Privacy

Lily & Minx is operated by NetLever Pty Limited ("we"). This policy covers everyone we deal with: website visitors, customers, email subscribers and anyone who contacts us. Personal information is information that identifies you, or could reasonably identify you.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988.

Our privacy officer handles privacy questions, requests and complaints. Email info@lilyandminx.com.au or write to PO Box 167, Keiraville NSW 2500. Ask us if you'd like this policy in another form.

• Contact details: your name, email address, phone number if you give one, and billing and delivery addresses.
• Order details: what you buy, prices, discount codes and gift cards used, how you paid (not your card number), delivery and tracking, and any returns, refunds or price-match requests.
• Account details, if you create an account: your email address, saved addresses and order history. You sign in with a one-time code, so we don't hold a password.
• Messages: what you send us by contact form, email, post or chat, such as your order number or a photo of a fault.
• Marketing details, if you subscribe: your email address, your name if you give it, when and how you signed up, and whether you open or click our emails.
• Device and browsing data: your IP address and rough location, device and browser, the pages and products you view, searches, bag and checkout steps, and cookie identifiers.
• Session recordings: how you click, tap and scroll on our pages, recorded by Microsoft Clarity.
• Fraud-check signals, such as whether your address and card details match.

We don't ask for sensitive information, such as health information. Please don't send it to us.

• From you, when you order, create an account, subscribe or contact us.
• Automatically, through cookies, pixels and similar tools on our website and in our emails.
• From Shopify, Shop Pay and the Shop app, and from PayPal, Apple Pay or Google Pay if you pay with them.
• From Australia Post, which sends us delivery updates.
• From someone who orders for you, such as a gift sent to your address.
• From our analytics and advertising providers, which report how our website and ads perform.

You can browse and ask a general question without giving your full name, but we can't take or deliver an order without your name, email address and delivery address.

We use your information to:

• take, check, charge and deliver your order, including customs paperwork for New Zealand and US orders
• send you messages about your order, delivery and account
• answer your questions and handle returns, refunds, faulty pieces and price-match requests
• run your account
• send marketing emails, if you've subscribed
• publish a review or photo you've agreed we can share
• understand how our website is used, and fix and improve it
• measure our advertising and show our ads to you on other websites and apps
• protect our store and customers from fraud and misuse
• keep the records the law requires and deal with complaints and disputes

We use it only for these purposes, for related purposes you'd reasonably expect, or where the law requires or allows it.

Shopify's fraud analysis rates every order automatically, using details such as your IP address and its location, your billing and delivery addresses and whether your card details match. If an order is flagged, we review it and may cancel it, as our terms explain.

Shopify Payments may automatically block a payment it rates as high risk, and your bank or PayPal may decline one. If that happens, contact us and we'll help you pay another way.

We send marketing emails only if you've agreed, for example by signing up on our mailing list page, through our sign-up pop-up or by ticking the box at checkout. Buying from us or contacting us doesn't sign you up on its own. Our mailing list is kept in Shopify; the pop-up is run by Chatty. If you've subscribed and leave items at checkout, we may email you a reminder.

Every marketing email comes from Lily & Minx, names NetLever Pty Limited, includes our contact details and has an unsubscribe link. Unsubscribing is free and doesn't need a sign-in, and we act on it within 5 business days. We keep a record that you've unsubscribed so we don't email you again, and we still send messages you need about an order, a return or your account.

Our emails may record whether you open them and which links you click. We don't send marketing text messages.

We share personal information with the businesses that run our store, take payment, deliver orders, answer messages, and measure and show our ads:

• Shopify: our website, checkout, customer accounts, order and fraud records, analytics, and Shop Pay and the Shop app if you use them. Shopify also uses some information for its own purposes, such as preventing fraud across its stores (Shopify's privacy policy).
• Payment providers: Shopify Payments, processed by Stripe, for cards, and PayPal, Apple Pay and Google Pay if you choose them.
• Delivery: Australia Post and, for international orders, the destination's customs and postal services. For US orders, Zonos calculates and pays import duties through Australia Post.
• Our email host, in Australia, which stores the emails you send us and our replies.
• Chatty: our chat, help centre, order tracking and sign-up pop-up.
• Microsoft: Clarity session recordings, and Microsoft's shopping assistant where it appears on our site.
• hCaptcha: spam protection on some of our forms.
• Analytics and advertising: Google (Analytics, Ads and Merchant Center), Meta (Facebook and Instagram) and Pinterest. See Advertising and cookies.

