What we do
with your data.

RAPSOC is a student society at UNSW Sydney. This page describes exactly what this website collects, where it goes and how to get rid of it. It covers this site only, not our Instagram, Discord or anything run by Arc or UNSW.

When you buy merch

At checkout we ask for, and store:

• Your name and email address
• A phone number, if you give one (optional)
• Any note you add to the order (optional)
• Your zID, if you tell us you are a UNSW student (optional)
• A delivery address, only if you choose the off-campus hand-off
• What you ordered, the size, the price and the order status

We never see or store your card details. Payment is handled entirely by Stripe on their own checkout page. We receive a payment reference back, nothing more. The charge appears on your statement with RAPSOC in the descriptor.

Your zID is a slight exception worth naming: it is not saved in our database. It travels with the Stripe session and lands in the fulfilment spreadsheet, so we can check student pricing.

When you sign in

Sign-in is Google only. We receive your name, email address, profile picture and whether Google has verified that address. We never see your Google password. A sign-in creates a session that expires after 7 days.

When you post a review

Album reviews, votes and replies are public. Your name and profile picture appear next to whatever you post, visible to anyone who visits the site. Do not put anything in a review you would not want publicly attached to your name.

When you join the mailing list

Just your email address, and only so we can email you about events, drops and merch.

Who else gets your data

Only the services that make the site work:

• Stripe processes the payment
• Neon hosts the database
• Vercel hosts the site
• Google Sheets holds the order list our committee works from
• Resend sends order confirmation emails
• Upstash handles abuse protection, described below

We do not sell your data, we do not share it for advertising, and we do not run advertising or tracking cookies on this site. The only cookie we set is the one that keeps you signed in.

Your IP address

To stop people scripting our checkout, we count recent requests per IP address. Those counters live in Upstash and expire within minutes. Your IP is not written to our database and is not attached to your order or your account.

How long we keep it

Order records are kept while we still need them for fulfilment, refunds and the society’s financial records. Sessions expire after 7 days. Mailing list entries stay until you ask to come off. Reviews stay up until you or we remove them.

Getting your data, or deleting it

Email rapsocunsw@gmail.com and ask. We will tell you what we hold about you, correct it, or delete it. The one thing we cannot always delete is a completed order, because we may be required to keep the financial record. If that applies we will say so.

Who to complain to

Start with rapsocunsw@gmail.com. If we handle it badly, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If this page changes materially we will update the date at the top. Continuing to use the site after that means the new version applies.