Privacy policy

1. Who this policy covers

This policy covers japanesematcha.com.au and the Japanese Matcha website services operated by Benjamin Turner. For privacy questions, email hello@japanesematcha.com.au.

2. What we collect

First-release list: your name, email, product interest, whether you’re joining for home, a café or a matcha business, optional business and city details, signup page, consent version and submission time. We also keep a protected removal-token reference. Joining does not verify your email address, create an order or collect payment details.

Café enquiries and Stocklist requests: your name, email, venue or business, city, any venue link, message or report reason, permission to reply, optional marketing choice and submission time. Reports and nominations stay private while we review them.

Website security: our hosting provider processes technical request information, including IP addresses, to serve the website, protect forms and limit misuse. Our application also keeps aggregate daily AI request counts.

3. Why we use it

We use signup details to manage first-release updates and your stated interests. We use enquiry details to answer you, assess wholesale requests and review proposed or reported stockists. We use technical information to operate and protect the website. We don’t treat a waitlist signup as a purchase, a stock reservation or an agreement to wholesale supply.

Home subscribers who choose email updates may receive a welcome note around two hours after joining. We send only when email delivery is available. A successful submission confirms that the signup was saved; it does not verify the email address.

4. Where information goes

Cloudflare hosts the website, forms, application database and AI service. Signup and venue-request records are also mirrored to a private Japanese Matcha tracker in Notion for follow-up. Access is intended for operating Japanese Matcha and handling your request.

We use Resend for welcome email delivery. It processes the recipient’s name, email address, message content and delivery information needed to send the email.

These providers operate internationally, so information may be processed outside Australia. We have not confirmed every processing location. We may also disclose information where required by law. We do not sell your personal information or add you to another brand’s mailing list.

5. AI chat

When you ask a question, your message, up to six recent exchanges and public page context may be sent to Cloudflare Workers AI to generate a reply. The assistant can make mistakes; check the product page or ask us before relying on product, ingredient or availability information.

The conversation stays in the current page’s memory until you reset it, reload or leave. Our application does not save chat transcripts in its database. Cloudflare processes the requests under its own service arrangements. Please leave out passwords, card details, medical history and private order information. Chat cannot place an order, join the list or send a message for you.

If you ask about your wholesale application, a separate read-only helper checks the account you are signed in to using your website session. It returns only that account’s recorded application status. Your private status question and reply are not sent to the AI model or included in later AI conversation history. If you also ask for a cup-cost calculation, only the numbers you supplied and the calculation may be kept for follow-up. Chat cannot change your application or approve access.

6. Cookies and browser storage

The recipe builder can save a recipe when you choose Save. Signup forms can save a private removal token, and account sign-in uses secure cookies. We store your analytics choice and any internal-testing exclusion in your browser.

Cloudflare Web Analytics measures page views and website performance without analytics cookies. Internal testing and private account or checkout pages are excluded from that measurement.

If you choose Allow analytics, Google Analytics measures visits, traffic sources and completed signup or café enquiry actions. Microsoft Clarity records interactions on public pages to help us understand clicks, scrolling and navigation. We mask page text and forms, and do not run Clarity on account, checkout or referral pages. Names, emails, messages, sign-in codes and private request references are not included in our analytics events.

Advertising storage and ad personalisation stay disabled. Choosing No thanks keeps Google Analytics and Clarity off. You can change your choice below; browser blocks and your choice may mean analytics does not count every visit.

Change analytics choice

Read the Google privacy policy and Microsoft privacy statement. You can clear local website data in your browser. This does not delete information already saved in our database or private tracker.

7. Access, corrections and removal

Use Remove my signup after submitting, or when returning in the same browser with its saved token, to delete that signup from the website database. If it has already been mirrored to our private tracker, email us to remove that copy too; the browser removal does not automatically delete the Notion record.

You can also use Unsubscribe in a welcome email. Opening the link shows a confirmation page; confirming removes the website signup and cancels pending welcome emails. Mailbox providers may offer a one-click unsubscribe. A message already accepted for sending cannot be recalled. We keep a hashed email reference to honour the unsubscribe and prevent the welcome from being sent again.

For access, a correction, stopping updates or removal of an enquiry, email hello@japanesematcha.com.au from the address you used. We may ask for enough information to verify that the record is yours. We may need to retain limited information for a legal obligation or an unresolved request.

8. Retention and security

We keep information for managing the list, following up your request and any necessary legal or security records. There is no automatic fixed deletion period in the current application. You can ask us to review or remove your information at any time.

For the welcome email, we keep scheduling times, attempt counts, message status and any provider message reference. An email awaiting a retry temporarily retains its exact recipient details and rendered content so it can be retried without creating a second message. We erase that retry content when the provider accepts the message or the job is suppressed, fails or needs manual review. Limited status records and hashed email references remain for deduplication, unsubscribe suppression and delivery evidence. Provider acceptance is not proof of inbox delivery.

We use restricted private systems and website safeguards, but no internet service can promise absolute security.

9. Questions or complaints

Email hello@japanesematcha.com.au with your concern and the address or request it relates to. We’ll review it and reply. You can also contact the Office of the Australian Information Commissioner to understand complaint options and whether they apply.

10. Changes to this policy

When our services or information handling change, we’ll update this page and its date. The policy describes the website as it operates now.

Your account and wholesale application

Your account stores your name, email and any business details in our Cloudflare D1 database. You can sign in with a six-digit email code. Codes expire after 10 minutes, work once and are stored as keyed hashes. We send requested sign-in codes through Resend using our Japanese Matcha email address. These service emails do not subscribe you to marketing.

A code verifies control of your email before you can submit an account wholesale enquiry. It does not link earlier guest enquiries or orders by email alone. Older password accounts can still use their password and recovery key. When an unverified account is verified by email for the first time, its unverified passwords, recovery keys and linked sign-ins are replaced, and older sessions are signed out. Account sessions use private cookies that expire after seven days.

Wholesale applications store your venue, suburb, cup estimate, message and permissions. A private Notion tracker receives the enquiry details for Ben to review. Account creation and applying do not approve wholesale access, place an order, or subscribe you to marketing. Marketing permission is a separate optional choice. We do not copy password hashes, session credentials or recovery keys to Notion.

Account actions use temporary attempt counts to limit abuse. To ask about accessing, correcting or deleting account information, contact us using the details below.

If you choose Google sign-in, Google supplies your name, email and Google account identifier. We verify Google’s signed response and store the link to your Japanese Matcha account. We do not receive your Google password or access to Gmail, Drive or your other Google services. Google handles its part of sign-in under its own privacy policy. Connecting Google to an existing account requires a recent sign-in; matching email addresses do not automatically join accounts.