Privacy Policy
This policy explains what personal information Leanly Journey collects, why it is collected, who it is shared with and what control you have over it. It is written to be read rather than to be skimmed past, because a privacy policy nobody understands protects nobody. It applies to leanlyjourney.au and to every order placed through it.
Last reviewed: August 2026.
Table of contents: Privacy Policy
- Who we are
- What we collect
- Why we collect it
- Cookies and tracking
- Who your information is shared with
- Payment information
- How long we keep it
- How it is protected
- Your rights under Australian law
- Asking for your data
- Marketing and unsubscribing
- Children and age
- Overseas disclosure
- Changes to this policy
- Privacy questions and answers
Who we are
Leanly Journey is an online retailer selling vaping, THC and CBD products to customers in Australia through leanlyjourney.au. When this policy says we, us or our, it means the operator of that store. When it says you, it means anyone who visits the site, places an order, contacts us or subscribes to email.
You can reach us about anything in this policy through the contact page. Privacy requests are handled through that same route, and there is a section below explaining exactly what to send so a request can be actioned quickly.
What we collect
We collect three broad kinds of information, and it is worth separating them because people often assume a store knows far more than it does.
Information you give us directly. When you place an order this includes your name, delivery address, email address and phone number if you supply one. When you create an account it includes your username and the password you set, which is stored in hashed form and is not readable by us. When you contact us it includes whatever you choose to put in your message. When you subscribe to email it includes your email address.
Information collected automatically. Like almost every website, our server records technical details of visits: IP address, browser type and version, device type, operating system, the pages viewed, the time of the visit and the page that referred you. This is standard web server and analytics data and is not tied to your name unless you are logged in.
Information from your order history. Once you have ordered, the record of what you bought and when sits against your account so you can see it in the My Account area and so we can handle any later query about that order.
We do not collect information about your health, and you should not send us any. We are a retailer, not a clinician, and a message describing a medical condition tells us something we have no proper use for. If you have a health question, the healthdirect service is the right place for it.
Why we collect it
Each category above exists for a specific reason.
Order information exists so an order can be taken, packed, addressed and delivered, and so we can answer a question about it afterwards. Without a delivery address a parcel cannot be sent, and without a way to reach you we cannot tell you if something has gone wrong.
Account information exists so you can log in, see your history and reorder without retyping everything.
Technical information exists so the site can be kept working, so abuse and fraud can be detected, and so we can see which pages are useful and which are not. A store that cannot see that a checkout step is failing cannot fix it.
Email subscription information exists only because you asked for it, and only for as long as you want it.
We do not sell your personal information. We do not trade mailing lists. If that ever changed, this policy would change first and you would be told.
Cookies and tracking
Cookies are small files a site stores in your browser. This site uses them for a few distinct purposes.
Strictly necessary cookies make the store work at all. They remember what is in your basket between pages and keep you logged in during a session. Blocking these breaks checkout, which is why they cannot be switched off and still leave a working shop.
Preference cookies remember choices such as recently viewed products so the site behaves consistently as you move around it.
Analytics cookies count visits and show which pages are read and where people leave. This is aggregate information about patterns rather than surveillance of an individual.
You control cookies from your browser. Every major browser lets you view what is stored, delete it and block future cookies, either entirely or per site. Doing so for this site will stop the basket working, so if you block cookies and then cannot check out, that is the cause.
Who your information is shared with
Your information goes to the smallest number of parties needed to actually deliver what you ordered.
Delivery carriers receive the name and address on the parcel, because a parcel cannot be delivered otherwise. They receive nothing about what is inside beyond what any consignment requires.
Payment processors handle the payment itself. See the payment section below, because this one matters more than people expect.
Service providers that run parts of the site, such as hosting, receive whatever is technically necessary for that service and nothing more.
Law enforcement or regulators where we are legally required to disclose something. We would comply with a lawful request. We would not hand over customer information to anyone who simply asked.
That is the complete list. Your details are not shared with advertisers, data brokers or other retailers.
Payment information
This section deserves its own heading because it is the part customers worry about most.
Card numbers are handled by the payment processor, not by this store. We do not receive your full card number, we do not store it, and we could not retrieve it if you asked us to. What comes back to the store is confirmation that a payment succeeded or failed, and a reference for that transaction.
This is why a question like what card did I pay with cannot be answered from our side beyond what appears on your order confirmation, and why the descriptor that shows on your bank statement is set by the processor rather than by us. If that descriptor matters to you, ask through the contact page before ordering.
How long we keep it
Order records are kept for as long as is needed to run the business and to meet record keeping obligations, which for commercial and tax records in Australia is a period of years rather than months. That means an order record generally outlives an account, because deleting the record of a completed sale is not something a business is free to do at will.
Account details are kept while the account exists. Email subscription details are kept until you unsubscribe. Technical logs are kept for a much shorter period, long enough to be useful for security and diagnostics.
Where information no longer has a purpose and no obligation requires it, it is deleted or de-identified.
How it is protected
The site is served over HTTPS, so traffic between your browser and the store is encrypted in transit. Passwords are stored hashed rather than in readable form. Administrative access is limited to those who need it.
No system is perfectly secure and any business claiming otherwise is overselling. What we can say honestly is that the sensitive part, your card number, is not held here at all, which removes the single most valuable target a store like this could hold.
You also control part of this. Use a password you do not reuse elsewhere. Most account compromises come from a password leaked from a completely unrelated site.
Your rights under Australian law
Australian privacy law gives you real, enforceable rights over information held about you. The key ones are the right to know what is held, the right to have inaccurate information corrected, and the right to complain if a business mishandles it.
