Privacy Policy

Who we are

“We”, “us” and “our” mean Maxwell Jacobs, a sole trader in Victoria, trading as Pet Sales Australia (ABN 43 597 814 497). The Privacy Act 1988 (Cth) doesn’t apply to most small businesses, and we believe that includes us. We aim to follow the Australian Privacy Principles (APPs) anyway, by choice.

What we collect

We collect information from you, your browser, people who email us and authorities or welfare bodies that contact us. Some also comes from the companies that run parts of the site for us, such as SMTP2GO telling us an email to you bounced.

From every visitor

• Page use and cookies (see Cookies and analytics).
• Your location, only if you press Use My Location. Your browser asks you first, then sends us your position, rounded to about a kilometre. We use it only to find your suburb, and don’t keep it. The suburb becomes part of the results page’s address.
• Connection details. Cloudflare, which hosts the site, uses your IP address (your connection’s internet address), browser details and the address of each page you ask for, to deliver pages and block attacks. It keeps them in its logs, with the rough location it works out from your IP address, and copies those logs to our own private storage, also with Cloudflare. We use the logs to fix faults, look into attacks and misuse, and as evidence if there’s a dispute (How long we keep it). Our own database stores only a scrambled code made from your IP address with a secret key, never the address itself, to limit repeated waitlist sign-ups.

When you email us

We keep your email address, your name if you give it, and what you send us, to answer you and to deal with what you raise. Claude, our AI assistant, also reads each email (Who we share it with). We log each report, complaint, privacy request, request to come off our list and request from an authority in a private spreadsheet: when it arrived, what kind it is, the sender’s first name (or an authority officer’s name and email address, what they asked and the listing or account they name), and when we must answer. Don’t email card or bank details, passwords or ID documents.

About other people

Emails you send us may mention other people. If we receive personal information we didn’t ask for, we delete it as soon as we reasonably can, unless we’d have collected it anyway, such as evidence of a scam.

The listings waitlist

If you join our list on our List a Pet page, we collect your email address, and the first name, seller type, state and animals you give us, whether you ticked the box for news and offers, and when you joined and confirmed. We also record which version of the form you saw, and when we emailed you.

We email you a link to confirm your address, and you join only when you press the button on the page it opens. If you don’t, you aren’t on the list. The link works for 30 days, and no longer than the 90 days we keep an unconfirmed sign-up. After that, until those 90 days are up, the page it opens offers to email you a new link, so you don’t have to fill in the form again.

We use your details only to email you when listings open, with what your state asks you to have ready, our news and offers if you ticked the box, and the notices this policy promises. Every email from the list has an unsubscribe link that works without signing in, or you can email info@petsales.net.au. Cloudflare stores the list and runs the bot check on the form, and SMTP2GO sends the emails (Who we share it with).

To limit misuse of the form, we also keep:

• a scrambled code made from your email address with a secret key, which doesn’t show the address, with a count of the confirmation emails we’ve sent it
• a note against that code if an email to the address bounces back as undeliverable or is reported as spam. Either way, we take the address off the list. After a bounce you can join again with it, but after a spam report we don’t email it again for the 7 years we keep the note
• a scrambled code made from your IP address (From every visitor), with a count of the sign-ups sent from it that day.

We delete sign-ups and changes to your answers that aren’t confirmed after 90 days. When you unsubscribe, we stop emailing you and delete your email address, first name, seller type, state and animals from the list. We keep a record of your consent and unsubscribe (the scrambled code of your address, what you ticked, the form version, the times and how you left the list), as evidence, for 7 years. Our email log also keeps a record of each email we send you (the address, the subject, when it was sent and what became of it, with the mail servers’ technical details) for 7 years, whether or not you confirmed. How long we keep it has the other periods.

The ID check

The ID check opens with listings. Until then, we collect nothing for it. This is how it will work.

Every seller must pass an ID check before their first listing goes live. It costs $9.95 and covers up to 3 tries in 30 days. Stripe sets it aside on your card when you start, and we take it once a try gets a result, pass or fail; if none does, we release it. It’s free for whoever runs a rescue or shelter’s account, once we’ve checked the organisation.

1. Stripe asks your consent, then for a photo of your government photo ID and a selfie.
2. Stripe checks the document, using software and sometimes its own reviewers, and its software compares your face with the ID’s photo. Your face is biometric information, which privacy law treats as sensitive.
3. Stripe tells us whether you passed. Stripe may refuse anyone under its minimum age.

From the check, we keep:

• your checked first and last name
• your suburb, postcode and state, if your ID shows an Australian address
• the check’s reference number, status and dates, the version of the consent you ticked, and each try’s result (with the reason, if it failed)
• from your $9.95 payment: what you paid and when, and a card “fingerprint” (a code Stripe gives each card, not its number), used only to count tries per card.

