Legal

Privacy Policy

Last updated: May 2026

FashCrave is a product of sortYa Pty Ltd (ABN 32 291 148 458), an Australian company. We are the data controller for personal information collected through this platform. This privacy policy explains how we collect, use, and protect your personal information when you use FashCrave at fashcrave.sortya.com.au.

We've written this in plain language because you deserve to understand it.

Applicable law

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). In addition, we have designed FashCrave to align with the European Union's General Data Protection Regulation (GDPR) as a standard of best practice — even where not strictly required — because we believe you deserve strong privacy protections regardless of where you are.

Lawful basis for processing

Under GDPR, every use of your personal data requires a legal basis. Here is the basis we rely on for each type of processing:

• Account & login — Contractual necessity. Your email address and session data are required to operate your account and keep you logged in.
• Price & stock tracking — Contractual necessity. The product URLs, sizes, colours, and price targets you track are the core of the service we provide.
• Email alerts — Consent. You choose which items to track and can stop alerts at any time by removing the item or deleting your account.
• Service notifications — Legitimate interest. We may email you about major changes to FashCrave that affect your account (e.g. policy changes, scheduled maintenance).
• Analytics — Legitimate interest. We use anonymised, aggregated data via Google Analytics to understand how the platform is used and to improve it.

What information we collect

We collect the following information when you use FashCrave:

• Your email address when you create an account or join the waitlist
• The product URLs, sizes, colours, and price targets you choose to track
• Usage data such as which items you add, refresh, or delete
• Technical data including your browser type, device, and IP address (via Google Analytics)

We collect product data (prices, stock status, images, descriptions) directly from retailer websites in order to provide the tracking service. This is publicly available information and does not contain your personal data.

How we use your information

• To send you email alerts when a tracked item changes in price or stock status
• To operate and improve the FashCrave platform
• To respond to your enquiries
• To understand how users interact with the platform (via Google Analytics)
• To notify you about major changes to the service

Your data is never sold to third parties. It is never shared with retailers — they do not know who is tracking their products.

Affiliate links and commissions

In the future, when you click a "go to retailer" link from FashCrave and subsequently make a purchase, we may receive a small commission from that retailer through an affiliate network. This does not affect the price you pay — the cost to you is identical to purchasing directly from the retailer's website.

We only link to retailers whose products we actively monitor. We do not receive payment to feature specific products or promote specific items.

Cookies and analytics

We use essential cookies to keep you logged in and maintain your session while you use the platform. These are strictly necessary for the service to function.

We also use Google Analytics to understand how visitors use FashCrave. Google Analytics uses cookies to collect data about your visit, including pages viewed, time spent, browser type, and approximate location. This data is aggregated and used to improve the platform. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on.

We do not use advertising cookies, social media tracking pixels, or any third-party cookies that follow you across other websites beyond what is described above.

Data sharing and third-party providers

We do not sell, rent, or trade your personal information. We use the following third-party providers to operate the platform, each processing data solely on our behalf and under our instructions:

• Amazon Web Services (AWS) — File storage (S3, Sydney region). Stores account data and tracked item information.
• DigitalOcean — Application hosting and database (Australia). Hosts the platform and stores structured data.
• Google Analytics — Anonymised usage analytics. Receives aggregated browsing data to help us understand how the platform is used.
• Web3Forms — Contact and waitlist form submissions. Receives your name and email only when you submit a form.

We maintain appropriate agreements with each provider. If we add new providers in the future, this list will be updated.

Data storage and security

Your primary data — account details and tracked items — is stored securely in Australia (AWS Sydney and DigitalOcean Australia). We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, including encryption in transit (TLS/HTTPS) and access controls on all systems.

We do not store payment information — any future paid subscriptions will be handled by a third-party payment provider, and we will update this policy accordingly before that happens.

International data transfers

When you use FashCrave, some data is transmitted to services operated outside Australia. Specifically, Google Analytics processes anonymised usage data on Google's servers, which may be located in the United States or other jurisdictions.

These transfers are protected by Standard Contractual Clauses (SCCs) as recognised under GDPR, and by each provider's data protection commitments. Data is transmitted in encrypted form (TLS) at all times.

Your rights

You have the following rights over your personal data. You can exercise most of these directly from your account, or by emailing us. We will respond to any request within 30 days.

• Access — View the personal information we hold about you. You can request a full copy by emailing us.
• Rectification — Request correction of inaccurate information at any time.
• Erasure — Request deletion of your account and all associated data. Personal data is removed within 24 hours of your request.
• Restrict processing — Ask us to pause processing your data while keeping your account intact (for example, if you dispute accuracy or have objected to processing).
• Object — You have the right to object to any processing based on legitimate interest (such as analytics or service notifications). If you object, we will stop processing unless we can demonstrate compelling grounds that override your interests.
• Portability — Request a machine-readable export of your tracked items and account data.
• Withdraw consent — Where we rely on consent (such as email alerts), you can withdraw it at any time by removing tracked items or deleting your account. Withdrawal does not affect the lawfulness of any processing carried out before that point.
• Opt out of marketing — Unsubscribe from any marketing communications at any time via the link in the email or by contacting us.

To exercise any of these rights, contact us at fashcrave@sortya.com.au.

Data retention

Active accounts and tracked items are retained for as long as your account exists. If your account has had no activity for 12 months, we will send you an email reminder. If we receive no response within 30 days, your account and all associated data will be permanently deleted.

On deletion — whether initiated by you or through inactivity — your personal data is permanently removed within 24 hours. An anonymised record containing only your account creation date and deletion date may be retained for platform analytics. This record contains no personally identifiable information.

Data breach notification

In the unlikely event of a data breach that affects your personal information, we will notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme. If the breach is likely to result in serious harm to you, we will notify you directly as soon as practicable — and no later than 72 hours after becoming aware of the breach — with details of what happened, what data was affected, and what steps you should take.

Children

FashCrave is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from someone under 16, we will delete it promptly.

Changes to this policy

We may update this policy from time to time. If we make material changes that affect how your data is used, we will notify registered users by email before the changes take effect. The "last updated" date at the top of this page always reflects the most recent version.

Complaints

If you believe we have not handled your personal information properly, please contact us first — we want to make it right. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au/privacy/privacy-complaints or by phone on 1300 363 992.

Contact

For any privacy-related questions or concerns, please contact us at fashcrave@sortya.com.au.