Privacy Policy

1. Who we are and our role

1.1 Brightmode Pty Ltd

Encored is owned and operated by Brightmode Pty Ltd, an Australian company. Our contact details appear at the top of this Policy.

1.2 Two different relationships

Website visitors and general enquiries. When you visit our public websites, request a demo, or email support@encored.com.au, Brightmode is the organisation that decides why and how that personal information is handled.

Retailer Shopify stores using Encored. When a retailer installs Encored on their Shopify store, Encored processes personal information about that retailer’s customers (including people who list Pre-Loved items and people who buy them) in order to provide the Service. In that context:

• the retailer is typically the party that decides why customer data is collected on their storefront and in Shopify; and
• Brightmode / Encored processes that data as a technology provider under the retailer’s Shopify installation, Shopify’s Partner and API requirements, and the retailer’s instructions as reflected in the Service.

If you are a customer of a retailer that uses Encored, you should also read that retailer’s privacy policy and Shopify’s privacy materials. Questions about a specific order, listing, or store-credit balance are usually best directed to the retailer first.

1.3 Shopify

Encored is a Shopify app. Shopify Inc. and its affiliates provide the commerce platform. Shopify’s own privacy practices apply to data Shopify holds as platform provider. Encored receives data from Shopify APIs, webhooks, and customer-account or admin sessions only as needed to run Pre-Loved workflows.

2. Scope

This Policy applies to personal information we handle about:

• visitors to Encored websites;
• prospective and current retailer contacts (merchants, staff, partners);
• end customers of retailers using Encored, where that information is processed through the Service (sellers of Pre-Loved items, buyers of Pre-Loved items, and related staff);
• job applicants or contractors who contact us (if applicable).

It does not govern websites, apps, or payment systems operated solely by third parties (for example Shopify Admin itself), except to the extent we receive data from them for Encored.

3. Australian privacy framework

Brightmode is based in Australia. We handle personal information in accordance with the Australian Privacy Principles (“APPs”) in the Privacy Act 1988 (Cth), and with other applicable laws where they apply (including, for some Shopify compliance workflows, requirements that Shopify places on apps regarding customer data deletion and access requests).

If the Australian Privacy Principles do not apply to a particular activity because of a small-business or other exemption, we still aim to handle personal information fairly, securely and for the purposes described in this Policy.

4. Personal information we collect

The categories below depend on how you interact with us.

4.1 Website and marketing

We may collect:

• identity and contact details (name, email address, phone number, company name, role);
• enquiry content and correspondence;
• technical and usage data (IP address, browser type, device type, pages viewed, approximate location derived from IP, referring URL, and similar logs);
• cookie or similar technology data where used on our websites (see Section 10).

4.2 Retailer accounts and staff (Service)

When a retailer installs or uses Encored we may collect:

• shop domain and Shopify shop identifiers;
• staff identity from Shopify (for example Shopify user id, display name, email where provided by Shopify session data);
• role and permission assignments configured in Encored;
• Shopify plan and default-currency information, shipping-access and carrier-service verification status, onboarding progress and saved shipping configuration;
• billing and commercial records related to Encored fees, including Shopify App Pricing subscription status and verification, sale and order references, usage values and reporting status, refund adjustments, billing currency, saved conversion information where relevant, and related reconciliation and audit records;
• support tickets, configuration choices (pricing formula, shipping provider, notification templates, inspection and shipping windows), and audit events generated by staff actions;
• retailer agreement acceptance records, including the shop, accepting staff identifier, email where available, acceptance time and agreement version, together with associated audit records.

Retailer agreement acceptance, approval of Shopify permissions and a seller’s acceptance of listing terms are separate records serving different purposes. None is blanket consent to unrelated marketing. Encored does not receive full payment-card credentials through these app-billing workflows.

