Legal notice
Privacy Policy
Effective date: 1 August 2026 Last updated: 1 August 2026
This Privacy Policy explains what personal information The Brave Kids collects when you visit or buy from thebravekids.store, why we collect it, who we share it with, and what control you have over it. It also covers our use of cookies — see section 12.
We've written this in plain English on purpose. If anything is unclear, email us at thebravekids.ok@gmail.com and we'll explain it.
1. Who we are
The Brave Kids is a trading name of Joaquin Garbuyo, 75 Digger St, Cairns North QLD 4870, Australia (ABN 38 258 103 245).
For the purposes of the EU and UK General Data Protection Regulation, Joaquin Garbuyo is the data controller for the personal information described in this policy.
Privacy contact: thebravekids.ok@gmail.com
2. A note about what we sell
We sell printable digital resources for parents, carers and educators. Our products relate to children's emotional development, but our store is designed for and directed at adults. We do not knowingly collect personal information from children. See section 10.
We also want to be direct about something: because our products relate to children's wellbeing, browsing our site could in principle reveal something about your family. We do not ask you about your child, your family, or any health condition, and we do not build or buy profiles about those things. See section 7.
3. What we collect
Information you give us
| What | When | Why |
|---|---|---|
| Name and email address | At checkout | To process your order and deliver your download links |
| Billing address and country | At checkout | Fraud prevention and calculating sales tax, VAT or GST |
| Payment details | At checkout | To take payment (see the note below) |
| Order and download history | Ongoing | Customer support, re-issuing download links, refunds |
| Messages you send us | When you contact us | To answer you |
| Marketing preferences | If you subscribe | To send you emails you've asked for |
| Reviews or feedback you submit | If you choose to | To display on our site, with your permission |
A note on payment details. We never see or store your full card number. Card data goes directly to our payment processors. We receive only what we need to identify the transaction: the last four digits, the card type, and whether payment succeeded.
Information collected automatically
- Device and browser type, operating system, screen size and language
- IP address and approximate location derived from it (city or region level, not a street address)
- Pages you viewed, how you arrived, what you clicked, and how long you stayed
- Cookies and similar technologies — see section 12
Information from third parties
- Shopify, which hosts our store, provides order, fraud-risk and analytics data
- Payment processors confirm payment status and flag suspected fraud
- Advertising platforms may tell us, in aggregate, that an ad led to a sale
4. Why we use it, and our legal basis
If you're in the EU or UK, the GDPR requires us to name a legal basis for each use. Here it is:
| Purpose | Legal basis (GDPR) |
|---|---|
| Taking payment and delivering your files | Performance of a contract |
| Customer support and re-sending download links | Performance of a contract |
| Processing refunds | Performance of a contract; legal obligation |
| Fraud and chargeback prevention | Legitimate interests; legal obligation |
| Keeping tax and accounting records | Legal obligation |
| Site analytics and improving our products | Legitimate interests, or consent where required for cookies |
| Marketing emails | Consent (you can withdraw it at any time) |
| Advertising and measuring ad performance | Consent where required; otherwise legitimate interests |
| Responding to legal requests | Legal obligation |
Where we rely on legitimate interests, we've weighed our interest against your privacy and concluded the processing is proportionate. You can ask us to explain that assessment, or object to it, at thebravekids.ok@gmail.com.
5. What we never do
- We do not sell your personal information for money.
- We do not send you unsolicited marketing after a purchase unless you opted in.
- We do not ask for, or knowingly collect, information about your child's health, diagnosis or behaviour.
- We do not use your information to make automated decisions that have a legal or similarly significant effect on you.
6. Who we share it with
We share personal information only with organisations that help us run the store, and only what they need:
- Shopify Inc. — hosting, checkout, order management, store analytics
- Payment processors — the providers shown at checkout
- Digital delivery provider — generates and serves your download links
- Email provider — sends order confirmations and, if you opted in, marketing
- Analytics providers — help us understand how the site is used
- Advertising platforms — for advertising and conversion measurement, subject to your cookie choices
- Professional advisers — accountants and lawyers, where necessary and under a duty of confidence
- Authorities — where we're legally required to, or to establish or defend legal claims
If our business is ever sold or restructured, personal information may transfer to the buyer. We'll notify you before that happens and this policy will continue to apply until you're told otherwise.
