Privacy Policy
Last updated 23 October 2026
This policy explains how Teals (Whitestone Capital Holdings Pty Ltd, ABN 37 643 764 096) handles your personal information, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
What we collect
We collect your email, account name, bids and private maximum bids, watchlist, purchases, notification choices and support correspondence. We record sign-in and terms-acceptance evidence, including the version accepted, time and network information. Bidding and security records can include your IP address and browser or device information (user agent). If you verify a mobile number for bidding, Twilio receives the number and sends and checks the verification code. We keep verification status, a keyed number digest, the last four digits and request evidence. If you choose text notifications, we also hold the verified number and your separate text preferences, consent and STOP records. Saving a card uses Stripe-hosted fields: Stripe receives and stores your card details; we keep provider references, card brand and last four digits, and the consent version, time and network evidence. At checkout, Shopify collects the name, billing and delivery addresses and payment information needed to complete your order. We receive order, payment-status and fulfilment information; we do not store full card numbers.
Google and Apple sign-in
Where offered, Google and Apple sign-in share a provider account identifier, your email address if available, and verification information with Teals. We use these to sign you in and connect that method to your account. We do not receive your provider password. Google sign-in requests identity and email access only, with no access to Gmail, Drive or other content. The verified address used for your Teals account is handled under the account, communication and advertising practices described in this policy. We retain the connected provider identifier and the address observed when it was linked. Apple credentials needed to revoke a connection are encrypted and kept until revocation is confirmed, including when account closure is pending. You can disconnect a method in Account. If your account uses an Apple private email address, connect another available sign-in method before disconnecting your last method. Your provider's own account settings are separate. If Apple hides your email, you can use that private address for your Teals account and invoices. Apple forwards those messages to your inbox while forwarding is enabled. We record that the contact is private so recovery safeguards still work if the Apple connection is removed.
How we use it
We use this information to operate bidding and automatic maximum bids, secure accounts, prevent misuse, record binding bids, reconcile payments, send invoices and reminders, arrange delivery and answer enquiries. We also measure site performance and how visitors find and return to auctions. Marketing email requires your opt-in and includes an unsubscribe link. Optional email, browser push and auction text alerts have separate account controls. Required payment reminders are separate from marketing choices. We use your verified mobile for factual unpaid-invoice reminders where a reachable destination is available. Replying STOP blocks SMS delivery, including payment texts; required payment information continues by email and in My Wins. Verifying a phone alone is not permission to send optional texts. Payment enforcement may restrict bidding when an invoice remains unpaid under the applicable sale terms. Contact us if a payment or restriction appears incorrect.
Who we share it with
Our providers include Shopify for checkout and orders, Stripe for saved cards and any authorised payment or refund using them, Twilio for phone verification and text delivery, Vercel and Railway for hosting, Ably for live updates, Resend for email delivery, Google Gmail for incoming support, Sentry for error monitoring, and storage providers for backups. Australia Post receives recipient and shipment details to deliver purchases. When Meta advertising measurement is active, browser and server signals can share page and conversion activity, item identifiers and values, advertising click identifiers, hashed email and account identifiers, and the browser's IP address and user agent. Twilio receives your verified number and the text content needed for the service, such as a verification code or chosen auction notification. Stripe receives account identifiers and the information needed to store a card or process an authorised payment or refund. Our servers do not receive the full card number or security code from the hosted card form. IP addresses, user agents and click identifiers are not hashed in Meta signals; hashing other identifiers does not make them anonymous. We do not sell your personal information.
Customer journey diagnostics
We collect first-party diagnostics for page visits, the buttons used to browse, bid, sign in, share and practise, bid-request outcomes, account setup steps, how far down a page you scroll, which lots appear on your screen, and how many times our sign-up and contact forms are shown. These include a short-lived browser session identifier, a signed-in account reference where available, the page path without any query, the first page of a visit, the campaign tags in the link that brought you (source, medium, campaign and content), the host name of the referring site, coarse device and browser categories, the operating system and its major version, whether the page opened inside a social app's browser and which app, your screen width and height, the connection type your browser reports, whether the site was opened from your home screen, which page layout you were shown, response timings and fixed error categories. Our page-speed measurements carry the same operating system, social app and page layout categories. We do not include form contents, search text, full URLs, private maximum bids or card details. These diagnostics are separate from advertising measurement and are not sent to advertising providers. Browser session identifiers expire after 30 minutes of inactivity. Diagnostic activity records are removed after 30 days by our scheduled cleanup. Where enabled, internal daily and signup-cohort reports retain aggregate counts for up to 13 calendar months, with small joint groups withheld. These reports do not retain the diagnostic session or account identifiers.
Google and TikTok conversion measurement
When enabled, our server can send Google or TikTok that provider's advertising click identifier, the time of a confirmed account registration or first accepted public-auction bid, and a purpose-specific event identifier to avoid counting it twice. This limited feed does not send your name, email, phone number, card details, private maximum bid or bid amount. Click and event identifiers are not anonymous. This measurement helps us understand whether advertising brings people who register and participate; clicks alone do not show that. These providers may process this information outside Australia. Contact us if you want to ask about, access or object to our use of your information. These advertising measurements are separate from your email and text-message preferences.
Where your data is held
Some of our providers, including our auction system's hosting and our advertising tools, store or process data on servers outside Australia (currently including Singapore for our auction platform, Japan for our email service, and the United States for advertising and error-monitoring tools; Stripe and Twilio also use international processing infrastructure) - this includes the Meta advertising signals described above. Where that happens we take reasonable steps, consistent with the Australian Privacy Principles, to ensure your information is handled to a comparable standard, including contractual protections and data minimisation. We never store full card numbers - those are held by the payment provider.
Cookies and advertising
Essential cookies support sign-in and security. Your browser also stores local preferences. A first-visit attribution cookie lasts up to 30 days and can contain campaign and advertising click identifiers; when an account is created, attribution may be saved with that account. Where enabled, a separate 30-day first-visit context cookie records only a coarse browser or social-app category and a timestamp. That context may also be saved at verified sign-in. The context cookie contains no account identifier, email, full browser user agent or full URL. While we compare a new phone layout with the current one, a cookie named teals_mv2 holds a random identifier for up to 30 days so this browser sees the same layout on each visit, and a cookie named teals_view remembers for up to 30 days a layout you choose yourself. Neither contains your name, email or account. We measure returns from tagged emails and SMS messages, including later bidding by a signed-in account. Meta's pixel may use advertising cookies when active. Your Meta ad settings and browser or device controls offer advertising choices, and you can contact us about our use of your information. Email unsubscribe does not itself disable browser cookies or push notifications.
Retention and deletion
Our activity-log cleanup removes IP addresses after 90 days and ordinary activity records after approximately 13 months. Email and SMS return measurement records are retained for 30 days. These limits apply to those specific logs, not to every account, bid or purchase record. We retain account and auction evidence, including records of verified customer account links, consent, payment, tax, delivery and dispute records for the purposes and obligations they support. Account deletion removes or anonymises account contact details and disables optional contact channels, but does not erase the financial history of completed sales. Unpaid obligations or an active suspension can require a manual review before account deletion. Provider-held records and backups are separate copies and are not instantly erased by deleting an account; contact us so we can assess any further deletion or correction request.
Your rights
You can manage account information and preferences in your account, or contact us to request access, correction or deletion. We may verify your identity before disclosing or changing records. For a privacy complaint, email us with the issue and the outcome you seek. We will review it and respond, explaining any information we must retain or any further steps needed. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).
Questions about your privacy? Email auctions@teals.net.au.