4.3 End customers — sellers (Pre-Loved listing)

To let a verified purchaser list an item for Pre-Loved resale, Encored may process:

• Shopify customer identifiers and profile fields needed to authenticate the seller and load eligible purchases (such as name, email, and phone where available from Shopify);
• order and line-item provenance (order and line identifiers, purchase history metadata needed to prove eligibility — paid, fulfilled, delivered physical goods);
• listing content supplied by the seller (condition grade, condition and damage answers, optional wear description, optional note, asking price, ship-from address in Australia);
• seller condition photographs uploaded to Encored (front, back, damage and similar slots);
• shipping-label and fulfilment state for sold items (tracking numbers, label documents we store for print, shipment and inspection status);
• dispute and rating information related to sales;
• emails Encored sends to sellers on behalf of the retailer’s program (for example listing live, item sold with label link, dispute opened), including message content and delivery history;
• listing versions, changes, the accepted seller-terms version and records linking the applicable retailer-configured dispatch window and deadline to the listing and sale.

The current listing flow does not ask a separate cleaning question. Earlier cleaning answers may remain in historical listing or audit records, subject to Section 8.

Depending on the retailer’s theme configuration, Encored can display a seller’s first name, last initial, rating and sales count on the public storefront. This information is visible to storefront visitors where the retailer enables the seller-profile display.

4.4 End customers — buyers (Pre-Loved purchases)

When a Pre-Loved item sells, Encored may process:

• Shopify order identifiers and line items for Encored SKUs;
• shipping destination address and contact details from the Shopify order, used to buy or prepare shipping labels and to support fulfilment;
• payment and refund signals received via Shopify webhooks as needed for sale lifecycle, overdue cancellation, and credit eligibility;
• buyer dispute reasons submitted during the inspection window;
• buyer ratings of the seller after delivery, used for retailer operations and for public seller-rating displays where enabled by the retailer.

For calculated checkout shipping, Shopify sends a shipping-rate request to Encored. Encored uses the shop identity, product or variant references identifying the Pre-Loved items, quantities, currency and destination country to calculate the retailer-set charge per Pre-Loved item in that shipment. Shopify’s request can include fuller address and contact details, even though this calculation does not need them.

The shipping-rate callback processes the request temporarily and does not persist or log customer addresses or the request payload. This statement applies only to that callback. Order fulfilment and label creation separately process and retain the shipment and contact details needed to deliver the order, as described elsewhere in this Policy.

4.5 Photos and media

Seller photos are stored in Encored-controlled object storage. Original uploads are kept in private quarantine while checks and processing take place. These originals may contain embedded metadata, such as EXIF information or location data. Removing metadata from a published copy does not remove it from the privately stored original.

Before publication, Encored creates a processed copy with EXIF and location metadata removed. Accepted copies may be uploaded to Shopify for storefront delivery and display. Current-condition seller photos appear in a separate public seller-photo gallery when the retailer includes the relevant storefront block. Original catalogue images remain separate and are handled as native Shopify product media under the retailer’s store.

Seller photographs, relevant product details and reference product images are also shared with OpenAI for content-safety and product-matching checks, as explained in Sections 6.3 and 13. Retention criteria for originals, rejected uploads and published copies are described in Section 8.2.

4.6 Shipping credentials

If a retailer connects Australia Post, ShipStation, Starshipit, or uses Shopify Shipping through Encored, we may store account connection metadata and encrypted API credentials or secrets needed to purchase labels. Postage is charged to the retailer’s carrier or Shopify Shipping account — Encored does not pay postage on the retailer’s behalf.

4.7 Information we do not intentionally collect

We do not require government identity documents for the core Pre-Loved loop. We do not intentionally collect sensitive information (as defined in the Privacy Act) unless a person voluntarily includes it in free-text fields (for example a dispute description). Please do not include health, racial, religious, or other sensitive details unless necessary.

We do not use Encored to take cash payouts to sellers; payout is Shopify store credit issued through the retailer’s Shopify store.

4.8 How we collect information

We collect personal information:

• directly from you (forms, email, customer-account extensions, staff console);
• from Shopify APIs, Admin and Customer Account sessions, and webhooks when a retailer installs Encored;
• from carriers or label providers when purchasing labels under a retailer’s connected account;
• from email delivery providers when sending transactional program emails;
• automatically through logs and security tooling.

If you provide personal information about someone else, you must have the authority to do so and ensure they are aware of this Policy where required.

4.9 Optional resale reminders

Where the retailer enables this feature, customers can opt in when purchasing an item to receive a later email reminder to resell it. Encored records the opt-in preference, customer email address and name where provided, the relevant order and purchased item, the scheduled reminder date, and sending or delivery status.