7. Sensitive information and advertising
Some privacy laws — including the California Consumer Privacy Act as amended, and the GDPR — give special protection to information about health, including mental health.
We do not intentionally collect this category of information, and we instruct our advertising partners not to build health-related inferences from your visit to our site. If you tell us something about your child in a support email, we use it only to answer you, we don't add it to a marketing profile, and we delete it with the rest of the support thread on our normal retention schedule.
Under California law, using cookies to share your browsing activity with advertising platforms can count as "sharing" for cross-context behavioural advertising, even when no money changes hands. You can opt out at any time — see section 9.
8. International transfers
We are based in Australia and use service providers in the United States, the European Union and elsewhere. That means your personal information may be transferred outside your own country.
Where we transfer personal information out of the EEA or the UK, we rely on one of the following safeguards:
- An adequacy decision by the European Commission or the UK government
- Standard Contractual Clauses, plus the UK International Data Transfer Addendum where relevant
- Your explicit consent, where no other mechanism applies
You can request a copy of the relevant safeguard by emailing thebravekids.ok@gmail.com.
9. Your rights
Everyone
Whatever country you're in, you can ask us to:
- Tell you what personal information we hold about you
- Give you a copy of it in a portable format
- Correct anything that's wrong
- Delete it, where we don't have an overriding legal reason to keep it
- Stop sending you marketing
- Stop or limit a particular use
Email thebravekids.ok@gmail.com. We'll respond within 30 days, or sooner where the law requires it. We won't charge you, and we won't treat you differently for asking.
If you're in the EU or UK
You also have the right to object to processing based on legitimate interests, the right to restrict processing, the right to withdraw consent at any time, and the right to lodge a complaint with your data protection authority. In the UK that's the Information Commissioner's Office. In the EU it's the authority in the country where you live.
If you're in the United States
Depending on your state, you may have the right to know, delete, correct and port your information, and to opt out of the sale of personal information, of targeted advertising, and of profiling. We extend these rights to all US residents regardless of state, so you don't have to check whether your state has passed a law yet.
To opt out of targeted advertising, either use the cookie settings link in our site footer, or turn on Global Privacy Control in your browser — we honour GPC signals automatically.
Authorised agents. You may use an authorised agent to make a request. We'll ask for proof of their authority.
Appeals. If we refuse your request, you can appeal by replying to our decision with the word "appeal". We'll review it and respond within 45 days with our reasoning. If we still refuse, we'll tell you how to complain to your state Attorney General.
California "shine the light"
California residents may request a list of any third parties to whom we disclosed personal information for their direct marketing purposes in the previous calendar year. We don't currently make disclosures of that kind, and we'll say so in writing if you ask.
10. Children's privacy
Our store is intended for adults. You must be at least 18, or the age of majority where you live, to buy from us.
We do not knowingly collect personal information from children under 13, and our site is not directed to children within the meaning of the US Children's Online Privacy Protection Act. We do not use analytics or advertising features designed to profile children.
If you believe a child has given us personal information, email thebravekids.ok@gmail.com and we will delete it promptly and confirm in writing.
Please note: our products are printable materials that you use with your child offline. Nothing in our products asks your child to enter information into a website, create an account, or contact us.
11. How long we keep it
| Data | Retention |
|---|---|
| Order and tax records | 7 years from the date of the order, as required by tax law |
| Download links and access logs | 24 months after purchase |
| Support emails | 24 months after the conversation ends |
| Marketing list data | Until you unsubscribe, then up to 12 months to honour the opt-out |
| Analytics data | Up to 26 months, usually in aggregated form |
| Cookies | See the table in section 12 for individual lifespans |
When a retention period ends we delete the information or irreversibly anonymise it.
