Privacy Policy

1. Who we are

VALORA is operated by VALORA PACIFIC PTY LTD (ABN 81 698 730 031) (we, us or VALORA).

Email: valorapacific8@gmail.com. Phone: 0426 895 676. Postal and contact location: Hamilton QLD 4007, Australia.

We handle personal information in accordance with this policy and applicable Australian privacy law. We aim to follow the Australian Privacy Principles as a practical standard whether or not a small-business exemption applies to a particular activity.

2. Personal information we collect

Depending on how you use VALORA, we may collect:

• Identity and contact information: name, email address, phone number, business name, ABN, business address, delivery and billing address.
• Account and authentication information: account email, password hash and salt (not your plaintext password), email-verification status, Google account identifier and email if you use Google Sign-In, roles, account status, sessions and security events.
• Order and transaction information: products, quantities, prices, discounts, GST, delivery method and address, order status, payment-provider references, refunds, invoices, shipments, the version of these terms you accepted and communications about an order. Card details are entered into Stripe or PayPal components and are not stored by VALORA.
• Trade information: company and contact details, ABN, business type, estimated usage, application and approval information, pricing tier and staff review records.
• Painter information: business and contact details, ABN, service areas, services, experience, portfolio, availability, self-declared insurance information, self-declared licence number, application status, staff notes and, where a painter chooses public listing, approved profile information, biography, photos and an optional phone number.
• Painter-job information: your name and contact details, preferred contact method, suburb, state, postcode, property and job type, approximate size, rooms, timeframe and description. If you agree to a match, these details may be provided to the selected painter so they can contact you about that job.
• Projects, quotes and product requests: client and project details, site address, project notes, documents and images, calculations, quote contents and decisions, product sample or quote requests and related communications.
• Product problem and support information: proof of purchase, product and batch information, property location, issue description, application and preparation details, photographs, video or other evidence, installer details, inspection information, assessment notes and the outcome.
• Membership, rewards and referral information: tier and points activity, rewards and redemptions, referral codes and relationships, referral submissions and photos, cashback and payout records. If you request a bank payout, we collect account name, BSB and account number. Current payout records are designed to store those bank details in encrypted and masked form and to log access.
• Technical and security information: IP address, user agent, session and login records, timestamps, audit records, request and application status, and standard hosting and server logs.
• Information you upload or publish: project files, images, portfolio material, captions, notes and other content you choose to submit. Uploaded material may contain personal information about you or another person.

2a. Information about other people

Please do not give us personal information about another person unless you are authorised to do so and the information is relevant to the service you request.

3. How we collect information

We collect personal information:

• directly from you when you create an account, order, submit a form, upload content, contact us or use an account feature;
• from Google if you choose Google Sign-In;
• from Stripe or PayPal about the status and reference of a payment or refund;
• from a VALORA staff member or painter when they administer an application, project, quote, job match, report or support request;
• automatically through the strictly necessary session cookie, security records and standard server logs; and
• from another user where they make an authorised referral or include you in a business project or quote.

3a. Being anonymous

You may browse public pages without identifying yourself. Some services cannot be provided anonymously because we need information to create an account, deliver goods, issue invoices, assess applications, arrange a painter introduction, pay a referral amount or handle a reported product problem.

4. Why we use personal information

We use personal information to:

• create, secure and administer accounts;
• process payments, orders, delivery, collection, refunds and tax invoices;
• record which version of our Terms of Sale you accepted when you placed an order, and when;
• respond to questions and provide customer support;
• assess trade and painter applications and administer approved accounts;
• manage projects, calculations, product requests and quotes;
• match a customer with a painter where the customer has agreed to the disclosure;
• administer public painter profiles where the painter has opted in and VALORA has approved publication;
• assess and resolve reported product problems and consumer-guarantee claims;
• run membership tiers, points, rewards, referrals, cashback and payouts;
• send transactional messages such as verification, order, payment, quote, application and outcome updates;
• prevent misuse, protect accounts, investigate security events and maintain audit records;
• comply with tax, accounting, legal and regulatory obligations; and
• improve and operate the platform using aggregated or de-identified information where appropriate.

4a. Marketing

We do not sell personal information. We do not currently use account information for marketing email, and there is no marketing consent box anywhere on this site. If we introduce marketing, we will obtain or otherwise rely on lawful consent, identify the sender and provide a working unsubscribe facility as required by Australian spam law.

5. Automated rules and decisions

The platform uses rule-based software to calculate matters such as prices, delivery bands, membership tiers, points, reward or referral eligibility, stock reservations and security controls. Payment providers may also apply their own fraud and risk systems.

