Privacy policy

Last updated: 9 August 2026

This Privacy Policy explains how Bravemark Pty Ltd trading as Witchy Lashes (ABN 16 700 285 721) ("Witchy Lashes", "we", "us", "our") collects, holds, uses and discloses your personal information when you visit or make a purchase from witchylashes.com.au.

The short version

We collect the information we need to take your order, ship it to you, answer your questions, and — only if you've opted in — send you marketing emails. We use trusted service providers (like Shopify and Klaviyo) to run the store, some of which are based overseas. We never sell your personal information. You can ask us at any time what we hold about you, ask us to correct it, or ask us to delete it. For anything privacy-related, email cs@witchylashes.com.au.

The full policy follows.

1. Who we are

Witchy Lashes is an Australian online store selling magnetic false eyelashes, magnetic eyeliner and botanical skincare. This policy is drafted to comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Spam Act 2003 (Cth), and covers all personal information handled through our website, email and customer service channels.

Privacy contact: cs@witchylashes.com.au Postal address: PO Box 545X, Leumeah NSW 2560, Australia

2. What personal information we collect

Depending on how you interact with us, we may collect:

  • Identity and contact details — your name, email address, shipping and billing address, and phone number (if provided).
  • Order information — the products you buy, order history, and delivery details.
  • Payment-related information — we do not see or store your full card number. Payments are processed securely by Shopify Payments and its payment partners (and PayPal or similar, where offered); we receive only confirmation of payment and limited details such as card type and last four digits.
  • Device and browsing information — IP address, browser type, time zone, pages viewed and how you arrived at our site, collected through cookies and similar technologies (see section 7).
  • Quiz answers — if you take our eye-shape quiz, your answers (and email address if you choose to provide it) so we can recommend the right lashes.
  • Customer service correspondence — the content of emails, messages and support requests you send us.
  • Marketing engagement data — whether our emails were opened or clicked, and your subscription status, held in our email platform.
  • Reviews, photos and stories — if you leave a review or agree to share your story or photos with us, the content you submit.

A note on health information. We do not ask for or deliberately collect health information. Some customers choose to tell us about circumstances such as chemotherapy-related or alopecia-related lash loss when asking for product advice. If you volunteer information like this, we use it only to answer your question. We do not use it for marketing segmentation, and we never publish or refer to it publicly, unless you give us separate, explicit written consent.

3. How we collect it

We collect personal information directly from you when you place an order, create an account, sign up to our email list, take the eye-shape quiz, leave a review, or contact us by email or social media. We collect some information automatically through cookies and analytics tools when you browse the site. Occasionally we receive information from third parties involved in serving you — for example our review platform, shipping carriers, or payment processors.

4. Why we collect and use it

We collect, hold and use personal information to: process and deliver your orders (including returns and replacements); respond to your questions and provide customer service; send you marketing emails where you have opted in (you can unsubscribe at any time using the link in every email); recommend products, including through the eye-shape quiz; improve our products, website and service through aggregate analysis; detect and prevent fraud; and meet our legal obligations, including tax record-keeping.

We only send marketing messages to people who have consented, and every marketing email identifies us and contains a working unsubscribe link, as required by the Spam Act 2003 (Cth).

5. Who we share it with

We share personal information only with service providers who help us run the store, and only what they need to do their job:

  • Shopify (USA/Canada) — hosts our store, processes orders and holds customer records. Shopify's privacy policy: https://www.shopify.com/legal/privacy
  • Klaviyo (USA) — sends our emails and holds subscriber profiles and engagement data.
  • Loox (review platform) — collects and displays product reviews, including names and photos you choose to submit.
  • Payment processors — Shopify Payments and its banking partners process your payment.
  • Shipping carriers — such as Australia Post and international carriers, who receive your name, address and contact details to deliver your order.
  • Analytics and advertising platforms — Google (Google Analytics 4), Meta (Meta Pixel, for Facebook and Instagram advertising) and Microsoft (Clarity, for understanding how visitors use our site). See section 7.

We do not sell, rent or trade your personal information to anyone.

6. Overseas disclosure

Some of the providers above are located overseas — principally in the United States (Klaviyo, Meta, Google, Microsoft, Loox's infrastructure) and Canada/USA (Shopify). This means your personal information is disclosed to recipients outside Australia. We take reasonable steps to ensure these providers handle your information safely, including relying on their published data processing agreements and privacy commitments. Please note the privacy laws in these countries differ from Australian law.

7. Cookies, pixels and tracking

Our site uses cookies and similar technologies:

  • Essential cookies (Shopify) — required for the store to function: keeping your cart, checkout and login working.
  • Google Analytics 4 — helps us understand site traffic and behaviour in aggregate.
  • Meta Pixel — measures the effectiveness of our Facebook and Instagram ads and may be used to show you relevant ads. This can involve sharing hashed (scrambled) identifiers with Meta.
  • Microsoft Clarity — records anonymised interactions (clicks, scrolls) to help us improve the site experience.
  • Klaviyo tracking — recognises subscribers who visit from our emails.
  • Loox — supports the display of product reviews.

You can control cookies through your browser settings, and opt out of interest-based advertising at https://www.youronlinechoices.com.au. Blocking essential cookies may prevent parts of the store (like checkout) from working.

8. How we hold and protect your information

Your information is held in the secured systems of the providers listed above, all of which encrypt data in transit and at rest, and on access-controlled devices. We protect access with multi-factor authentication, limit access to those who need it, and review our installed apps and integrations regularly. No internet transmission is ever completely secure, but we take the protection of your information seriously.

Retention. We keep order records for at least five years to meet Australian tax obligations. Marketing data is kept while you are subscribed; if you unsubscribe you are moved to a suppression list so we never email you again by mistake. Customer service correspondence is kept only as long as needed to resolve and document the matter. Review and story content is kept until you withdraw your consent.

9. Data breaches

If we ever suspect that personal information has been accessed or disclosed without authorisation, we will assess it promptly, take steps to contain it, notify affected customers where serious harm is likely, and notify the Office of the Australian Information Commissioner where required by law.

10. Access, correction and deletion

You can ask us at any time: what personal information we hold about you (we'll provide a copy, free of charge, normally within 30 days); to correct it if it's wrong; or to delete it. If you ask us to delete your information, we will remove you from our marketing platform and de-identify your customer record, keeping only what tax law requires us to retain (and we'll tell you if that's the case). To protect you, we will verify that a request comes from the email address linked to the account before acting on it.

Email cs@witchylashes.com.au to make any of these requests.

11. Complaints

If you believe we have mishandled your personal information, please contact us first at cs@witchylashes.com.au — we will investigate and respond promptly. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au.

12. Children

Our store is not directed at children under 16 and we do not knowingly collect their information. If you believe a child has provided us personal information, contact us and we will delete it promptly.

13. Third-party links

Our site and emails may link to third-party websites (such as social media platforms and review pages). This policy applies only to Witchy Lashes; those sites have their own privacy policies which we don't control.

14. International customers

We are based in Australia and handle personal information under Australian law. If you are in the EU, UK, US or elsewhere, you may have additional rights under your local law (for example access, erasure, portability or objection under the GDPR or UK GDPR, or rights under US state privacy laws). Contact us at cs@witchylashes.com.au and we will honour these requests.

15. Changes to this policy

We update this policy whenever our data practices change — for example if we add a new tool or service provider — and refresh the "Last updated" date above. Material changes will be posted on this page.

Contact

Bravemark Pty Ltd trading as Witchy Lashes Email: cs@witchylashes.com.au Post: PO Box 545X, Leumeah NSW 2560, Australia