The subscription preference is shared with Shopify and associated with the relevant purchase. We use these records to schedule and send the requested reminder on the retailer’s behalf. Customers can request withdrawal of their opt-in as described in Section 9.2.

5. Purposes of collection and use

We collect and use personal information to:

5.1 Provide and operate the Service

• verify eligible purchases and prevent duplicate listing of the same unit;
• run the listing wizard, staff review, retailer-configured automatic approvals, publication to Shopify, and sale lifecycle;
• check seller photographs for content safety and whether they match the relevant product and required photo type;
• calculate retailer-set per-item Pre-Loved shipping charges in response to Shopify checkout requests;
• generate or retrieve shipping labels, tracking, and fulfilment updates for Pre-Loved sales;
• run inspection windows, disputes, ratings, seller blocks, and store-credit readiness;
• check retailer setup requirements, including Shopify plan, default currency and shipping access, and save onboarding progress and shipping settings;
• maintain Encored’s fee ledger, verify Shopify App Pricing subscriptions, report usage, reconcile refund adjustments and retain supporting financial and audit records;
• send retailer-configured transactional emails related to listings and sales, and optional resale reminders where customers have opted in;
• isolate each retailer’s data (shop-scoped tenancy and access controls).

5.2 Support retailers and improve reliability

• provide customer support and troubleshoot incidents;
• monitor uptime, security, abuse, and error rates;
• maintain audit logs for significant staff and system actions, including retailer agreement acceptance and changes to program settings;
• develop and improve Encored features (using aggregated or de-identified information where practical).

5.3 Websites and business operations

• respond to enquiries and demos;
• operate, secure and improve our websites;
• meet legal, accounting, insurance and regulatory obligations;
• enforce our terms and protect our rights, users and the public.

5.4 Legal bases and consent (where relevant)

In Australia we generally handle personal information where it is reasonably necessary for our functions and activities, where required or authorised by law, or with consent where consent is needed. Where overseas laws require a specific lawful basis (for example consent or contract), retailers and Shopify’s platform terms may also govern the underlying customer relationship.

You may withdraw consent where processing is based on consent, without affecting earlier lawful processing. Withdrawal may mean some features cannot be provided. Retailer agreement acceptance records document the agreement accepted; Shopify permission approvals authorise the relevant platform access; seller listing-term records document the terms accepted for a listing. These do not replace a separate opt-in where consent to optional reminders or unrelated marketing is required.

6. Disclosure of personal information

We may disclose personal information to:

6.1 The retailer

Staff with Encored permissions can see seller and sale information needed to run the Pre-Loved program (listings, photos, shipping status, disputes, ratings, credit state). The retailer’s own staff policies apply to their use of that access.

6.2 Shopify

Order, customer, product, fulfilment, store-credit and related platform operations occur in or through Shopify. Encored writes and reads Shopify resources as required for the Service. This includes receiving checkout shipping-rate requests and returning calculated Pre-Loved charges. This calculation does not introduce a separate external rate-quoting provider; label creation and carrier sharing remain separate, as described in Section 6.4.

Where Shopify App Pricing is enabled, Encored exchanges shop and subscription information with Shopify to verify the retailer’s plan and sends usage values and refund adjustments with the event and reconciliation information needed to administer app billing. Encored retains linked sale and order references and relevant conversion information for reconciliation. The billing event’s usage attributes do not include customer names, email addresses or customer identifiers. Shopify manages the retailer’s app-billing approval and charges; these workflows do not provide Encored with full payment-card credentials.

6.3 Service providers (processors)

We use service providers to host and operate Encored. Depending on configuration, these include:

• cloud application hosting, databases and queue/cache infrastructure, including Render;
• object storage for media and privacy exports, including Cloudflare R2;
• email delivery, including Resend;
• OpenAI for automated photo-safety and product-matching checks;
• Formspree for public website forms, including demo requests;
• Google Analytics for optional public website analytics, where enabled and permitted by the visitor;
• error monitoring and security tooling;
• professional advisers (lawyers, accountants) under confidentiality.