We don’t download your ID images, selfie, ID number or date of birth. Stripe stores them for us. We can view them in our Stripe account, but we look only if you ask about a problem with your check, or to investigate fraud or a legal issue. We ask Stripe to delete them 30 days after your check ends (you pass, use your last try, cancel, or your 30 days for tries run out); that can take up to 4 days.

Never email us your ID. If you do by mistake, we delete that email.

What Stripe keeps

Stripe processes your ID images, selfie and ID details (name, address, date of birth and ID number), device information and signs of fraud, and receives your account email and card details. It also keeps its own copy, under its privacy policy, to run and improve its services and prevent fraud. It says it keeps biometric information for up to a year. Stripe may ask to use your data to improve its face-matching technology; you can say no. To have Stripe delete its copy or withdraw that consent, see Stripe’s guide or Stripe support. Stripe may store and process this information in the United States and India.

What other people can see

Until listings open, the site shows nothing you’ve given us to anyone else. When listings open, this section will say what a listing and a seller’s page show.

Reports and welfare concerns

The report buttons open with listings. Until then, you can email a report or a concern to info@petsales.net.au. We collect what you tell us. Don’t include card or bank numbers, passwords, sign-in codes or ID documents.

• We don’t tell the person you reported who you are, unless the law makes us. We may ask them for their side, without saying who you are.
• We may give the relevant authority your report and your contact details so they can ask you about it.
• We email you to say what we did, leaving out anything private.

How we use your information

We use personal information to:

• run the listings waitlist
• stop misuse of the site and our forms
• handle reports, welfare concerns and authorities’ requests
• answer questions, requests and complaints
• improve the site
• meet legal obligations.

We don’t use it for anything else unless it’s related and you’d expect it, you agree, or the law allows it.

We may publish overall figures that don’t identify anyone.

Who we share it with

We use these companies to run the site and our email:

• Cloudflare, Inc. (United States) hosts the site, database, backups and our copies of logs, runs scheduled jobs and blocks bots and attacks, including with its Turnstile bot check. It receives the emails you send to info@petsales.net.au and passes them to our inbox, keeping its own record of each email’s sender, recipient and subject for up to 31 days. We ask for our database to be kept in the Oceania region, but Cloudflare doesn’t guarantee it, and your visits may be handled in other countries.
• SMTP2GO (Sand Dune Mail Ltd) (a New Zealand company; we send through its Australian region) sends our waitlist emails, and sends our replies when you email us. It gets your email address and those emails, and tells us if an email to you bounces or is reported as spam.
• Anthropic, PBC (United States) provides Claude, the AI assistant that helps us run our email. It reads every email sent to info@petsales.net.au: its text, and the names and types of any attachments, never the attachments themselves. It sends our standard reply saying we’ve got your email, logs reports, complaints, privacy requests, requests to come off our list and requests from authorities for a person to deal with, and moves any email that seems to hold the sender’s own ID document to the bin, so we can delete it. An email holding someone else’s ID, such as one a scammer sent you, stays for a person to deal with. It decides from what an email says, in any words, whether it asks to come off our list. It never replies to an authority or gives anyone your details. Anthropic doesn’t use what Claude reads for us to train its AI models, unless its safety systems flag it as breaking Anthropic’s usage rules. We also use Claude to help run the site, so it may see your details when it carries out a request, such as taking you off our waitlist.
• Google LLC (the United States and other countries with Google data centres) hosts the inbox where we read emails sent to info@petsales.net.au, so it holds emails you send us until we delete them, and clears them from its systems within 180 days after that. It also hosts the private spreadsheet where we log reports, complaints and requests from authorities, and runs Google Analytics on our public pages (see Google Analytics).

Overseas

Some providers above hold or access personal information overseas: Cloudflare, Google and Anthropic in the United States (Cloudflare and Google also in other countries where they have data centres), and SMTP2GO, a New Zealand company that sends our emails from Australia. Before using one, we check its privacy and security terms and confirm it publishes how it protects personal information, and we accept its data protection terms where it offers them. On the plan we use, Anthropic offers none: it handles what Claude reads under its own privacy policy, and we keep its model training turned off.

Authorities

We may give personal information to:

• animal welfare authorities, such as Animal Welfare Victoria, councils, RSPCA inspectors and similar bodies in other states, after a report of, or if we suspect, poor animal welfare or a breach of animal welfare, sale or advertising laws.
• officers using a legal power to ask for it, such as Victorian authorised officers checking an ad, who can require documents and records (Domestic Animals Act 1994 (Vic) s 74AA)
• police, about a suspected scam or other crime, or when they use a legal power to ask
• the eSafety Commissioner, when the Online Safety Act 2021 (Cth) requires it
• courts, tribunals and anyone else the law requires.

