Privacy Policy

Revision 27 October 2026

Who we are

Bagged Comics ("we", "us") is an online comic store for collectors in Australia, ABN 92 548 131 715. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It covers our website, the pre-launch waitlist, our emails, our Members' Store, and the way we pack, ship and handle returns of your comics.

If you have a question or a complaint about privacy, contact our Privacy Officer at support@baggedcomics.com.au.

What we collect

We only collect what we need to run your membership, take payment, and get your comics to you.

When you join the waitlist

Your email address, when you joined and confirmed it, and your place in the queue.
Who referred you, if you used someone's share link, and who joined with yours.

When you create an account

Your name, email address and, if you give it, your phone number.
Your delivery address (name, street, suburb, state, postcode). We only deliver within Australia.
Your plan (Monthly box or Weekly box), membership status and dates (started, paused, cancelled), your founder place or number if you have one, and any plan special or coupon you signed up with.
That you agreed to our Terms and confirmed you're 18 or over: which version of the Terms, when, the browser you used, and a one-way hash of your IP address (not the address itself).
What you agreed to when you saved your card (the words shown to you, and when).
Your preferences: whether to show mature-reader titles, which emails you get and how often, standard or express postage, and the site's light or dark theme.
If you add a passkey: its name, and the public key your device gives us. Your device keeps the private key; we never see your fingerprint, face or PIN.
To stop the same person using a coupon or plan special twice, we keep a simplified version of your email address (for example, without "+" tags, or dots in a Gmail address).

When you order

The series you subscribe to and the choices you make (covers, copies, annuals, collected editions, relaunches), your pull list, what you skip, and what's been ordered, charged, received, packed and shipped for you.
What you buy in the Members' Store, and whether you chose to ship it now or add it to your box.
Your invoices, adjustment notes, payments, failed payments and retries, store credit, refunds, and any card dispute.
The parcels sent to you: the delivery address used, the number of parcels, their weight, the postage service, and the Australia Post tracking number.
If a comic arrives damaged, faulty or wrong, or we couldn't supply it: the record of that, and the credit or refund we gave you.

When you report a problem with a delivery

The copies you report, your description of the problem, and the photos you upload (of the comic, its packaging, or proof that a copy was destroyed). Please only photograph the item: avoid people, documents or anything else in the frame.
Our decision for each copy, any return label and RMA slip, when we received the return, and how we refunded it.

Card details

Cards are handled by our payment provider, Stripe. Your full card number and security code go straight from your browser to Stripe and never reach our servers.
We keep Stripe's references to you and your card, plus the card brand, last four digits and expiry date, so you can see which card we'll charge.

When you use the site

A session cookie that keeps you signed in, and a record of each signed-in browser (the browser and device description it sends, when it was created and last used), so you can see and sign out of them in Account.
When you ask for a sign-in link, a short-lived cookie in that browser, so the link only signs in the browser that asked for it.
If you browse before signing up and pick a comic or Store item, a cookie that remembers that pick until you finish signing up or signing in.
To stop abuse, we count sign-in, sign-up and waitlist attempts by IP address. We store a salted, one-way hash of the address, never the address itself, and delete old records as new ones arrive.
An audit log of security and money events on your account (sign-ins and failed sign-ins, changes to your email or card, data exports, credits and refunds), with the IP address and browser used.
Our hosting provider keeps short-term server logs that can include IP addresses, for security and troubleshooting.
We don't use advertising cookies, analytics trackers or social media pixels.

Emails we send you

A copy of each email, and whether it was delivered, opened, bounced or marked as spam. Opens are detected by our email provider (Amazon SES) with a small image in the email; if your mail app blocks images, we won't know.
If an email to you bounces or is reported as spam, we stop emailing that address until it's fixed.

When you contact us

Whatever you tell us, and our reply.

You can browse our public pages without giving us any personal information. You can't order without an account, because we need to know who you are, where to send your comics and how to charge you.