For photo checks, Encored sends seller photographs, relevant product details (such as the product title and variant information) and reference product images to OpenAI. These checks help identify unsafe content, incorrect photo types and images that do not appear to match the purchased product. An automated result can prevent a photo from being accepted or leave it pending further checks. See Section 13 for the decisions and customer contact options.

OpenAI’s handling and retention depend on the API service, applicable provider terms and account settings. We do not represent that photo-check data has zero retention. The provider’s data controls are linked in Section 7.

When you submit a public website form that uses Formspree, the information you enter, such as your email address and enquiry details, is sent to Formspree so we can receive and respond to the request. Email providers receive recipient details, message content and delivery information needed to send communications.

Providers process information for the services they supply, subject to applicable contractual and privacy protections. The provider list and available location information appear in Section 7.

6.4 Carriers, shipping platforms, buyers and sellers

When a retailer buys labels through Encored, shipment addresses and parcel details are sent to Shopify Shipping and/or the retailer’s connected carrier account (such as Australia Post, ShipStation, or Starshipit) to create labels and tracking.

Sellers can download shipping labels for their sold items. These labels disclose the buyer’s delivery details, including their name and address and any contact details included by the shipping provider, so the seller can send the parcel.

Depending on the carrier or label provider, labels and parcels may also show the seller’s sender or return address to the buyer and other people involved in delivery. Buyers and sellers should use these details only for shipping, returns and resolving matters relating to the transaction.

6.5 Legal and safety disclosures

We may disclose information if we reasonably believe it is required or authorised by law, court order, or regulator, or is necessary to protect a person’s safety, investigate fraud or abuse, or establish, exercise or defend legal claims.

6.6 Business transfers

If we undergo a restructure, sale, financing, or acquisition of Brightmode or Encored assets, personal information may be disclosed to advisers and counterparties under confidentiality arrangements, and transferred to a successor that continues Encored under comparable protections.

6.7 No sale of personal information for unrelated marketing lists

We do not sell personal information as a commodity. We do not rent retailer customer lists to unrelated third-party marketers.

6.8 Public storefront visitors

Pre-Loved listing details and seller photographs can be displayed on the retailer’s public storefront. Where the retailer enables the seller-profile display, a seller’s first name, last initial, rating and sales count can also be shown. These details can be seen by people visiting the storefront, not just the buyer of a Pre-Loved item.

7. Cross-border disclosure

Encored is operated from Australia. Some providers store or process personal information overseas, including in the United States. Resend states that stored data is held in the United States, and Formspree states that its services are hosted there. Other hosting, storage, photo-check and platform locations depend on the provider’s infrastructure and our account or deployment settings; an Australian retailer or delivery address does not mean all information stays in Australia.

7.1 Providers and location information

The following links describe providers used by the Service or public website and their location or data-handling arrangements:

• Render — application hosting, databases and queues: locations depend on the region selected for each service. See Render regions.
• Cloudflare R2 — photo and privacy-export storage: locations depend on bucket placement and any configured jurisdiction restrictions. See Cloudflare R2 data location.
• Resend — email delivery: stored data is held in the United States. See Resend security and data handling.
• OpenAI — photo checks: processing and retention depend on the API service and account arrangements. See OpenAI API data controls.
• Formspree — public website form submissions: services are hosted in the United States. See Formspree security.
• Google Analytics — optional website analytics: Google processes information using infrastructure in multiple countries; locations depend on its service arrangements. See Google’s Privacy Policy.

These provider documents describe the providers’ arrangements and do not, by themselves, confirm every setting of Encored’s accounts. We are confirming the remaining account-specific processing locations and will update this section as those details are verified. You can contact support@encored.com.au for available information about the providers handling your data.

7.2 Overseas safeguards and other platforms

Where we disclose personal information to overseas recipients, we take reasonable steps to ensure the recipient handles the information in a way that is consistent with the APPs, unless an exception under the Privacy Act applies (for example the disclosure is required by law or an applicable consent exception is satisfied).

Shopify and carrier platforms may also process data under their own location arrangements and privacy policies. Their independent handling of information is distinct from Encored’s records.

