Privacy policy
Privacy Policy
once a day co.
Effective date: 16 August 2026
Last updated: 16 August 2026
1. Who we are
This website, onceadayco.com, is operated by The Trustee for the RGMG Family Trust (ABN 58 522 510 571), trading as once a day co. ("we", "us", "our"), of Paddington, Queensland, Australia.
We are an Australian business. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where the laws of other countries apply to you — such as the EU/UK GDPR or the California Consumer Privacy Act — we have set out your additional rights in section 11.
Contact for all privacy matters: team@onceadayco.com
This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.
2. What personal information we collect
Information you give us:
- Name, email address, phone number
- Shipping and billing address
- Order and purchase history
- Account login details, if you create an account
- Marketing preferences, and whether you have subscribed to our newsletter, the one-Minute Mail
- Anything you write to us — enquiries, reviews, support messages
Payment information. Payments are processed by Shopify Payments and, where you choose it, Shop Pay, PayPal or another provider shown at checkout. We never see or store your full card number. We receive only a confirmation that payment succeeded, the card type, and the last four digits.
Information collected automatically when you visit:
- IP address and the approximate location it indicates (typically city or region — not a street address)
- Device type, operating system, browser and screen size
- Pages viewed, time on page, links clicked and scroll depth
- The website, ad or QR code that referred you to us
- Cookie and device identifiers
Information from session recording. We use Lucky Orange, which records an anonymous playback of how visitors move through the site — mouse movement, clicks, scrolling and page navigation.
These recordings are not linked to your name, email address or account. We see how a page was used, not who used it. Text typed into form fields is masked, so passwords, card numbers and anything you type are not captured. Recordings are used only to find broken links and confusing steps in checkout, and are deleted after 30 days. If you would prefer not to be recorded at all, see section 8.
We do not collect sensitive information as defined by the Privacy Act — health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record or biometric data. Please do not send it to us.
3. Why we collect it
- To process and deliver your order — name, address, contact details, order details
- To take payment and prevent fraud — payment confirmation, IP address, order details
- To send order confirmations and shipping updates — email, phone, order details
- To send marketing emails you have opted into — email, name, purchase history, engagement data
- To answer your questions and handle returns — contact details, order details, your message
- To improve the website and fix problems — usage data, session recordings, analytics
- To advertise to you on Meta platforms — cookie identifiers, browsing and purchase activity
- To meet our legal obligations (tax, consumer law) — order and transaction records
If the GDPR applies to you, our lawful bases are: contract (to fulfil your order), consent (marketing), legitimate interests (securing and improving the site, preventing fraud), and legal obligation (tax and accounting records).
4. Cookies and tracking technologies
We use four categories of cookie and similar technology.
- Essential — required for the site to work: your cart, your login session, security and load balancing. These cannot be switched off. Provider: Shopify
- Analytics — how many people visit, which pages they use, where they drop off. Providers: Shopify Analytics, Google Analytics
- Session recording — anonymous playback of on-site behaviour to find usability problems, with form input masked and no link to your name or account. Provider: Lucky Orange
- Advertising — measuring which ads lead to purchases, and showing you our ads on other platforms. Provider: Meta Pixel (Facebook and Instagram)
Everything except the essential category is non-essential, and you can refuse it. Section 8 explains how.
5. Who we share personal information with
We share only what each provider needs to do its job. We have listed them by name so you know exactly who handles your information.
- Shopify — store platform, hosting, order management. Processed in Canada and the United States.
- Shopify Payments / Shop Pay — payment processing. Processed in the United States.
- Klaviyo — email marketing and order notifications. Processed in the United States.
- Meta — advertising and conversion measurement. Processed in the United States.
- Google — website analytics. Processed in the United States.
- Lucky Orange — session recording and heatmaps. Processed in the United States.
- Shipping carriers — delivering your order. Processed in Australia and the destination country.
We also disclose personal information to our accountant and professional advisers where necessary, and to law enforcement, courts or regulators where we are required by law to do so.
We do not give your personal information to anyone else for their own marketing purposes.
6. Selling and sharing your information
We do not sell your personal information for money. We never have and we have no plans to.
We do need to be straightforward about one thing, because privacy laws in California and some other US states define "sale" and "sharing" more broadly than most people expect.
When you visit our site, the Meta Pixel may send information about your visit — such as pages viewed, items added to cart and purchases — to Meta, so that we can measure whether our ads work and show our ads to people who have shown interest. Under California law this is classified as "sharing" personal information for cross-context behavioural advertising, and it counts as such even though no money changes hands and no list is handed over.
So, stated plainly: we do not sell your data, but we do share limited browsing and purchase activity with Meta for advertising purposes, and you have the right to opt out.