A person at Pet Sales Australia decides each disclosure. We keep a written record of what we give authorities, to whom and why.

If the business is sold

If we sell the business, the new owner may take over the records needed to run the site. We’ll make following this policy a condition of the sale. We’ll tell people on our waitlist by email and on the site at least 30 days before. If the law needs your permission for your information to go to the new owner, we’ll ask, and you can unsubscribe instead. While a sale is being discussed, a possible new owner sees only information that doesn’t identify you.

Nobody else

We may share information with a lawyer or accountant for advice; they must keep it confidential. Apart from those listed above, we don’t sell, rent or share personal information, including with advertisers. If we ever offer deals from partners, we’ll ask you separately, with a box you tick yourself, and share your details only if you say yes.

Cookies and analytics

We use Google Analytics (below). We don’t use advertising cookies or hidden tracking images (pixels). If we ever add either, we’ll update this policy first and give you a way to turn them off that works. You can block or delete cookies in your browser.

Cookies we set

We set no cookies of our own yet, apart from Google Analytics’ and Cloudflare’s security cookies (below). The cookies that keep you signed in start when sign-in opens with listings.

Cloudflare, which protects the whole site from bots and attacks, sets a security cookie (__cf_bm) when you open a page, to help tell people from bots. It lasts 30 minutes after your last visit. If Cloudflare asks your browser to pass a check, it also sets cf_clearance for 30 minutes to remember that you passed, and our limits on repeated requests may set _cfuvid to tell apart people who share an internet connection. These are security cookies, not analytics or advertising ones.

Cloudflare’s Turnstile bot check runs on our waitlist form, using your IP address and browser details. Cloudflare also uses this to improve Turnstile (its policy).

Google Analytics

Google Analytics 4 tells us how people find and use our public pages. It never loads on account, sign-in, message, report, alert, unsubscribe or waitlist confirmation pages. Its cookies (_ga, and _ga_ followed by our site’s Google Analytics code) hold a random ID and the times of your visits, for up to 2 years after your last visit. Google receives your IP address (to estimate roughly where you are), that ID, the pages you view, how you got here, and your device and browser. We don’t send Google your email address, phone number, messages or anything you type into a form, and we don’t use its advertising features. Google keeps its record of each visit, tied to that random ID, for 14 months, then deletes it in its next monthly clean-up. If you visit again, the 14 months for the ID itself starts again. Totals that don’t identify anyone, such as how many times a page was viewed in a day, have no end date.

See how Google uses this information. To opt out, use Google’s opt-out add-on on a computer, or a browser or extension that blocks Google Analytics.

Decisions made automatically

Until listings open, computer programs make only these decisions about you.

Software alone decides:

• whether our waitlist form takes a sign-up. It limits how many sign-ups one internet connection can send in a day, and how often we email one address to confirm it, using the scrambled codes the waitlist keeps
• whether a form was sent by a person (Cloudflare’s Turnstile bot check)
• whether an address comes off our waitlist after an email to it bounces back as undeliverable or is reported as spam.

Claude, our AI assistant, decides, for each email sent to info@petsales.net.au, whether it seems to hold the sender’s own ID document (if so, it moves the email to the bin and we delete it), whether it gets our standard reply saying we’ve got it, and whether it is logged for a person to deal with as a report, complaint or request from an authority. It uses the sender, the subject and the text, and the names and types of any attachments, never the attachments themselves. Claude is an AI assistant made by Anthropic (Who we share it with). It can get things wrong, which is why a person looks again if you ask.

A person decides what we do about each report, complaint and request, whether to pass anyone’s details to an authority or police, and any decision you ask us to look at again.

Asking a person to look again

To have a person look at any decision above, email info@petsales.net.au. We’ll tell you what information the decision used and give you a person’s answer.

Emails we send

Our emails come from Pet Sales Australia (info@petsales.net.au), and those from our waitlist show our ABN.

If you join our listings waitlist, we email you a link to confirm your address, then email you when listings open, and send news and offers only if you ticked the box.

Marketing emails, such as news and offers, go only to people who’ve said yes. Each has an unsubscribe link that works without signing in and takes effect within 5 business days. We email old-site users only if they’ve asked us to.

We’ll never ask you, by email or message, for your bank or card details or a sign-in code, or ask you to pay another member. Until listings open, we don’t charge for anything.

How long we keep it

When each period ends, we delete the information or remove what identifies you, and a copy of it in a backup goes when that backup does. We keep something longer only where the law requires it, or while a legal claim, or a police or regulator request, is open.