8. Storage, security and retention

8.1 Security measures

We implement technical and organisational measures appropriate to the sensitivity of the information, including:

• encryption in transit for Service traffic;
• encryption of retailer shipping credentials at rest using application-level encryption keys;
• shop-scoped data models and PostgreSQL row-level security for tenant isolation;
• access controls and staff permission roles in the Encored admin;
• stripping of EXIF/location metadata from processed seller-photo copies before publication;
• least-privilege operational practices for production systems;
• logging and monitoring for security and reliability.

No method of transmission or storage is completely secure. Absolute security cannot be guaranteed.

8.2 Retention

We retain personal information only for as long as needed for the purposes in this Policy. Retention is determined by the information’s purpose, the status of the relevant listing, sale or request, security and support needs, and applicable legal requirements:

• Original and rejected photo uploads: retained privately while needed for validation, retries, support, an active dispute or abuse investigation. They are to be deleted when those purposes are complete, unless a documented legal retention requirement applies. Metadata in an original is subject to the same criteria as the original image.
• Published photo copies and listing versions: retained while needed to display or manage the listing and sale, deal with a return or dispute, or maintain a required transaction or audit record. Stored photos and linked records are included in applicable deletion workflows.
• Email content and delivery history: retained while needed to deliver messages, investigate delivery failures, support customers, resolve disputes or demonstrate relevant program communications. Copies held by an email provider are also subject to that provider’s terms and retention arrangements.
• Reminder preferences and purchase references: retained while needed to schedule the opted-in reminder, record its delivery or withdrawal, and handle related support or consent questions.
• Accepted terms, sale, credit and audit records: retained while needed to demonstrate the applicable agreement, operate the retailer’s program, or meet legal, tax, audit and dispute-resolution obligations. This includes retailer agreement versions and staff acceptance records, seller terms and linked dispatch settings, subscription verification, reported usage, refund adjustments and saved billing-conversion information. Onboarding and shipping-configuration history is retained while needed to operate the installation, troubleshoot setup or maintain a necessary audit record. An active installation or uninstall wind-down may also require some records to be retained.
• Privacy-request exports: encrypted copies hosted by Encored expire after seven days, as explained in Section 8.3. This does not expire copies already downloaded by authorised staff.
• Backups: residual copies may remain after deletion from primary systems until replaced or removed through backup rotation. Their retention is limited by recovery needs, the applicable backup configuration and any legal retention requirement; deletion from the active system does not necessarily immediately remove every backup copy.

When information is no longer required, we take reasonable steps to destroy or permanently de-identify it. A documented legal retention requirement can delay deletion. No single retention period applies to every category, and we do not promise that all provider or backup copies are deleted immediately.

8.3 Shopify privacy requests, exports and deletion

Encored subscribes to Shopify’s mandatory privacy compliance topics for customer data requests, customer redaction and shop redaction. These workflows identify linked Encored records using the relevant shop, customer and order information.

For a customer data request, Encored prepares an export of linked information. Export files are encrypted while stored by Encored and are available for seven days. Only authorised retailer staff with the required export permission can download them through the authenticated app. The download supplies a decrypted copy for the retailer to handle securely and provide to the customer where appropriate. Download access is logged; the expiry of the hosted export does not delete copies the retailer has downloaded.

Deletion requests remove or de-identify linked Encored records and stored photographs, including associated app-managed media where the workflow can identify it. This may cover listing and sale records, contact details, communications and other linked operational records. A documented legal retention requirement may prevent or delay deletion of affected information until that requirement ends.

These workflows concern information Encored holds or manages. They do not automatically erase information independently retained by Shopify, the retailer, shipping providers or other parties under their own obligations and policies. Requests about those records may need to be directed to the relevant organisation. You can also contact us as described in Section 9.

9. Access, correction and your choices

9.1 Access and correction (APP 12 and APP 13)

You may request access to personal information we hold about you, or request correction of inaccurate, out-of-date, incomplete, irrelevant or misleading information.

End customers of a retailer: please contact the retailer first for storefront account, order, and store-credit matters. You may also contact us at support@encored.com.au and we will help where the request relates to data Encored holds and where we are able to verify your identity and authority.

Retailers and website visitors: contact support@encored.com.au.

We may refuse access in limited circumstances permitted by the Privacy Act (for example where providing access would unreasonably impact another person’s privacy). If we refuse, we will explain why unless it is unreasonable to do so, and outline available complaint avenues.

