HEAT HITS LIVE railway variable set NEXT_PUBLIC_BUSINESS_ABN=26178572385 (“we”, “us”) runs weekly Pokémon card auctions from Australia. This policy explains what personal information we collect, why, and your rights under the Australian Privacy Principles.
What we collect
- Account details: your full legal name, email, phone number and password (stored only as a one-way hash).
- Shipping address: street address, city, state, postcode and country.
- Auction activity: bids, won auctions, orders and payment status.
- Agreement records: when you accepted our terms and acknowledgements, the version, and your IP address and browser at that time.
- Security data: sign-in sessions, IP addresses and browser details, used to protect accounts and prevent fraud.
- Preferences: your chosen display currency.
Payment cards: card details are collected and stored by our payment provider, Stripe. We never see or store your full card number. We keep only a reference to your saved card, its brand and its last four digits.
How we use it
- To run your account, process bids, charge winning bids with your consent, and ship your cards.
- To send account, auction, payment and shipping emails.
- To prevent fraud, duplicate accounts and abuse, and to keep records required by law.
Who we share it with
Only the service providers needed to run the site, and only what each needs: Stripe (payments, United States and Australia), Resend (sending email, United States), Railway (website hosting and database, Singapore), Cloudflare (card photos, global), and the shipping carrier for your order (name, address and phone, for delivery). These providers may store data outside Australia. We take reasonable steps to make sure they protect it, and we never sell your personal information.
Cookies
We use a strictly necessary sign-in cookie and a cookie that remembers your display currency. We do not use advertising or tracking cookies. We guess your likely currency from your browser's time zone and language settings, not by tracking you. We don't use analytics or advertising services.
Public information
Bid histories show a masked bidder name (for example “a***h7”), the amount and time. Your real name and contact details are never shown publicly.
Your rights
You can view and update your details in My Account, and ask us for a copy of your data, a correction, or deletion (subject to records we must keep for legal and tax reasons). Contact us using the details below. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner.
Security
Passwords are hashed with scrypt, sign-in tokens are stored only as hashes, connections are encrypted, and access to admin tools is restricted and logged.
How long we keep it
We keep order and payment records for 7 years (Australian tax law). Notifications are deleted after 180 days and security logs after they're no longer needed. If you ask us to delete your account, we remove or anonymise everything we aren't required to keep.
Contact
HEAT HITS LIVE railway variable set NEXT_PUBLIC_BUSINESS_ABN=26178572385 · South Australia, Australia. Use our contact form.