Privacy policy
Privacy Policy
Last updated: August 20, 2026
Circa Rhythm ("we", "us", "our") operates https://circarhythm.com.au and related services (the "Services"). This policy explains how we collect, use, store and disclose your personal information, and complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Services, you agree to this policy.
ABN: [insert ABN]
Information We Collect
Provided directly by you — name, email, phone, shipping/billing address, payment details, account credentials, order history, and anything you send us via support, reviews, or competition entries.
Collected automatically — IP address, device/browser type, pages viewed, time on site, and similar log and usage data collected via cookies and tracking pixels (see Cookies below). This data isn't personally identifying on its own but may become so when combined with other information.
We only collect what's reasonably necessary to run the Services — we don't ask for health, medical or diagnosis information, and CircaRhythm products are not medical devices.
Cookies and Tracking
We use cookies and similar technologies for essential site functions (login, cart, checkout), performance and analytics, remembering your preferences, and advertising and personalisation (including cart reminders). You can block or delete cookies in your browser settings, but parts of the Services may not work properly if you do. We do not currently respond to browser "Do Not Track" signals.
How We Use Your Information
To fulfil and ship orders, process payments, run your account, provide support, run competitions/promotions, personalise your experience, and for analytics and business improvement. We also use it for marketing — sending you promotional emails/SMS and showing you targeted ads — consistent with APP 7 and the Spam Act 2003 (Cth): every marketing message identifies us and includes a working opt-out, and SMS marketing requires your prior consent. Consent you give for SMS marketing (including your phone number and opt-in status) is never shared with third parties beyond what's needed to send that message.
Who We Share It With
Service providers who help us run the business — Shopify, Klaviyo, Meta/Google advertising platforms, payment processors (e.g. Afterpay, PayPal), analytics, customer support, and shipping/fulfilment partners. Also: professional advisors, law enforcement or regulators where legally required, and a buyer if we sell the business or its assets. Some of these providers operate overseas and may not be bound by the Privacy Act or the APPs — where we transfer your information overseas, we take reasonable steps required under APP 8 to ensure it's still protected, but you should be aware overseas recipients aren't always directly accountable under Australian law.
We do not sell your personal information.
Security and Retention
We take reasonable steps to protect your information from loss, misuse and unauthorised access, but no method of storage or transmission is 100% secure. We keep personal information only as long as needed for the purpose it was collected, or as required by law (e.g. tax and consumer-law recordkeeping).
Data Breaches
If a breach occurs that's likely to cause serious harm, we'll comply with the Notifiable Data Breaches scheme — notifying affected individuals and the OAIC where required.
Your Rights
You may request access to, correction of, or deletion of the personal information we hold about you, subject to our legal recordkeeping obligations. You can withdraw marketing consent or unsubscribe at any time via the link in our emails/SMS or by contacting us. We won't discriminate against you (e.g. charge more, deny service) for exercising these rights, except where the information is genuinely required to provide the service. We may need to verify your identity before actioning a request.
Complaints
Contact us first on support@circarhythm.com.au so we can try to resolve it. If unresolved, you can lodge a complaint with the Office of the Australian Information Commissioner — www.oaic.gov.au, 1300 363 992.
Business Transfers
If CircaRhythm is acquired, merges, or transfers its assets, your personal information may be transferred as part of that deal, and the new owner will be bound by this policy (or an equivalent) going forward.
Children
The Services aren't directed at children and we don't knowingly collect personal information from anyone under the age of majority. Parents/guardians can contact us to request deletion of a child's information.
Third-Party Links
We aren't responsible for the privacy practices of third-party sites you reach via links from our Services. Check their policies before providing information.
International Transfers
Your information may be stored or processed outside Australia by our service providers. Where this happens, we take reasonable steps to keep it protected consistent with the APPs.
Changes to This Policy
We may update this policy from time to time; the current version is always posted here with an updated "Last updated" date.
Contact
ABN: 48 695 494 887