How we use it

To run your membership: keep your pull list, place your pre-orders with distributors, receive and prepare your comics, and pack and ship your box and Store orders.
To take payment: charge your saved card for your comics when they lock, Store orders, postage, and your membership fee; retry failed payments; issue store credit, refunds and adjustment notes; and respond to disputes.
To tell you about changes to your prices: when the price of a comic on your pull list goes up before it locks, your membership fee changes, or our spend tiers change so that some orders get less off.
To decide who gets a copy when we're short: see Automated decisions below.
To sort out problems with a delivery: review your report and photos, arrange a return, and refund you.
To keep you informed: sign-in links, order summaries, payment notices, delivery and tracking, returns, and updates about your subscriptions, pull list and our Terms.
To protect you and us: sign-in security, rate limits, fraud prevention (Stripe may run its own fraud checks on payments), and an audit trail of staff actions on accounts and money.
To run the business: tax invoices, bookkeeping, GST and our other legal obligations.
Marketing: we don't send marketing emails at the moment. If you joined the waitlist, we'll email you about our launch, and nothing else. If we start sending marketing, we'll only send it to people who've agreed, and every one will have an unsubscribe link.

We don't sell your personal information, and we don't share it with anyone for their own marketing.

Automated decisions

Some decisions about your account are made by our software, following set rules, without a person deciding each one:

Who misses out when stock is short. If a distributor sends us fewer copies than customers ordered, or copies are damaged, our system decides who gets a copy. Staff accounts miss out first. Among customers, people who've missed out more often in the last six months get theirs first, then whoever missed out most recently, then whoever ordered first. Anyone who misses out is credited what they paid, and can ask for a refund to their card instead. Staff can review and change these decisions.
Releasing unpaid orders. If a payment still hasn't gone through shortly before we must order from the distributor, the order is cancelled and its comics released.
Pausing a membership after unpaid orders. If 2 orders in a row are released unpaid, your membership pauses automatically until you add a working card.
Holding a box. A box doesn't ship while there's money owing or a card dispute is open.
Founder places. A founder place held at signup is released automatically if no first order is paid within the time we told you.
Price rises. If the price of a comic on your pull list goes up shortly before it locks, our system keeps the old price for you.
Fee and discount changes. When we raise a membership fee or cut a spend-tier discount, our system works out when the change reaches you (never sooner than the notice in our Terms) and emails you.
Closing unused accounts. If your membership has been cancelled and there have been no orders, payments or sign-ins for 3 years, your account is de-identified automatically, unless there's money owing, something still to ship, an open return, or store credit that's your money.

Who we share it with

We share personal information only with the businesses that help us run the store, only as much as they need, and under contracts that require them to protect it:

Stripe (payments): your name, email, card details (collected directly by Stripe), and payment and refund amounts. Stripe is based in the United States and processes data in several countries. See Stripe's privacy policy.
Amazon Web Services (database and email): our database runs on AWS servers in Sydney, and our emails are sent through Amazon SES in Sydney. That means your email address and the content of the emails we send you. AWS is a United States company.
Fly.io (website hosting): our website runs on Fly.io's servers in Sydney. Fly.io is a United States company.
Australia Post and other carriers (delivery): your name, delivery address, email address and phone number, so they can deliver your parcel and send you tracking updates. Carriers require these details. We give them to Australia Post through its MyPost Business service, or to another carrier through its own system.
Metron (comic information): when we add back issues to the Store, we look comics up on Metron. We send it barcodes and titles, never anything about you.
Our accountant, bookkeeper and professional advisers, as needed.
Law enforcement, regulators or courts, when the law requires or permits it.
A buyer of our business, if the business is ever sold, under the same protections.

We don't send your personal information to comic distributors: our orders to them list comics and quantities, not customers.

Information sent overseas

Our database, emails and website are hosted in Sydney. Stripe, Amazon Web Services and Fly.io are United States companies, and Stripe may process payment information in the United States and other countries. Where we use a provider overseas, we take reasonable steps to make sure it handles your information in line with the APPs.

