Privacy Policy

Last updated: 14 October 2026

MJ Creations (“we”, “us”) is a wholesale bakery at 31a Old Theatre Lane, Claremont WA 6010. This policy explains what personal information we collect through this website and ordering system, why we collect it, and how we look after it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect

Business details: business name, ABN, delivery address.
Contact details: your name, email address and phone number.
Account details: your login email and a password (stored in scrambled, hashed form — we cannot read it).
Order and billing information: the products you order, delivery dates and notes, invoices and payment status.
Technical information: IP address, browser type and basic server logs, collected for security and troubleshooting.

Why we collect it

To set up and manage your wholesale account.
To take, bake, deliver and invoice your orders.
To send you order confirmations, status updates and invoices by email or in-app notification.
To keep the website secure and prevent misuse.
To meet our legal, tax and record-keeping obligations.

We do not sell your information and we do not use it for third-party advertising.

Who we share it with

We use trusted service providers to run the system. They only receive what they need to do their job:

Supabase — database and login (account and order data).
Vercel — website hosting.
Xero — accounting and invoicing (your business and billing details).
Resend — sending system emails such as order confirmations.

Some of these providers store or process data outside Australia (for example in the United States or other regions). We take reasonable steps to make sure they protect your information appropriately.

How long we keep it

We keep account and order information while your account is active and afterwards for as long as we need it for tax, accounting and legal purposes. When it is no longer needed, we delete or de-identify it.

How we protect it

Access to the system is by login only, customers can only see their own orders and invoices, connections are encrypted (HTTPS), and staff access is restricted by role. No online system is perfectly secure, so please keep your password private and let us know straight away if you think your account has been accessed.

Your rights

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete your account (subject to records we must keep by law). Email us at mjcreations.orders@gmail.com and we will respond within a reasonable time.

Complaints

If you have a concern about how we handled your information, please contact us first so we can fix it. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows the latest version.