12. Cookies and tracking
A cookie is a small text file a website stores on your device so it can recognise you next time. We also use similar technologies — pixels, tags, local storage and SDKs — and everything in this section covers all of them.
Cookies are either first-party (set by us) or third-party (set by another company whose service we use), and either session (deleted when you close your browser) or persistent (they stay until they expire).
12.1 Strictly necessary
These make the store work. They can't be switched off, and we don't need your consent for them because without them you couldn't buy anything.
| What it does | Set by | Typical lifespan |
|---|---|---|
| Remembers your cart | Shopify | 2 weeks |
| Keeps your checkout session secure | Shopify | Session |
| Fraud and bot detection | Shopify, payment providers | Up to 1 year |
| Remembers your cookie choices | Shopify | 1 year |
| Load balancing and site availability | Shopify | Session |
12.2 Functional
These remember your preferences — language, currency, whether you've dismissed a banner. If you block them the site still works, it's just slightly more annoying.
| What it does | Set by | Typical lifespan |
|---|---|---|
| Language and currency preference | Shopify | 1 year |
| Dismissed notices and banners | The Brave Kids | 1 year |
12.3 Analytics
These tell us how the site is used in aggregate — which pages people read, where they drop off, whether a page is broken on a particular browser.
| What it does | Set by | Typical lifespan |
|---|---|---|
| Store traffic and behaviour reports | Shopify Analytics | Up to 2 years |
| Site usage measurement | Google Analytics | Up to 2 years |
12.4 Marketing and advertising
These let us run ads and measure whether they work. They also let advertising platforms build a profile of your interests across sites.
| What it does | Set by | Typical lifespan |
|---|---|---|
| Measures whether an ad led to a purchase, and builds audiences | Meta Pixel | Up to 3 months |
| Conversion tracking and remarketing | Google Ads | Up to 2 years |
This is the category most people want to turn off, and it's the one where your choice matters most. Under EU and UK law we need your consent before setting these at all.
12.5 Your choices
On our site. Use the cookie preferences link in the footer of every page. You can change your mind at any time, and changes take effect immediately. If you're in the EU, the UK or another region requiring prior consent, non-essential cookies stay off until you accept them.
Global Privacy Control. If your browser or an extension sends a GPC signal, we treat it as an opt-out of targeted advertising and of the sale or sharing of personal information. You don't need to do anything else.
In your browser. Every major browser lets you block or delete cookies in its settings. Blocking all cookies will break checkout, so we'd suggest using our preferences panel instead.
At the source. Meta and Google both let you adjust ad preferences in your account settings. The Digital Advertising Alliance, the Network Advertising Initiative and Your Online Choices (EU) offer bulk opt-out pages. Opting out stops targeted advertising — it doesn't stop advertising, and it doesn't reduce the number of ads you see.
Do Not Track. There is still no agreed standard for how sites should respond to browser DNT headers, so we don't act on DNT. We do act on Global Privacy Control, which is the successor signal and legally recognised in several US states.
Cookies set by Shopify, Google and our payment providers are governed by their own policies. We've described what they do to the best of our knowledge, but they can change their own cookies without telling us. We review this section periodically.
13. Security
We use HTTPS across the site, restrict internal access to order data to the people who need it, use multi-factor authentication on our administrative accounts, and rely on Shopify's PCI DSS Level 1 certified infrastructure for checkout.
No system is perfectly secure, and we won't claim otherwise. If a breach ever affects your personal information, we will notify you and the relevant regulator within the timeframes the law requires.
14. Changes to this policy
If we make a material change we'll update the date at the top and, for significant changes, email anyone on our list. Continuing to use the site after a change means you accept the updated policy.
15. Contact
Privacy questions and rights requests: thebravekids.ok@gmail.com Everything else: thebravekids.ok@gmail.com Postal: Joaquin Garbuyo, 75 Digger St, Cairns North QLD 4870, Australia.