How we protect it

You sign in with a single-use link emailed to you, or a passkey. We don't store passwords for customer accounts. A sign-in link only works in the browser that asked for it. Sign-in links and sessions are stored only as one-way hashes.
Changing your email or card, adding a passkey, downloading your data and deleting your account need you to confirm it's you again.
All traffic to the site is encrypted (HTTPS), and the database connection is encrypted.
Staff access is by role: for example, warehouse staff can see the name and address on a parcel but not your email, phone or payment details. Staff sign in with a second factor (a passkey or an authenticator code). Photos you send with a delivery problem can only be seen by you and the staff who handle returns.
Changes to money and to staff access are recorded in a log that can't be edited.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

How long we keep it

Account information: while your account is open. If you cancel your membership but don't delete your account, we keep it so you can rejoin. After 3 years with no orders, payments or sign-ins, we de-identify it, as if you'd deleted it. We don't do this while there's money owing, something still to ship, an open return, or store credit that's your money.
Invoices, payments and other financial records: seven years, as tax and company law require. If you delete your account, they're kept without your name or contact details.
Photos and descriptions from delivery problems: photos and other files you uploaded are deleted 12 months after the case is closed, and photos and descriptions are removed straight away if you delete your account. Our decision and the refund stay with our financial records.
Emails we've sent you: what an email said, and the address we sent it to, are removed 24 months after we sent it. We keep a record that it was sent. Sign-in links are removed from our copy once they're sent.
Unconfirmed waitlist sign-ups: removed after 7 days. Confirmed waitlist entries: removed 6 months after we launch (once the waitlist is closed), or when you delete your account.
Sign-in links: they expire after 15 minutes (an hour for a link that changes your email). Sessions end after 30 days, or 14 days without use. Expired links, sessions and passkey sign-in challenges are deleted 7 days later.
Records of sign-in and sign-up attempts: deleted as new ones arrive, within up to 24 hours.
The audit log: 7 years. If you delete your account, your email addresses and IP addresses are removed from it.

When we no longer need information, we delete it or remove what identifies you. A scheduled job does this every night, using the periods above, and records what it removed (counts only) in our audit log.

Your choices and rights

See and correct your information. Most of it is in Account: your name, email, phone, address, card, plan, passkeys, email preferences and mature-reader setting.
Get a copy. Account → Your data → Download my data gives you a file with your profile, addresses, cards (brand, last four and expiry only), passkey names, signed-in browsers, subscriptions, pull list, orders, invoices, account history, shipments, Store orders, coupons, returns, the Terms you agreed to, and the emails we've sent you. For anything else, contact us. We'll reply within 30 days, and we won't charge you for asking.
Emails. Turn off order summaries, subscription confirmations and pull-list emails in Account → Emails, or get pull-list emails weekly instead. Sign-in, payment, price-rise, fee and discount change, delivery, returns, Terms and membership emails can't be turned off while you have an account, because they're about money we're taking, what we're sending you, or your access.
Delete your account. Account → Delete your account. We'll ask you to wait until any comics you've paid for have shipped, money owing is settled, open returns are resolved, and any store credit that's your money has been refunded (the page offers Refund to my card for that). Promotional credit ends with the account. We then remove your name, email, phone, addresses, saved cards, passkeys, sessions, email contents, return photos and waitlist entry, and Stripe deletes its record of you. We keep financial records without your details, as the law requires. You can sign up again with the same email afterwards.
Signed-in browsers. See them in Account and sign out of any or all.
Anonymity. You can browse without telling us who you are, but we can't take or deliver an order for someone we can't identify.

Children

You must be 18 or over to create an account, and you confirm this when you sign up. Our public pages are open to anyone, but we don't knowingly collect personal information from anyone under 18. If you think someone under 18 has given us their details, contact us and we'll delete them.

Complaints

Contact our Privacy Officer first at support@baggedcomics.com.au. We'll acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992.

Changes to this policy

We'll update this policy when the way we handle information changes. The date at the top shows the latest version. If a change matters to you, for example a new type of information or a new place we send it, we'll email you before it takes effect.