9.2 Marketing and optional resale reminders

Encored’s core emails to sellers are transactional program messages about listings and sales. Optional resale reminders are sent where a customer opted in for the relevant purchase; purchasing an item alone does not constitute that opt-in.

To request withdrawal of a resale-reminder opt-in, contact the retailer or email support@encored.com.au, identifying the store and relevant purchase so the request can be matched to the reminder record. We will coordinate with the retailer to action the request. Withdrawal does not affect information already lawfully processed or necessary transactional communications.

If you receive optional Encored marketing emails from us directly, you can unsubscribe using the link in the message or by emailing support@encored.com.au.

9.3 Cookies and similar technologies

See Section 10.

9.4 Account controls

Sellers and buyers primarily manage identity and contact details through Shopify customer accounts and the retailer’s store. Retailer staff manage Encored access through Shopify staff accounts and Encored roles.

10. Cookies and website analytics

Our websites may use cookies, local storage, pixels, or similar technologies to:

• keep the site secure and functioning;
• remember preferences;
• understand aggregate traffic and performance;
• support marketing attribution where enabled.

Where Google Analytics is configured on our public website, we load it only after you select “Allow analytics”. We record your choice in local storage. You can change it using “Analytics preferences” in the footer; declining stops further analytics collection on the site. This does not delete information already collected by Google.

Our analytics events measure page visits, broad referral categories (including recognised AI services), walkthrough steps, calculator use and successful enquiry submissions. They exclude the content of your enquiry, contact details entered in our forms and calculator figures. Our page identifiers exclude URL query strings and fragments, and we retain a broad referral category in session storage to attribute visits across pages.

Google Analytics may also process technical information such as browser and device information, network information and cookie identifiers under Google’s policies. Optional analytics is not required to use our website or submit an enquiry.

You can control cookies through your browser settings. Blocking some cookies may affect site functionality. Third-party analytics or embedded content (if used) are subject to those providers’ policies.

The Shopify-embedded Encored admin and customer-account extensions also rely on Shopify session and platform technologies outside our sole control.

11. Children

Encored is intended for retailers and adult consumers participating in retail commerce. We do not knowingly collect personal information from children under 15 for Encored marketing. If you believe a child has provided personal information to us inappropriately, contact support@encored.com.au and we will take reasonable steps to delete it.

Retailers are responsible for age-related legal requirements on their own storefronts.

12. Third-party links and apps

Our websites or documentation may link to third-party sites (including Shopify). Those sites are not controlled by Brightmode. Their privacy practices are their own. Review their policies before providing personal information.

13. Automated decisions

13.1 Information used and possible outcomes

Encored uses retailer-configured rules and automated checks, including AI-assisted photo checks, to operate the Pre-Loved program. Depending on the workflow, these can make a decision automatically or provide information that substantially informs a retailer’s decision:

• Purchase eligibility: customer and purchase identifiers, payment, fulfilment and delivery status, product information and previous listings can determine whether a purchased item is available to list or prevent a duplicate listing.
• Photo checks: seller photographs, the requested photo type, product details and reference product images are used for content-safety and product-matching checks. A photo can be accepted, rejected or left pending because a result is uncertain or a check cannot be completed. A rejected or pending photo can prevent the listing from progressing or being published.
• Automatic listing approval: retailer-configured rules may use asking price and the suggested price, condition or damage answers, previous successful sales, seller restrictions, open disputes and photo-check results. A submitted listing may be approved and progress to publication without an individual staff approval, or remain for retailer review when the rules or required checks are not satisfied.
• Pricing suggestions and limits: verified original retail recommended retail price (RRP), purchase provenance, condition and damage answers, and retailer pricing settings can produce a suggested resale price and constrain an asking price. Where a retail purchase has no verified RRP, its verified amount paid may be used as the asking-price limit. Repeat resale without the required original RRP can be blocked rather than using the previous Pre-Loved price. The price reference shown on the storefront may differ from the RRP used for these checks.
• Dispatch, refunds and store credit: the configured dispatch deadline and accepted seller terms, shipment and tracking events, inspection windows, payment and refund signals, and dispute status can trigger overdue-sale cancellation and a buyer refund, prevent credit for a cancelled sale, or determine when store credit is ready to be issued. The dispatch period starts when the item sells. Records of the applicable terms and dispatch settings support these checks.
• Retailer setup and billing: shop plan, default currency, granted shipping access, carrier-service status and verified subscription information can determine whether shipping verification, plan approval or a new seller submission may proceed. Paid-sale and refund records, saved conversion information and billing-period status can produce usage reports or refund adjustments, or leave an exception for review.

