Privacy policy

Sophia King trading as Camp Cosy (ABN 16 783 863 217) sets up indoor camp sleepovers in homes across North and North-West Brisbane. We operate from The Gap, QLD 4061.

This policy explains what personal information we collect when you use campcosy.com.au or book a sleepover with us, why we collect it, who we share it with, and how you can get at it or correct it.

Contact us about privacy

Email hello@campcosy.com.au.

When you book

To set up a sleepover we ask for:

• Your details — name, email address and mobile number.
• Where we're going— street address, suburb and postcode, which room you'd like the setup in, and any delivery notes you add.
• How many campers are coming— a number, so we bring the right amount of gear. We don't ask for children's names on the website.
• Your booking — the package, number of teepees, the date, any add-ons, and the totals we calculated.
• Confirmation that you accepted our hire terms.

When you pay

Payments run through Stripe. Your card number never reaches Camp Cosy's systems — you enter it on Stripe's own hosted checkout page. We keep only Stripe's reference for the payment, the amount, and whether it succeeded.

While we look after your booking

Our staff may add notes to a booking — for example, access instructions or a change you asked for over the phone. Treat these as part of your record: you can ask to see them.

Automatically

Our hosting provider, Vercel, keeps standard server logs, which can include IP addresses and browser information. Those logs sit with Vercel and are kept to their own schedule, not ours — we don't copy them anywhere, and we don't use them for anything beyond keeping the site running and secure.

What we don't collect

We think it's worth being specific:

• We don't run analytics, advertising pixels or tracking cookies. There is no Google Analytics, no Meta pixel, no third-party tracker on this site.
• We never see or store your full card number.
• We don't buy personal information from anyone, and we don't sell or rent yours.

We don't collect children's names on this website. A booking records only how many campers are coming — a number, which identifies nobody.

We make wooden name tags, so we do need first names eventually. We ring you the week before your night and take them over the phone. They're written on the tags and used to plan the setup, and they aren't entered into the booking system.

We never use children's information for marketing, and we never ask children for information directly — bookings are made by adults.

We use what we collect to:

• work out whether you're inside our delivery area and what the travel fee is;
• take payment for your booking, and issue receipts;
• issue and redeem a credit, if you move a booking without a new date in mind — a credit is tied to the booking it came from, so we can see it was yours and that it has only been used once;
• confirm your booking and send you the details;
• turn up at the right address, at the right time, with the right setup;
• contact you if something changes or we need to reach you on the day;
• keep records of bookings and payments as our tax and accounting obligations require.

We don't send marketing emails.We only email you about the booking itself — confirmation, reminders, changes and cancellation. There's no mailing list to opt into or out of, because we don't run one.

We share personal information only with the services that make the booking work, and only with what they need:

We may also disclose information where the law requires it, or where it's necessary to protect someone's safety.

We don't disclose your information to anyone else without your consent.

Overseas disclosure

Some of the services above store or process data outside Australia, including in the United States:

• Supabase — our database provider, which holds your booking record.
• Stripe — our payment processor, which holds your name, email and payment details.
• Resend — our email provider, which holds your name, email and booking details to send your confirmation.

We've chosen established providers with strong security practices. If you'd like more detail on where a particular provider processes data, ask us and we'll find out.

We use no advertising or analytics cookies. What we do use:

• A session cookie for staff. Only Camp Cosy staff signing in to the admin area get this. It keeps them signed in. Customers never receive it.
• Your browser's session storage.While you're going through the booking steps, your progress and choices are kept in your own browser so a refresh doesn't lose them. It stays on your device, is not a cookie, is not sent to us, and it clears when you close the tab.

• Card details are handled entirely by Stripe and never touch our systems.
• Booking data sits in a database protected by row-level security, so the public site key cannot read customer records.
• The admin area requires a staff sign-in.
• Access to customer information is limited to the people who need it to run a booking.

No system is perfectly secure, and we can't guarantee absolute security — but if a data breach occurs that's likely to cause you serious harm, we'll notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

• Booking and payment records — kept for 5 years from the booking date, in line with our tax and accounting obligations.
• Enquiries that never became a booking — deleted after 6 months.
• Staff admin notes — kept with the booking they belong to.
• Credits — kept while valid, and then with the booking record they came from, since a credit is evidence of money moved and has to be auditable after it expires.

When we no longer need your information, we delete it or de-identify it.

You can ask us to:

• tell you what we hold about you and your booking;
• correct anything wrong — a misspelt name, an old address, a wrong number;
• delete what we're not required to keep.We can't delete records we're legally required to retain, such as records of a completed payment, but we'll tell you what we've kept and why.

Email hello@campcosy.com.auand we'll respond within 30 days. We may need to verify who you are first. There's no charge for asking.

If you think we've mishandled your personal information, please email hello@campcosy.com.aufirst — we'd like the chance to put it right, and we'll respond within 30 days.

If you're not satisfied with how we've handled it, you can complain to the Office of the Australian Information Commissioner:

• Online: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992

If we change how we handle personal information, we'll update this page and change the "last updated" date. If the change is significant, we'll tell customers with an active booking directly.