Privacy Policy

Last updated: 2 October 2026

The Cinnamon Estate respects your privacy. This policy explains what we collect, why, and the choices you have. We handle personal information in line with the Australian Privacy Principles.

What we collect

Order details. When you check out, we collect your name, email, shipping address and phone number so we can fulfil and send your order.
Payment information. Payments are processed securely by Stripe. We never see or store your full card number; Stripe handles that.
Preferences you share. If you answer our short welcome questions and choose to leave your name and email for a voucher, we save those answers so we can serve you better. If you ask for the voucher by leaving your name and email, those answers come to us so we can send it, whatever you chose on the privacy banner. Otherwise we wait until you accept it.
Messages. If you use the contact form, we keep your name, email and message so we can reply.
Website analytics. Only if you accept the privacy banner, we use Google Analytics to understand how the site is used (pages viewed, general location, device). If you decline, no analytics are loaded.
Review invitations. After you place an order, Google asks whether you would like to be emailed once, after your parcel has had time to reach you, to rate your experience of buying from us. You make that choice on the thank you page and it is entirely yours. In order to ask you, Google is given your email address, a reference for your order, your delivery country and roughly when your parcel should arrive, so the question is not asked before it has. If you say no, it does not send the email.
On your device. Your browser keeps a small amount of information so the shop works, and it comes in three kinds. The first is what you have chosen, such as what is in your basket, the country you picked for delivery, any discount code you are holding, your answers to the welcome questions and your privacy choice. The second is a record of what the site has already shown you or already done, so it does not repeat itself. That record begins the first time you load a page, before you have answered anything, and it includes the moment your visit started. The third is two random identifiers. One is made the first time you open the prize game or start a checkout. The other is made the first time you send us your welcome answers. Both stay in your browser until you clear it, and both identify a browser rather than a person. Some of this reaches us and the rest stays where it is. Your basket, the country you chose and any discount code come to us when you order, so it can be priced and placed. The prize game identifier comes to us as you browse, which is explained under Your consent below. If you send us your welcome answers, they come to us with the second identifier, the page you arrived from and your browser type. When you press Checkout your browser also keeps a copy of what you are buying, and if you accepted the privacy banner that copy is sent to Google Analytics once your payment goes through. Once you have paid it keeps a reference to that checkout, which comes to us so the thank you page can show you your own order, and a copy of the basket it has just emptied, so it can put your basket back if the checkout turns out not to have completed. Accepting the privacy banner also sends what you do on the site to Google Analytics, as described above. The "Reset my preferences" link in the footer clears your preferences and, when we are asking the welcome questions, brings them back. It does not clear the rest, so to remove everything, clear this site's data in your browser.

How we use it

To take and fulfil your orders, to reply to you, to send your welcome voucher if you asked for it, and to improve the website. We do not sell your personal information to anyone.

Your consent

Analytics only run after you accept the privacy banner. If you decline, no analytics are loaded, and you can still browse and shop normally. Your preferences work the same way, with one exception. If you ask for the welcome voucher by leaving your name and email, your answers come to us so we can send you the code, whatever you chose on the banner, because asking for the voucher is you asking us to send you something. That does not load analytics.

Payment and the rating question sit outside that banner because they are part of buying rather than browsing. Your payment is handled by Stripe. And after you place an order, Google asks whether you would like to rate us, as described above. Neither of those happens unless you buy something.

The prize game identifier sits outside the banner too, whatever you choose on it. The first time you open the prize game or start a checkout, your browser is given a random identifier, and from then on it is sent to us as you browse, so we know whether you still have a turn left today. Our own server uses it for two things, keeping the prize game to one play a day, and telling your own repeat attempt at checkout apart from someone else trying to spend your discount code. It goes to us and to nobody else, it identifies a browser rather than a person, and clearing your browser data removes it.

Who we share it with

We use a small number of trusted services to run the shop, and only share what each needs to do its job:

Stripe processes payments.
Resend sends our order emails. It receives your name, email address and delivery address, the items you ordered with their prices, the postage, any discount and the total, the date we post your order, and the tracking link if there is one.
Google provides our analytics, stores preference and contact submissions in a private spreadsheet, and asks you for a rating after an order as described above.
Cloudflare hosts and delivers the website.
Etsy, if you choose to buy there, under Etsy's own privacy policy.

Cookies and analytics

We do not use advertising cookies. Google Analytics sets its own cookies only after you accept the banner, to measure site usage. You can decline, or clear cookies in your browser at any time.

Keeping your information

We keep personal information only as long as we need it to run the business and meet our legal obligations, then remove it. We take reasonable steps to protect it from misuse and loss.

Your rights

You can ask us to access, correct or delete the personal information we hold about you. Email info@thecinnamonestate.com and we will help.

Children

Our shop is intended for adults. We do not knowingly collect information from children.

Changes

We may update this policy from time to time. The date at the top shows when it last changed.

Contact

Privacy questions or requests: info@thecinnamonestate.com.