Privacy Policy

1. Overview

ImportHQ is operated by Sweet and Salty Brands Pty Ltd (ABN 85 689 037 205) trading as ImportHQ ("ImportHQ", "we", "us", "our"). We are committed to protecting your personal information and handling it in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, where applicable, the EU and UK General Data Protection Regulation (GDPR).

This policy explains what information we collect, how we use and store it, who we share it with, and your rights. It applies to the ImportHQ website and web application at importhq.net.

2. Information we collect

Account information. When you create an account we collect your name, email address, and business name (if provided). Authentication is handled by Supabase Auth using an email address and password; your password is stored in hashed form and we cannot see it. We do not currently offer third-party (social) sign-in.

Business data. When you use the purchase order and production tracking features, we store the information you enter, including purchase orders, product and pricing details, supplier names and contact details, production milestones and dates, shipping information, and any documents or files you upload. Uploaded files are stored in Supabase Storage. We also store your tracker display preferences, such as custom column and milestone labels, against your account. This data is stored on our servers so it is available to you across sessions and devices.

If you enter personal information about other people (for example a supplier’s contact name, email, or phone number), you are responsible for ensuring you are permitted to provide it to us. We process that information only to provide the Service to you.

Saved calculations. Calculations you save from the planning tools (landed cost, margin, cash flow, reorder point, CBM, and freight tools) are stored on our servers against your account, so they are available to you across sessions and devices. They are included in your data export and are deleted with your account.

Payment information. Payments are processed by Stripe. Stripe collects your card details, billing name, and billing address directly; we do not receive or store full card numbers. We receive and store a Stripe customer reference, your subscription status, billing history, and the last four digits and expiry of your card so you can identify it in your account settings.

Usage and technical data. We collect information about how you use the Service, including pages and tools used, actions taken, approximate location derived from IP address, browser type and version, device type, operating system, referring URLs, and timestamps. Some of this is collected through analytics tools (see section 7) and server logs.

Support and communications. If you contact us, we keep a record of the correspondence and any information you provide.

3. How we use your information

We use your information to: create and manage your account and authenticate you; provide, operate, and maintain the Service, including storing and displaying your business data; process subscriptions, payments, and billing; send you service-related communications such as account confirmations, password resets, billing receipts, security notices, and material changes to our terms; respond to support requests; monitor, analyse, and improve the Service, including understanding which features are used and diagnosing errors; detect, prevent, and respond to fraud, abuse, and security incidents; and comply with our legal obligations.

We may send you occasional product updates or announcements by email. You can opt out of these at any time using the unsubscribe link or by contacting us; you will still receive essential service and billing communications while you have an account.

We do not sell or rent your personal information, and we do not share it with third parties for their own marketing purposes.

Where GDPR applies, our legal bases are: performance of our contract with you (providing the Service and processing payments); our legitimate interests (improving and securing the Service, and communicating with you about it); compliance with legal obligations; and your consent, where we ask for it (for example, non-essential cookies).

4. Data storage and security

Your data is stored using Supabase (database, authentication, and file storage) and served through Vercel. Data is encrypted in transit using TLS and encrypted at rest by our infrastructure providers. Access to your business data is restricted to your own account through database-level access controls. We limit staff access to personal information to what is necessary to operate and support the Service.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.

If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) and any other regulator as required by law, and take steps to contain and remediate the breach.

5. Where your data is stored and overseas disclosure

Our infrastructure providers (Supabase, Vercel, and Stripe) operate data centres and support operations in a number of countries, which may include the United States, Singapore, the European Union, and other locations outside Australia. By using the Service, you acknowledge that your personal information may be stored and processed outside Australia. We take reasonable steps to ensure our providers protect your information to standards comparable to those required in Australia, including through their contractual commitments and security certifications.

6. Cookies

We use cookies and similar technologies (including local storage) for essential purposes, such as keeping you signed in, maintaining your session, and remembering your preferences. Our analytics provider (see section 7) is cookieless and does not use cookies or track you across other websites.

You can disable or clear cookies in your browser settings, but the Service will not function correctly without essential cookies. Where required by law, we will ask for your consent before setting any non-essential cookies.

7. Third-party services

We use the following providers, which process your data on our behalf under their own privacy policies:

Supabase (database, authentication, and file storage) stores your account and business data, and sends authentication emails such as sign-up confirmations and password resets. Privacy policy: supabase.com/privacy

Stripe (payment processing) handles card details and billing, and sends billing receipts. Privacy policy: stripe.com/privacy

Vercel (hosting, edge network, and Vercel Analytics) serves the Service to your browser and processes request logs including IP addresses. Vercel Analytics collects aggregated usage data such as pages visited, tools used, referrer, and device and browser type. It is cookieless, does not use cross-site tracking, and does not store data that identifies you personally. Privacy policy: vercel.com/legal/privacy-policy

Exchange rate data provider supplies live currency rates. No personal data is sent to this provider.

Resend (transactional email delivery) sends service emails we generate ourselves, such as notice that an inactive free account is due to be deleted. It processes your email address and the contents of that email for delivery. Privacy policy: resend.com/legal/privacy-policy

We do not use a bulk email or marketing platform. Every email you receive from us is transactional.

8. Data retention

We retain your account and business data for as long as your account is active. If you close your account, or ask us to delete it, we will delete or anonymise your personal information and business data within 30 days, except that: copies may remain in our provider’s encrypted daily backups for up to 7 days before being overwritten; billing and transaction records may be retained for up to 7 years to meet Australian tax and accounting obligations; and we may retain information where required by law or to resolve disputes or enforce our terms.

Free-plan accounts that have been inactive for more than 12 months may be deleted after we notify you by email and give you at least 30 days to sign in.

9. Your rights

You may access and update your account information at any time in your account settings. You may also request that we: provide a copy of the personal information we hold about you; correct inaccurate or incomplete information; delete your account and associated data; restrict or object to certain processing; or provide your data in a portable format. To make a request, email support@importhq.net. We will respond within 30 days and may need to verify your identity first.

If you are in the EEA or UK, you additionally have the right to withdraw consent where processing is based on consent, and to lodge a complaint with your local data protection supervisory authority.

Complaints. If you have a concern about how we have handled your personal information, please contact us first at support@importhq.net and we will investigate and respond. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Children’s privacy

The Service is intended for business use by people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version on our website with a new "last updated" date and, for significant changes, notify you by email or by a notice within the Service. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact

Privacy questions or requests: support@importhq.net

Sweet and Salty Brands Pty Ltd (ABN 85 689 037 205) trading as ImportHQ, New South Wales, Australia. Our full registered address is available on request by emailing support@importhq.net.