• Listings waitlist:
  • a confirmed sign-up: until you unsubscribe
  • unconfirmed sign-ups: 90 days
  • unconfirmed changes to your answers: 90 days
  • a record of your consent and unsubscribe: 7 years after you unsubscribe
  • the scrambled code of an address we’ve emailed to confirm, and its count: 12 months after the last of those emails
  • a note that an email to an address bounced or was reported as spam: 7 years
  • a day’s count of sign-ups from one connection: 2 days.
• Reports: 7 years after the end of the calendar year we review them.
• Claude, our AI assistant: Anthropic deletes what Claude reads for us within 30 days. If Anthropic’s safety systems flag something as breaking its usage rules, it can keep that for up to 2 years, and its record of the flag for up to 7 years. Copies of the emails Claude read, kept on our own computer and in its backups: 7 years at most.
• Email: what you send to info@petsales.net.au, 7 years, and our replies for as long as the email they answer. Each line in our spreadsheet is kept as long as the email it points to. An emailed report is kept as a report, above. A complaint’s emails stay with our record of the complaint, as our Complaints page explains.
• Requests from authorities, and our record of what we gave authorities, to whom and why: 7 years after the end of the calendar year we close the request.
• Logs:
  • Cloudflare’s own request and security logs and our email providers’ own delivery logs: up to 35 days
  • our copy of every request to the site (each page you visit, with your IP address and browser details): 14 months
  • our copies of security, sign-in, admin, waitlist and email logs: 7 years
  • a log tied to a report, scam, dispute or breach, copied into that case’s record: 7 years.
• Google Analytics: visit records tied to a random ID, 14 months (see above); totals that don’t identify anyone, no time limit.
• Backups of our database, used only to restore the site:
  • daily copies: 90 days
  • one copy a month: 12 months
  • one copy a year: 7 years.

How we protect it

The site works only over encrypted connections (HTTPS). Only Pet Sales Australia’s owner and the providers listed above can get at the personal information we hold. Each provider uses it to do its job for us, and for its own purposes only where this policy says so, or, for Anthropic, as its own privacy policy allows.

No system is completely secure. If a data breach is likely to cause you serious harm, we’ll tell you as soon as we can, explain what happened and say what you can do.

Your choices and rights

Stay anonymous where you can

You can browse without an account or saying who you are. To join our waitlist you give an email address, how you’ll list and your state, so we can email you what your state asks for. A first name and your animals are up to you.

See your information

Email info@petsales.net.au for a free copy of the personal information we hold about you. We’ll answer within 30 days. We may first check it’s really you. We may hold some back, for example where it would reveal someone else’s personal information, affect a scam investigation or relate to a legal dispute. If so, we’ll tell you why in writing and how to complain.

Fix it

Tell us what’s wrong and we’ll fix it, free. To change your waitlist answers, send the form again with the same email address, then confirm the change from the email we send. Until you do, your answers stay as they were. To change the address itself, join with the new one and unsubscribe the old one, or email us. If we’ve already passed the wrong information to someone, we’ll tell them about the fix if you ask.

Delete it

To leave the waitlist, use the unsubscribe link in any email from the list, or email info@petsales.net.au. To have us delete anything else, email the same address. We’ll delete your information or remove what identifies you, except our record of your waitlist consent and unsubscribe and the scrambled codes that limit misuse of the waitlist form (for the periods in How long we keep it), and what we need for a safety report, a legal claim or an authority’s request. Copies already in backups, logs and our providers’ systems go at the end of the periods this policy gives them. If we restore the site from a backup, we delete again what you asked us to delete.

Children

Accounts and listings are for people 18 or older, when they open. Under-18s can browse. We don’t ask anyone’s age, so someone under 18 can still email us or join our waitlist. Apart from what we collect from every visitor and what they choose to send us, we don’t knowingly collect their information.

If you used the old site

At launch, we keep a dated archive of the old site’s records, then delete its user accounts and stored messages from the old site’s server and its backups. We use the archive only for questions about old ads and accounts, legal requests and claims, and checking whether a breeder listed on the old site, for our founding offer. We keep it for 2 years after the old site closes.

Complaints

If you’re unhappy with how we’ve handled your personal information, email info@petsales.net.au with “Privacy complaint” in the subject, saying what happened and what you’d like. We’ll let you know we’ve got it within 2 working days and reply in writing within 30 days, as our Complaints page explains.

If you’re not satisfied, or we haven’t replied within 30 days, contact the Office of the Australian Information Commissioner (OAIC). It can investigate only businesses the Privacy Act covers, which may not include a small business like ours, but it can tell you your options.

Changes to this policy

Changes update the version and date at the top. We’ll email people on our waitlist before a change affects how we use information they’ve given us. Ask us for any earlier version. Before a planned feature starts, we’ll update this policy to say what it collects and who receives it. Planned features include listings, accounts, the ID check, messages and the report buttons, and later saved-search alerts, microchip checks with Central Animal Records, a help chat, text messages and reviews.

Contact

Pet Sales Australia (ABN 43 597 814 497). Email info@petsales.net.au about anything in this policy, or to ask for it in another format.