Privacy policy

Who we are

Kerbo is an online grocery service for shops in Box Hill Central, run by the business that operates Kerbo in Australia. Contact us at (contact email to be published before launch).

What we collect

When you order: your mobile number, delivery address (for delivery), your choices (time slot, out-of-stock preference, how we send updates) and what you bought.

If you create an account: your email and the name and profile picture your sign-in provider (Google, Facebook or Kakao) shares, and the details you save.

We do not see or keep your card details: payments are handled by Stripe.

How we use it

To prepare, pack and deliver your order, tell you about its progress, give refunds, and keep records shops are paid from.

To give the first-order discount once per mobile number or account, and to prevent misuse.

Who we share it with

Shops see only your order number, time slot and the items from their shop, not your phone or address.

The hub store packs your order and sees the same; couriers get your address and mobile number to deliver.

Service providers that run Kerbo for us: Stripe (payments), Supabase (database, in Australia), Vercel (website), and the email and messaging services we use to send updates. We do not sell your information.

How long we keep it

Order records are kept for at least 7 years for tax and accounting. Account details are kept until you delete your account.

Your choices

You can see and change your saved details in My account, and delete your account there at any time. Past orders stay for the shops' and tax records but are no longer linked to you.

To ask what we hold about you, to correct it, or to make a complaint, email (contact email to be published before launch). If you are not happy with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Data deletion (Facebook, Google, Kakao sign-in)

To delete the data we received from your sign-in provider, open My account and tap “Delete my account”, or email (contact email to be published before launch) and we will delete it within 30 days.