Privacy
Last updated 2 August 2026
What we collect
When you place an order we collect the information you give us at checkout: your name, email, shipping address, the design files you upload, and the kit details you choose. Payment is processed by Shopify — we never see your card details. We also collect basic usage information about your visit (pages viewed, browser and country) through Vercel Analytics.
On a club store we also record how the shop itself is used — which pieces were shown, which colours and sizes were picked, and how far an order got before it was finished or left. This is so we can fix the parts that trip people up. It is tied to a random tag that lasts only until you close the tab, never to you: your email address is not part of it, and neither is your name, your address or anything you type. We keep it for up to 90 days and we do not share it.
What we do with it
- Take your payment via Shopify.
- Send your design, name and shipping address to the printer who makes your order, so they can print it and post it to you. Depending on the item, that is either Printful or The Print Bar — both print in Australia. Club store items in a performance range are made by The Print Bar.
- Send you order confirmations, shipping notifications, and replies to your messages via Resend.
- Hold the order record in Supabase so /track works and we can answer support questions.
- Store your design and mockup files with Cloudflare R2 so we can send them to the printer.
- Run this site on Vercel, which hosts it and gives us basic visit statistics.
What we don’t do
- Sell your information to anyone.
- Use your uploaded designs for anything other than fulfilling your order.
- Share your details with anyone beyond the companies that help us run the store — Shopify, Printful, The Print Bar, Resend, Supabase, Cloudflare and Vercel. Each one only sees what it needs to do its job.
How long we keep it
Order records are kept for seven years, because Australian tax law requires it. Design and mockup files are deleted after two years — or sooner if you ask. Emails to us stick around as long as they’re useful for helping you, then go.
Your rights
You can ask for a copy of your data, ask us to delete it, or correct anything wrong at any time — email privacy@dropmerch.shop and we’ll action it within 30 days (usually much sooner). You can also lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
Contact
Cameron — cam@dropmerch.shop