Yumori Privacy Policy

Effective date: 9 November 2026
Last updated: 9 November 2026 · Version 5.1

Your privacy matters to us. This policy explains what personal information Yumori collects, why we use it, who receives it and how you can make choices about it.

Contents

• 1. Who we are
• 2. What this policy covers
• 3. Information we collect
• 4. How we use information
• 5. Launch emails
• 6. Sharing information
• 7. Overseas processing
• 8. Security and retention
• 9. Your requests and complaints
• 10. Visitors outside Australia
• 11. Changes to this policy

1. Who we are

Stephen O’Brien trading as Yumori, ABN 14 253 364 243, operates in Queensland, Australia. “We”, “us” and “our” mean that business.

Contact us about privacy at info@yumori.com.au. Please put “Privacy” in the subject line.

Our postal address is:
PO Box 3689
ROBINA TOWN CENTRE QLD 4230

2. What this policy covers

This policy covers our launch website at yumori.com.au, launch-list emails, enquiries and associated services described below. We initially market to people in Australia.

The teaser website does not currently take orders or payments. Before opening our online shop, we will update this policy to explain ordering, payments, delivery, returns and additional providers.

Our website and marketing are intended for adults. We do not deliberately seek personal information from children. Contact us if you believe a child has provided information so we can assess it and arrange appropriate removal.

3. Information we collect

We collect information directly when you complete a form or contact us. Our service providers also process information generated by your interactions.

• Launch-list information: your email address, signup source, consent and confirmation records, subscription preferences and unsubscribe requests.
• Enquiries: your name, email address and information you include in messages or attachments, together with our replies.
• Website and security information: information such as IP address, browser and device details, requested pages, timestamps, errors and security events processed by our hosting services.
• Signup protection: coded identifiers derived from your email and network address, together with request status and timestamps, used to limit repeated submissions and investigate uncertain signup attempts. Our signup-control tables do not store readable email addresses or raw IP addresses. The coded identifiers can still be linked to a person using separately held information.
• Email activity: delivery, bounce and unsubscribe information. Where tracking is enabled, this can include opens, link clicks and associated technical information.

You can browse without joining our launch list. Providing your email and agreeing to launch emails is optional, but we cannot send launch-list messages without them. To answer an enquiry, we need enough information to understand it and contact you.

Please do not send passwords, payment-card details, identity documents or health information through our signup form or general support channels. We do not ask for sensitive information to join the list. If we receive information we do not need, we assess whether we can lawfully retain it and otherwise delete or de-identify it where lawful and reasonable.

4. How we use information

We use information to:

• process and confirm signups and send the Yumori launch news requested;
• respond to enquiries, preferences, privacy requests and complaints;
• deliver, maintain and secure our website and email services, limit repeated signups and investigate uncertain requests;
• understand email delivery and engagement using the email activity information described above; and
• meet legal obligations and establish, exercise or defend legal claims.

Reading this policy or browsing our website is not consent to every use described here. Before introducing a materially different use, we will assess whether it is permitted, explain it and seek consent where required.

5. Launch emails

Our signup form asks for your agreement to receive Yumori launch news by email. A confirmation email checks that you control the address before we add it to the subscribed launch list.

Marketing emails identify us and include an unsubscribe option. You can also email info@yumori.com.au to stop marketing. We will action the request within five working days, without a fee or requiring an account.

Unsubscribing stops marketing emails. We may still answer an enquiry you initiate or send a communication legally required. We keep a limited suppression record where needed to prevent further marketing to an unsubscribed address.

If you have unsubscribed, signing up again through our website form will not resubscribe you. The form shows the same message whether or not an address is already on our list, so it does not reveal who has joined. To rejoin, email info@yumori.com.au.

Your agreement to receive launch emails does not give blanket permission for other uses of your information. We will explain new uses and seek additional consent where required.