We may also share information with Australia Post or the label that made a piece when we make a claim (photos of the piece and the order details, not your contact details); with our professional advisers; with someone you've asked us to deal with; with a new owner if our business changes hands; and with courts, regulators or police when the law requires or allows it.

Our store runs on Shopify, so your details are stored and processed outside Australia, and many of our other providers are overseas too. Based on what they publish, the countries are:

• the United States: Shopify, Stripe, PayPal, Apple, Google, Meta, Pinterest, Microsoft, Chatty, hCaptcha and Zonos, and US customs and postal services for US orders
• Canada, the United Kingdom and Switzerland: Shopify
• the European Union: Shopify and Australia Post's service providers
• Singapore and New Zealand: Shopify and Australia Post's service providers, and New Zealand's customs and postal services for New Zealand orders
• Vietnam: Chatty, which is based there
• Japan, India and the Philippines: Australia Post's service providers

These countries may not protect personal information the way Australian law does. We take reasonable steps to make sure our providers protect it.

We use cookies, pixels and similar tools to see how our website is used and to measure and show our ads. A cookie is a small file your browser saves; a pixel is code that tells a provider what happens on a page, such as a product view or a purchase. Google, Meta, Pinterest and Microsoft collect information across many websites, not just ours, under their own privacy policies.

Hashed contact details

Our connections to Google, Meta and Pinterest also send your name, email address, phone number and address in hashed (coded) form once you've given them to us, for example at checkout. Each platform compares the codes with its own users' details to measure our ads and decide who sees them. Some of this is sent from Shopify's servers, so browser settings alone don't stop it.

Your choices

• Email info@lilyandminx.com.au with "Stop ads" in the subject line. We'll stop sending your details to Google, Meta and Pinterest and stop using them for our ads, usually within 30 days.
• Block or delete cookies in your browser, or use private browsing or tracker blocking. Blocking essential cookies can stop your bag or checkout working.
• Turn off personalised ads in your Google, Meta and Pinterest settings.
• Use the unsubscribe link in any marketing email.

Essential cookies keep your bag, currency, checkout and sign-in working. Analytics and advertising cookies last from the end of your visit to up to 2 years, and Chatty's up to 3 years.

You can ask us to:

• give you a copy of the personal information we hold about you
• correct information that's wrong, out of date or incomplete
• delete your information or close your account
• take down a review or photo we've published
• stop marketing emails, or stop using your details for our ads

Email info@lilyandminx.com.au with "Privacy request" in the subject line, or write to PO Box 167, Keiraville NSW 2500. It's free. We'll check the request comes from you, usually by writing to the email address on your orders, and respond within 20 business days.

When you ask us to delete information, we erase it from our store with Shopify's tools, and from our other tools where we can. We keep what the law requires (order and payment records), anything needed for an open order, return, dispute or fraud check, and a note that you've unsubscribed. Providers that use information for their own purposes, such as Google, Meta, Pinterest, PayPal and Australia Post, handle their own deletion requests; we'll tell you how to ask them. If we can't do what you've asked, we'll tell you why in writing.

Our website and checkout run on Shopify over encrypted connections, card payments are handled by the payment provider, customer accounts use one-time codes, and we limit access to the people and providers who need it. No website or email is completely secure, so don't send card details or anything sensitive by email or chat.

If a data breach is likely to cause serious harm, we'll tell the people affected and the regulators the law requires, and what you can do to protect yourself.

How long we keep it

• Order, payment and refund records: at least 7 years, as tax and company law require.
• Account details: until you close your account. Order records stay as above.
• Messages and chats: as long as we need them for your question and anything that follows.
• Session recordings: 30 days.
• Marketing: while you're subscribed, then a record of when you signed up and unsubscribed.

When we no longer need information, we delete it or remove what identifies you.

If you're under 18, you need a parent or guardian's permission to order from us. If you're a parent or guardian and think your child has given us personal information without your permission, contact us and we'll help, including by deleting it where we can.

If you're unhappy with how we've handled your personal information, contact us first at info@lilyandminx.com.au or PO Box 167, Keiraville NSW 2500. Our privacy officer will look into it and give you a written response within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We update this policy when our practices or providers change. This version applies from 28 September 2026. If we want to use information we already hold for a new purpose you wouldn't expect, we'll ask you first where the law requires it.