Privacy Policy

Last updated: 16 April 2026.

This Privacy Policy explains how Mr Tayne Rongo trading as Seaqae Group (ABN 40 300 987 116), operator of Cold Case Club ("we", "us"), collects, uses, stores, and shares your personal information. We comply with the Australian Privacy Principles (Privacy Act 1988), the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and Canada's PIPEDA where they apply.

1. Information We Collect

1.1 You give us directly

• Name and email address (subscription, newsletter, contact).
• Mailing address (required to ship evidence packets).
• Payment details — processed and stored by Stripe, not us. We receive only a transaction ID, last 4 digits of card, and country.

1.2 Automatically collected

• IP address (used for rate-limiting and security).
• Browser type, device, and referring URL (analytics).
• Pages visited on our site and interaction events (Vercel Analytics and Microsoft Clarity when enabled).

1.3 From third parties

• Stripe (payment status, dispute notifications).
• Meta, TikTok, Reddit, or Google advertising platforms when you arrive via our ads and have consented to tracking on their platform.

2. Cookies and Similar Technologies

We use a small number of cookies. Non-essential cookies (analytics, advertising) only run when you consent via the cookie banner. Your choice is stored in a first-party cookie you can clear at any time.

Cookie	Purpose	Category	Expires
ccc_boot_seen	Skips our boot intro for return visitors.	Essential	24 h
ccc_sound_on	Remembers your audio preference.	Essential	30 days
ccc_cookie_consent	Stores your cookie-banner choice.	Essential	12 months
_vercel_insights	Anonymised traffic measurement.	Analytics	24 h
_ga / _ga_*	Google Analytics session + user.	Analytics	2 years
_fbp	Meta Pixel visitor attribution (ads only).	Advertising	90 days

3. How We Use Your Information

• Fulfil your order (ship packets, process payment, send confirmations).
• Provide customer support.
• Send transactional emails (order receipts, shipping updates, password reset).
• Send marketing emails only with your consent; every one carries an unsubscribe link.
• Improve the Service (aggregate analytics, never personal tracking).
• Prevent fraud and abuse.
• Comply with legal obligations (tax, consumer protection, court orders).

4. Who We Share With

We share only when strictly required for the Service:

• Stripe — payment processing.
• Resend — transactional + newsletter email delivery.
• Vercel — hosting, CDN, analytics.
• Upstash / Vercel KV — storing order and subscriber records.
• Australia Post / national postal services — packet delivery (name + address).
• Analytics platforms (Google, Microsoft Clarity, Meta, TikTok, Reddit) — only where you consent.

We never sell your personal information. We never share it for cross-context behavioural advertising outside what our cookie banner discloses.

5. International Data Transfers

Our hosting and email providers are based in the United States. By using the Service you consent to your personal information being transferred there. Stripe and our other processors use EU Standard Contractual Clauses and the UK International Data Transfer Addendum for compliant transfers.

6. Data Retention

• Order records: 7 years (tax and consumer-protection compliance).
• Newsletter subscribers: until you unsubscribe.
• Customer-support emails: 3 years.
• Analytics: aggregated, 26 months.
• Cookies: per the table in section 2.

7. Your Rights

7.1 Australian Privacy Principles (APP)

You may request access to, or correction of, personal information we hold about you. Contact us at hello@coldcaseclub.store. If you believe we have breached an APP, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

7.2 EU / UK GDPR

You have the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing, and withdrawal of consent at any time. Requests go to hello@coldcaseclub.store and we respond within 30 days. For UK residents, you can complain to the ICO at ico.org.uk; EU residents may complain to their local supervisory authority.

7.3 California (CCPA/CPRA)

California residents may request: (a) the categories and specific pieces of personal information we've collected, (b) deletion, (c) correction of inaccurate data, and (d) opt-out of sale or sharing for cross-context behavioural advertising. Exercise these rights via the "Do Not Sell or Share My Personal Information" link in our cookie banner, or by emailing us. We do not discriminate against Californians who exercise their rights.

7.4 Canada (PIPEDA)

Canadian residents may request access to and correction of personal information we hold. Contact us; we respond within 30 days. Complaints to the Office of the Privacy Commissioner at priv.gc.ca.

8. Data Security

Payment card data never touches our servers. All traffic to our website is TLS-encrypted. Webhook events are HMAC-verified. We limit access to subscriber data to administrators. If a data breach occurs that poses a risk of serious harm, we will notify affected individuals and the appropriate regulator (OAIC, ICO, or other) within the time required by law.

9. Children

The Service is not directed at children under 16. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us personal information, email us and we will delete it.

10. Automated Decision-Making

We do not use your personal information for automated decisions that produce legal or similarly significant effects. Rate-limiting and fraud checks are purely operational.

11. Changes to This Policy

We'll post revisions here with a new "Last updated" date and — for material changes — email active subscribers at least 14 days before the new version takes effect.

12. Data Requests and Contact

For any access, correction, deletion, portability, opt-out, or general privacy request, contact:

Privacy Officer
Mr Tayne Rongo, trading as Seaqae Group
Email: hello@coldcaseclub.store
Subject line: Privacy Request

We will verify identity and respond within 30 days (45 for more complex requests, with notice).