Privacy Policy

This privacy policy is provided by STOREFULFIL PTY LTD (ACN 701 718 649, ABN 98 701 718 649), a proprietary company limited by shares registered in Queensland, Australia on 25 August 2026, operating under the StoreFulfil™ brand. You can contact us regarding privacy or data matters by emailing info@storefulfil.com.

This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have in relation to it when using our public site, Knowledge Library, and merchant platform.

We process personal data in the following distinct ways:

• Enquiries. When you contact us via the public website, you provide your name, email address, company name (optional), and your message. A hidden, empty "website" honeypot field is included for bot detection (real visitors should leave it empty; it is not an additional visible field). Enquiries are stored by us before best-effort notification delivery via Resend to our configured internal contact mailbox (currently info@storefulfil.com). We use this to follow up and respond to your enquiry.
• Abuse prevention & security. When you request the security check on the contact form, our server observes your IP address and you submit security signals. We use this to apply rate limits and verify that submissions are from humans. This bot check is provided by Cloudflare.
• Platform accounts. For clients using the app, we process contact details, login credentials, and role information to authenticate and authorise users.
• Fulfilment operations (Processor). We process order, inventory, and return data on behalf of our clients. In this context, we act strictly as a data processor; the client is the data controller. We only use this data to provide the contracted service to that specific client.

As a data controller for the public website, our stated position on processing activities is based on the following:

• Legitimate interests: We have a legitimate interest in answering requested business enquiries and protecting the public form from abuse and automated attacks. We do not reuse these details for unsolicited marketing.
• Necessary storage: Language and session storage is limited to carrying out the visitor's explicit request to remember a language or banner choice and is not used for tracking.

Our public website and Knowledge Library use minimal local storage. StoreFulfil application code sets no cookie on anonymous public pages and includes no analytics, ads, or tracking. The live Replit-hosted production edge currently adds a platform-managed cookie named GAESA to responses. StoreFulfil code does not create, read, or use that cookie, and the public Replit documentation available to us on 21 August 2026 did not explain its purpose. The Knowledge Library uses no application storage.

• sf-marketing-locale: Written only after your explicit language choice to remember your preferred language across visits, and persists until cleared.
• sf-lang-banner-dismissed: Session-only storage applied after you take action on the language banner.
• sf-locale: A legacy key neither read nor written by the current site. It is mentioned here only as historical data that the clear button below removes.
• GAESA: Added by the production hosting edge rather than by StoreFulfil code. It was observed with an expiry about 30 days after issue and may be reissued by the host on later responses. The clear control below does not claim to manage provider infrastructure cookies.

No new service workers or caches are registered on this site. A temporary retirement script at the previous URL exists solely so browsers with already-installed legacy workers can safely delete their StoreFulfil caches and unregister automatically in the background. New visitors do not install it. The Clear local data button below remains an immediate manual control (it unregisters only the exact legacy StoreFulfil worker and preserves any unrelated same-origin registrations or caches you may have).

We only share personal data with service providers to operate our platform. These named providers may process data outside your country; processing locations and safeguards depend entirely on their current provider configuration and terms.

• Cloudflare: Provides the Turnstile bot-challenge for our contact form. Cloudflare Turnstile collects client IP, TLS fingerprint, User-Agent, site key and origin. Cloudflare says it acts as processor for website protection and controller when using signals to improve Turnstile. Our server sends the token and may send remote IP to siteverify. Standard widget config requires no cookies/localStorage and pre-clearance is not enabled. Turnstile is loaded only after your explicit request. Removing the widget unloads it but cannot undo signals already processed. (Cloudflare Turnstile Privacy)
• Resend: Delivers notification emails generated from your enquiries. Enquiries are stored by us before best-effort Resend notification delivery. (Resend Privacy)
• Replit: Hosts our application infrastructure and databases. Live production responses currently identify a Google frontend and add the hosting-managed GAESA cookie described above. Google is listed by Replit as an infrastructure subprocessor; StoreFulfil does not load Google Fonts, Google Analytics, or Google advertising code. The selected project geography and account-level contractual evidence are maintained separately from this public notice. (Replit Privacy)

We do not sell personal data.

Our active data retention practices for public site visitors are: the current configured schedule redacts enquiry IP and deletes stale rate-limit rows after 30 days, and deletes enquiry rows after 730 days when the automated policy runs; an authorised controller review or legal hold can pause automation and will be documented.

• Platform data: Client operations data is subject to the client's separate controller retention limits.

You have rights, subject to applicable law and circumstances, to access, correct, delete, restrict processing of, object to processing of, or request portability of your personal data. To exercise these rights, please contact us at info@storefulfil.com. If you are unsatisfied with our response, you may lodge a complaint with your local data protection authority.

StoreFulfil application code uses no optional analytics, advertising, or tracking technology. The clear control removes user-requested language preferences, while Turnstile is used for form submission only after an explicit request. The purpose and legal classification of the hosting-managed GAESA cookie remains a provider-evidence item; this notice does not describe it as an application cookie or make an unsupported necessity claim.