6. Sharing information

Recipients of information needed for the purposes in this policy include:

• Klaviyo, for subscriptions, consent records and email delivery;
• Vercel, for website hosting and the server connection processing signups;
• Supabase, for the coded identifiers and request records used to protect the signup form;
• Google Workspace, for business email and enquiries;
• authorised people assisting with business operations, technical support or professional advice, where access is necessary; and
• regulators, courts or other parties where disclosure is required or authorised by law.

We seek to limit access and disclosures to what is needed. Providers may engage their own service providers.

We do not sell our launch-list database for payment.

7. Overseas processing

Providers may store or process information, or provide support, outside Australia. The United States is a likely processing location for our current services. Klaviyo, which manages our launch list, and the Vercel server that processes signups both operate in the United States. Other locations depend on the service and its subcontractors.

Our Supabase signup-control database is hosted in Sydney, Australia. This does not mean all related processing stays in Australia: website and email processing, provider support and other service operations may involve overseas locations as described above.

Where applicable law requires safeguards for overseas disclosures or transfers, we take the required steps, including reviewing provider arrangements and using appropriate contractual protections. This policy does not ask you to waive protections or release us from responsibility for overseas handling.

8. Security and retention

We take reasonable steps to protect information against misuse, interference, loss and unauthorised access, modification or disclosure. These include appropriate access restrictions and security arrangements for the services we use. No online service can guarantee absolute security.

We retain information for as long as reasonably needed for its purpose and applicable legal, recordkeeping or dispute-resolution requirements:

• subscription information while needed to manage the list and your choices;
• limited consent and suppression records to demonstrate permission and honour withdrawals;
• enquiries while needed to resolve them and manage reasonably related follow-up or disputes; and
• technical and email activity records according to their purpose and the retention arrangements of the services we use.

Our signup controls are set to delete rate-limit records once they are more than one hour old, and resolved request records once they are more than 30 days old. Deletion happens whenever the form is used and in a daily scheduled cleanup. When the daily cleanup runs as scheduled, records are removed within about 25 hours and 31 days respectively. If a scheduled cleanup does not run, the records are removed at the next cleanup or the next time the form is used. Requests with an uncertain outcome are retained for investigation and reviewed for removal once resolved. Provider logs and backups have separate retention arrangements.

We review retained information and delete or de-identify it when no longer needed, unless law requires retention. Backup copies may remain until the applicable backup cycle expires and are protected from ordinary use.

If a data breach occurs, we will take steps to contain it, assess the consequences and notify affected people and regulators where the law requires.

9. Your requests and complaints

Email info@yumori.com.au, or write to our postal address in section 1, to request access, correct information, withdraw marketing consent or ask us to delete information you believe we no longer need. We may need proportionate information to verify identity and protect another person’s privacy.

We assess requests under applicable law and retention obligations. Some information may need to remain, including a limited unsubscribe record. If we cannot fulfil a request, we will explain why, where permitted, and how to raise a concern. Making a request is free. If a lawful access charge is proposed, we will explain it beforehand. Corrections are free.

For a complaint, tell us what happened and the outcome you seek. We aim to respond within 30 days, or sooner where law requires. If more investigation is needed, we will explain why and the expected timing without extending a mandatory deadline.

Where the complaint falls within its jurisdiction, contact the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints or 1300 363 992. Another regulator may be appropriate where another privacy law applies.

10. Visitors outside Australia

Our initial service is directed to Australia. Being able to access our website elsewhere does not, by itself, determine which privacy laws apply.

If an overseas privacy law applies to our handling of your information, we will honour its rights and obligations. Depending on the law, you may have additional rights to deletion, restriction, portability, objection, withdrawal of consent or a complaint to your local regulator. Contact us using the details above.

Before targeting another market or introducing tracking or processing that brings an overseas law into scope, we will assess the requirements and provide additional notices, legal grounds, safeguards and choices as required. This section does not limit rights you already have under applicable law.

11. Changes to this policy

We review this policy whenever we add or change technology or a service that affects personal information. We update the policy and any relevant collection notices before the new or changed handling begins. We will publish updates with a revised effective date and provide additional notice of material changes where appropriate or required. Updating the policy does not replace a requirement to obtain fresh consent for a new use.