Privacy Notice
Last updated: May 18, 2026
1. Who we are
Bowlful is operated by R R Hertel Enterprises (ABN 14 406 236 920) ("Bowlful", "we", "us"), based in Australia. We are the entity responsible for personal information collected through bowlful.org and our related tools, and we handle that information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You can reach us at hello@bowlful.org.
2. What we collect and why
| Category | Purpose | Legal basis |
|---|---|---|
| Email address | Send your meal-plan PDF, account/login links, transactional receipts, and (with consent) the newsletter | Contract; consent for marketing |
| Pet details (species, breed, weight, age, activity) | Generate the calorie calculation and meal-plan PDF you requested | Contract |
| Account credentials (if applicable) | Authenticate you and protect your account | Contract; legitimate interests (security) |
| Subscription status and plan ID | Entitle you to paid downloads | Contract |
| Device, browser, IP address, usage analytics | Site security, abuse prevention, debugging, and product improvement | Legitimate interests |
| Support correspondence | Help you and keep a record of the conversation | Legitimate interests |
Payment card data is collected directly by Paddle (see below). We never see or store your full card number.
3. Who we share data with
- Paddle.com Market Limited — our Merchant of Record. Paddle processes sales, subscriptions, payments, invoicing, tax compliance, refunds, and chargebacks. See the Paddle Privacy Policy.
- Hosting and database providers (Cloudflare, Supabase) — to run the site and store your data.
- Email delivery providers — to send transactional and (where you opted in) marketing emails.
- Analytics providers — aggregated, privacy-respecting analytics only.
- Professional advisers (legal, accounting) when reasonably necessary.
- Authorities when required by law, court order, or to protect rights, safety, or property.
We do not sell your personal data.
4. Overseas disclosure
Some of our service providers (including Paddle, Cloudflare, and Supabase) store or process personal information outside Australia, including in the United States, the United Kingdom, and the European Union. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual safeguards such as Standard Contractual Clauses.
5. How long we keep it
Account and subscription records: for the life of your account plus up to 7 years to meet tax and accounting obligations. Lead-only emails (people who downloaded a free plan but never bought): up to 24 months of inactivity, then deleted. Support tickets: 3 years. Analytics logs: typically 90 days. Backups are overwritten on a rolling basis.
6. Your rights
Under the Australian Privacy Principles you have the right to request access to the personal information we hold about you and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant, or misleading. You may also withdraw consent to marketing at any time by using the unsubscribe link in our emails or by emailing us. If you are based in the UK, EEA, or another jurisdiction with additional rights (such as erasure, restriction, objection, or portability), we will honour those rights where they apply. To exercise any right, email hello@bowlful.org; we aim to respond within 30 days.
If you are not satisfied with how we have handled your personal information or a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992. Customers in other jurisdictions may also contact their local data-protection authority.
7. Security
We use appropriate technical and organisational measures — encryption in transit (HTTPS), encrypted storage, scoped access controls, and regular review of vendor security. No system is 100% secure; we encourage you to use a strong, unique password.
8. Cookies
We use a small number of strictly-necessary cookies to keep you signed in and remember your preferences, plus aggregated analytics cookies to understand how the site is used. You can manage cookies via your browser settings; blocking essential cookies may break parts of the Service.
9. Children
The Service is not directed to children under 16 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we'll delete it.
10. Changes
We may update this notice. Material changes will be posted here with a new "Last updated" date.
11. Contact
R R Hertel Enterprises (ABN 14 406 236 920), Australia · hello@bowlful.org