Trade, painter and product-problem outcomes that can materially affect a person are designed to involve staff review rather than being decided solely by an automated program. If this changes, we will update this policy and any collection notice before the change takes effect.

6. Who we disclose information to

We may disclose relevant personal information to:

• Stripe and PayPal, for payment, refund and fraud-prevention services;
• Resend, for transactional email delivery;
• Google, if you choose Google Sign-In;
• Neon, as database infrastructure, and Vercel, as application hosting infrastructure;
• a selected painter, but only for the painter introduction requested by the customer and subject to the customer's consent;
• the public, for painter-directory information the painter has expressly opted to publish and VALORA has approved;
• professional advisers, insurers, payment or delivery providers where reasonably required for the service or a dispute;
• regulators, courts, law-enforcement agencies or other persons where required or authorised by law; and
• a purchaser or successor in connection with a genuine business restructure or sale, subject to appropriate confidentiality and legal requirements.

6a. What service providers receive

Service providers may only receive the information reasonably needed for their function. Their own privacy terms also apply to information they collect directly from you.

7. Overseas disclosures

Our database is hosted with Neon in the AWS Asia Pacific (Sydney) region, in Australia. Our application code runs on Vercel in the Washington, D.C., United States function region (us-east-1 / iad1), and Vercel's content delivery network serves static files from locations worldwide. In practice this means the information itself is stored in Australia and is read and written by servers in the United States.

Stripe, PayPal, Resend and Google are headquartered in the United States and may process information there. Each of them uses its own subprocessors, which operate in further countries and change from time to time; their current subprocessor lists are published by those providers. We have not listed every one of those countries here because we cannot state them accurately and keep them accurate — saying so is more useful to you than a list that quietly goes stale.

Where Australian privacy law applies, we take reasonable steps appropriate to the circumstances before disclosing personal information to an overseas recipient. We review our hosting regions and provider subprocessor lists periodically and will update this section when they change.

8. Cookies and logs

VALORA uses a strictly necessary valora_session cookie to keep signed-in users authenticated. The cookie is not used for advertising. We also use standard server and security logs to operate and protect the service.

We do not currently use third-party behavioural advertising or analytics cookies, and there is no consent banner because there is nothing non-essential to consent to. If that changes, we will update this policy and implement any notice or choice required before those tools are enabled.

9. Security

We use technical and organisational safeguards appropriate to the information we hold. Implemented controls include salted password hashing, hashed verification, reset and session tokens, role-based access controls, audit records, restricted handling of reward secrets, encrypted and masked referral bank details with access logging, and payment-provider hosted card entry so that card numbers never reach our systems.

No internet service is completely secure. Please use a strong, unique password and contact us promptly if you believe your account or personal information has been compromised.

10. Retention and deletion

We retain personal information only for as long as reasonably needed for the purposes in this policy, to resolve disputes and enforce agreements, and to meet legal, tax, accounting and record-keeping obligations. In particular:

• order, invoice, payment, refund and GST-related records are generally retained for at least five years, and longer where legally required;
• records of a reported product problem or a dispute are retained for a reasonable period needed to assess, resolve or defend it;
• account, trade, painter, project, quote, reward and referral records are retained while the relationship or relevant program remains active, and afterwards where reasonably needed for records, disputes, fraud prevention or legal obligations;
• expired authentication tokens and sessions are retained only as operationally or legally required; and
• information that is no longer needed and is not required by law is destroyed, de-identified or put beyond use using reasonable steps.

10a. How retention is actually carried out

The platform does not automate every retention decision. VALORA carries out deletion and de-identification reviews manually, on a documented quarterly schedule, and records what was deleted, de-identified, or retained and why. Financial, audit or transaction records may need to be retained even after an account is deactivated.

11. Access and correction

You may ask for access to personal information we hold about you, or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Contact us at valorapacific8@gmail.com. We may need to verify your identity. We will respond within a reasonable period, generally within 30 days. If we refuse access or correction where the law permits refusal, we will explain the reason and the complaint options available to you, unless the law prevents us from doing so.

Australian privacy law does not provide a general right to erase every record. We will nevertheless consider deletion and de-identification requests, and will explain any information we must retain for legal or legitimate operational reasons.

12. Privacy complaints

Send a privacy complaint to valorapacific8@gmail.com with enough detail for us to investigate. We will acknowledge it, investigate, and aim to respond within 30 days.

If you are not satisfied with our response and the Privacy Act applies, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Changes to this policy

We may update this policy when our practices or legal obligations change. The current version and effective date are published at the top of this page. If a change is material, we will take reasonable steps to provide an additional notice where appropriate.