identity should be verified proportionately without collecting unnecessary identity documents. Any lawful refusal and applicable complaint options should be explained.

Where the Australian Privacy Act applies, the Office of the Australian Information Commissioner provides information about privacy rights and complaints. The service's response process must be finalised before launch. Material changes to this notice should be communicated in a way appropriate to their effect.