To opt out, use any of these:
- Email team@onceadayco.com and ask us to opt you out. We will action it and confirm.
- Block or delete cookies in your browser settings
- Turn off ad personalisation in your Meta account at facebook.com/adpreferences
Opting out will not change the price you pay, the products available to you, or the service you receive. We will never discriminate against you for exercising a privacy right.
7. Sending information overseas
We are based in Australia, but several of the providers listed in section 5 store and process personal information overseas — principally in the United States and Canada.
This is an overseas disclosure under Australian Privacy Principle 8. Before disclosing information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual data protection terms with each provider.
If you are in the EEA or UK, transfers of your personal information out of your region rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), or on an adequacy decision where one exists.
By using this site and placing an order, you consent to your information being handled overseas as described here.
8. Your choices
Email us. The simplest way to exercise any choice in this policy is to email team@onceadayco.com. Tell us what you want — to be opted out of advertising, excluded from session recording, unsubscribed, or to have your information deleted — and we will action it and confirm back to you.
Session recording. To opt out of Lucky Orange, turn on Do Not Track in your browser settings — Lucky Orange honours it. You can also email us and we will exclude you.
Marketing emails. Every email has an unsubscribe link at the bottom. You can also reply to any email and ask us to remove you, or email team@onceadayco.com. Unsubscribing from marketing does not stop order and shipping notifications, which we have to send you.
Browser settings. You can block or delete cookies in your browser settings at any time. Blocking essential cookies will stop the cart and checkout working.
Meta ad preferences. You can control the ads you see at facebook.com/adpreferences and instagram.com/accounts/privacy_and_security.
9. How long we keep it
- Order, invoice and transaction records — 7 years from the transaction, as required by Australian tax law
- Customer account details — while your account is open, then 12 months
- Marketing contacts — until you unsubscribe, then 24 months, or 24 months after your last engagement
- Session recordings — 30 days, then automatically deleted
- Analytics data — up to 14 months
- Customer service enquiries — 2 years from resolution
When information is no longer needed for any of the purposes in this policy and we are not required by law to keep it, we destroy it or de-identify it, in line with APP 11.2.
10. How we protect it
We take reasonable technical and organisational steps to protect personal information from misuse, loss, unauthorised access, modification and disclosure. These include encryption in transit (HTTPS across the whole site), PCI-DSS compliant payment processing handled entirely by Shopify, access limited to the people who need it, and multi-factor authentication on our administrative accounts.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
11. Your rights
Everyone. You may ask us to:
- Access the personal information we hold about you
- Correct anything inaccurate, out of date or incomplete
- Delete your information, where we are not required to keep it
- Stop sending you marketing
Email team@onceadayco.com. We will respond within 30 days. We do not charge a fee. We may need to verify your identity before acting on a request, usually by confirming details of a recent order.
If you are in Australia. Your rights come from the Privacy Act 1988 and the Australian Privacy Principles. If you are unhappy with how we have handled your personal information or a request, please tell us first at team@onceadayco.com so we can try to fix it. We will respond within 30 days.
If you are still not satisfied, you can complain to the Office of the Australian Information Commissioner:
- Website: oaic.gov.au
- Phone: 1300 363 992
- Email: enquiries@oaic.gov.au
- Post: GPO Box 5218, Sydney NSW 2001
If you are in the EEA or UK. In addition to the above, you have the right to data portability, to restrict or object to processing, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority.
If you are in California. You have the right to know what personal information we collect and why, to delete it, to correct it, to opt out of sale and sharing, to limit the use of sensitive personal information (we do not collect any), and not to be discriminated against for exercising these rights. See section 6 for how to opt out.
Appeals. If we decline a request, we will tell you why. You may appeal by replying directly to our response, and we will review the decision.
12. Automated decision-making
We do not make decisions about you that produce legal or similarly significant effects using automated processing alone.
We do use automated tools in our email marketing platform (Klaviyo) to group contacts into segments and choose the timing and content of marketing emails, based on things like your purchase history and whether you have opened previous emails. This only affects which marketing emails you receive. You can opt out entirely by unsubscribing.
13. Children
Our products and this site are intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has given us personal information, email team@onceadayco.com and we will delete it.
14. Changes to this policy
We will update this policy when our practices change or the law requires it. The effective date at the top will change, and material changes will be notified by email to subscribers and by a notice on the site. Please check back from time to time.
15. Contact us
once a day co.
The Trustee for the RGMG Family Trust
ABN 58 522 510 571
Paddington, Queensland, Australia
Email: team@onceadayco.com
We are the entity responsible for your personal information and the point of contact for any privacy question, request or complaint.