13.2 Questions about an outcome

Automated checks can produce incorrect or incomplete results. If you believe an eligibility, photo, approval, pricing or sale outcome is wrong, contact the retailer and identify the affected item, listing or order. Authorised retailer staff can investigate within the controls available to them; providing further information or a replacement photograph may be needed. You can also contact support@encored.com.au about Encored’s processing or a technical issue. Contacting us does not guarantee that an outcome will be changed or that a failed safety check can be bypassed.

13.3 Transparency obligations

From 10 December 2026, additional automated-decision transparency requirements under the Privacy Act apply where the relevant statutory conditions are met, including where personal information is used in automated decisions that could reasonably be expected to significantly affect an individual’s rights or interests. This section explains the information and workflows involved; the retailer’s privacy notice should also address automated decisions it arranges through its program. See the OAIC’s APP 1 guidance.

14. How to contact us and complaints

14.1 Contact

Brightmode Pty Ltd trading as Encored
Email: support@encored.com.au
Post: PO Box 5088, Bentleigh East, Victoria 3165, Australia

Please include enough detail for us to identify you and the issue. We may need to verify your identity before responding.

14.2 Complaints

If you have a privacy complaint, email support@encored.com.au with “Privacy complaint” in the subject line. We will acknowledge and investigate in a reasonable time.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):

• Website: https://www.oaic.gov.au
• Phone: 1300 363 992

15. Changes to this Policy

We may update this Privacy Policy from time to time to reflect product, legal or operational changes. The “Last updated” date at the top will change when we do. Material changes may also be notified via our website, retailer communications, or the Shopify app listing where appropriate. Continued use of the websites or Service after an update means you accept the revised Policy to the extent permitted by law.

16. Shopify permissions and App Store summary (for merchants)

For merchants evaluating Encored on the Shopify App Store, in plain terms Encored may access protected customer data (such as name, email and address) and order data needed to:

• verify that a customer owns an eligible purchased unit before listing;
• create Pre-Loved products and process Pre-Loved sales;
• prepare ship-from / ship-to labels for peer-to-peer style fulfilment under the retailer’s postage account;
• support inspection, disputes, ratings and store-credit workflows;
• check seller photographs for content safety and product matching, and apply retailer-configured listing rules;
• email sellers about listing and sale events using retailer-configured templates, and send resale reminders where customers have opted in.

Data is shop-scoped. We do not use merchant customer data to advertise Encored to those customers independently of the retailer’s Pre-Loved program messages described above.

16.1 Required Shopify scopes

A Shopify scope is a permission that lets Encored read or update particular information in Shopify. Encored’s required permission set contains 21 scopes. The table below explains why each is needed. Optional shipping access is explained separately in Section 16.2; the permissions available to a particular installation depend on its Shopify app version and the grants approved through Shopify.

These permissions support the purposes described in this Policy. The table supplements the explanations of disclosures (Sections 6 and 7), retention (Section 8), access and correction (Section 9), and complaints (Section 14).

16.2 Optional shipping access

Encored also requests the optional Shopify permission write_shipping for calculated-rate checkout shipping. It is used to register or update Encored’s calculated-rate service and manage its app-owned Pre-Loved shipping profile and associated product assignments.

This permission is approved separately through Shopify. Without the grant, a new installation cannot complete the shipping-verification step for this workflow. The permission does not itself enable a shipping charge, create a new service provider, or authorise unrelated use of customer information. Retailer agreement acceptance, Shopify permission approval and seller listing-term acceptance remain separate.

17. Entity details

If you need our ABN or a signed data processing addendum for enterprise onboarding, contact support@encored.com.au.

© Brightmode Pty Ltd. All rights reserved.