The Office of the Australian Information Commissioner is the regulator and publishes plain English guidance on those rights, including how to make a complaint if you are not satisfied with how a business has responded. If you think we have got something wrong, raise it with us first through the contact page, because most issues are a misunderstanding that can be fixed in one exchange. If that does not resolve it, the OAIC is the next step and we would not stand in the way of it.
Your consumer rights, which are separate from privacy rights, are set out by the ACCC.
Asking for your data
To ask what is held about you, to correct it, or to ask for it to be deleted, send a request through the contact page.
Send it from the email address associated with your orders if you can. That single detail is what lets a request be verified as genuinely yours, and without it we have to ask for something else that proves it, which slows everything down. Say plainly which of the three you want: to see the data, to correct it, or to have it removed.
Where a deletion request covers information we are required to retain, such as the record of a completed sale, we will say so and explain what can be removed and what cannot, rather than quietly doing half of it.
Marketing and unsubscribing
Placing an order does not automatically add you to a marketing list. If you did subscribe, every message carries an unsubscribe link, and using that link takes effect without needing to contact anyone. It is the fastest route and it always works.
Transactional messages are different from marketing. An order confirmation or a dispatch notice is part of the service you bought, so those continue for an order in progress even if you are not subscribed to anything.
Children and age
This store sells adult products and is not intended for anyone under the legal age in their state or territory. We do not knowingly collect information from children. If you believe a minor has provided information to this site, contact us and it will be removed.
More detail on age requirements is on the age verification policy.
Overseas disclosure
Some service providers used to run a modern website, such as hosting and email infrastructure, may store or process data on servers outside Australia. This is normal for almost every Australian online business and is not something a small retailer can avoid. Where that happens, the provider is bound by its own contractual and legal obligations regarding that data.
Changes to this policy
If this policy changes, the revised version is published on this page and the review date at the top is updated. Material changes will be genuinely material, not a quiet rewrite of what we do with your data. Checking this page occasionally is worthwhile if privacy matters to you.
Privacy questions and answers
Do you store my credit card number?
No. Card details are handled entirely by the payment processor. The store never receives your full card number and could not produce it if asked.
Will placing an order sign me up to marketing email?
No. Ordering does not subscribe you to anything. If you did subscribe separately, every message carries an unsubscribe link that works immediately.
Can I ask you to delete everything you hold about me?
You can ask, and most of it can be deleted. Records of completed sales generally have to be retained for a period under Australian record keeping obligations, so we will tell you exactly what can go and what has to stay rather than doing it silently.
What does the delivery carrier know about my order?
The name and address on the parcel, which is what is needed to deliver it. Packaging is deliberately plain and does not describe the contents.
What shows up on my bank statement?
The descriptor is set by the payment processor rather than by us. If it matters to you, ask through the contact page before you order.
Who do I complain to if I am unhappy with your answer?
Raise it with us first through the contact page. If that does not resolve it, the Office of the Australian Information Commissioner handles privacy complaints and publishes guidance on making one.
Do you use cookies I can turn off?
Analytics and preference cookies can be blocked from your browser. The strictly necessary ones that hold your basket and session cannot be blocked while still leaving a working checkout.
Related reading: the terms and conditions cover the rules of buying here, the returns and refunds policy covers what happens when something goes wrong, and the FAQ answers the practical questions about ordering.
Our position on privacy policy is simple: publish what is true, hold what we list, and ship it quickly.
Questions about privacy policy are welcome at any point. Our team answers specification queries directly and quickly.
If anything about privacy policy is still unclear, contact us before ordering rather than after. We would rather answer a question than process a return.
For privacy policy we would rather set expectations accurately than promise something we cannot deliver.
Our position on privacy policy is simple: publish what is true, hold what we list, and ship it quickly.
We keep this privacy policy page current because outdated information helps nobody.
People researching privacy policy usually want specifics rather than reassurance, so that is what this page gives.
If you have compared privacy policy elsewhere and something here differs, ask us and we will explain why.
Questions about privacy policy are welcome at any point. Our team answers specification queries directly and quickly.
Our position on privacy policy is simple: publish what is true, hold what we list, and ship it quickly.
We keep this privacy policy page current because outdated information helps nobody.
If anything about privacy policy is still unclear, contact us before ordering rather than after. We would rather answer a question than process a return.
For privacy policy we would rather set expectations accurately than promise something we cannot deliver.
Most questions about privacy policy come down to stock, timing and price, and all three are answered above.
For privacy policy we would rather set expectations accurately than promise something we cannot deliver.
Most questions about privacy policy come down to stock, timing and price, and all three are answered above.
Most questions about privacy policy come down to stock, timing and price, and all three are answered above.
Everything stated here about privacy policy reflects what we actually hold rather than what we could order in.
If anything about privacy policy is still unclear, contact us before ordering rather than after. We would rather answer a question than process a return.
For privacy policy we would rather set expectations accurately than promise something we cannot deliver.
If privacy policy is new to you, start small, read the packaging, and ask before assuming.
Anything on privacy policy that is not covered here is worth an email, and we answer properly rather than with a template.
The practical side of privacy policy matters more than the marketing, which is why this page leads with detail.
Still weighing up privacy policy? Get in touch and we will help you decide before you spend anything.
If you have compared privacy policy elsewhere and something here differs, ask us and we will explain why.
Questions about privacy policy are welcome at any point. Our team answers specification queries directly and quickly.
People researching privacy policy usually want specifics rather than reassurance, so that is what this page gives.