Privacy Policy

This policy explains how Online Business Generator (“OBG”, “we”, “us”) handles personal information. OBG is operated by Last Third Pty Ltd as trustee for the NFWTH Trust, trading as Online Business Generator (ABN 47 378 564 806), Mandurah, Western Australia, contactable at info@onlinebusinessgenerator.com. It covers three groups of people:

• Shop owners and their team members, who hold OBG accounts;
• Shoppers, who buy from shops powered by OBG (each shop is its own business; we process shopper information on the shop’s behalf so their orders work); and
• Visitors to our own website.

From shop owners: your name, email, password (stored only in protected, scrambled form), business name and details, logo and brand settings, products and photos, orders, and support and call-booking history.

From shoppers (on behalf of their shop): name, email, shipping address, what was ordered, and, if the shopper creates an account with a shop or joins its mailing list, those details and preferences. Product reviews if they leave one.

Payment cards: never.Card numbers go directly to Stripe, our payment provider, and never touch or pass through OBG’s systems. We see only what is needed to manage orders and subscriptions, such as the last four digits and the payment status.

From website visitors: almost nothing. Our analytics are built in-house and anonymous by design: a random identifier, the pages viewed, and which site referred the visit. We do not record IP addresses in analytics, we set no advertising or tracking cookies, and we do not use Google Analytics or similar third-party trackers. This is why our site has no cookie pop-up.

• Running your shop and processing its orders;
• sending the emails the platform exists to send: order confirmations, receipts, trial reminders, password resets and the like;
• marketing emails only where someone has opted in, always with an unsubscribe link (Spam Act 2003);
• providing support, including the call bookings you make;
• keeping the platform safe: fraud prevention, rate limiting, security;
• understanding how the platform is used in aggregate, so we can improve it; and
• meeting legal obligations.

We do not sell personal information. Ever. To anyone.

We use only essential cookies: the ones that keep you logged in and keep a shopper’s cart working. No advertising cookies, no cross-site tracking, no third-party analytics cookies.

Only the service providers the platform is built on, each receiving just what their job needs:

• Stripe (payments and subscriptions);
• Supabase (our database and file storage, hosted in Sydney, Australia);
• Vercel (website hosting);
• Resend(delivering the platform’s emails);
• Australia Post(a parcel’s weight and postcodes, only to calculate postage quotes);
• Fashn.ai (only the product photos a shop owner submits for AI model images);
• Anthropic (only the product details a shop owner asks the AI writing assistant to work from);
• Calendly and Zoom (support call bookings); and
• authorities, where the law genuinely requires it.

The platform’s database and uploaded files are stored in Sydney, Australia. Some of the providers above process limited data overseas (mainly in the United States) to do their specific job, for example delivering an email or generating an AI image. We choose providers with strong security practices and send them the minimum.

Every shop’s data is walled off from every other shop’s at the database level (row-level security), so one business can never read another’s records. Connections are encrypted in transit. Passwords are stored only as protected hashes. Access to production systems is restricted, and we use automated monitoring to catch errors and abuse. No system is perfectly secure, but if a data breach ever created a likely risk of serious harm we would notify affected people and the OAIC as required by the Notifiable Data Breaches scheme.

• Account and shop data: while the account is active, and for a reasonable period afterwards so a returning owner can pick up where they left off. You can ask us to delete sooner.
• Order records:kept while the shop’s account is active, because sellers need them for taxes, refunds and warranty claims.
• Storefront analytics events: deleted after 90 days (only aggregated totals remain).
• Website visit analytics: deleted after about 13 months (kept that long only for year-on-year comparison).

Email info@onlinebusinessgenerator.com to ask what we hold about you, to correct it, or to have it deleted (we may need to keep some records where the law requires, and we will tell you if so). Every marketing email has an unsubscribe link that works immediately. If you are unhappy with how we have handled your information, tell us first and we will do our best to fix it; you can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

The shop you bought from is its own business and is your first port of call for anything about your order, refunds or its marketing. OBG’s role is to provide that shop’s software, so we hold your order details on the shop’s behalf as described above. You are always welcome to contact us directly too, and we will help or pass you to the right place.

OBG accounts are for people 18 and over, and our website is not directed at children.

When this policy changes in any meaningful way we will update the date at the top and, for significant changes, email account owners. Questions about privacy are answered by a real person at info@onlinebusinessgenerator.com. See also our Terms of Service.