What we keep, and what we delete.

Who we are

The Ethical Merchant & Maker Index (EMMI) is operated by SOCii and published at emmi.socii.au. Public sign-in uses Persona by SOCii. A claimed business uses a separate organisation login.

For privacy requests, write to privacy@socii.au. Please use the email address on your Persona or business account so we can match the request to the right record.

Information you give us

If you create a public account, Persona provides your name, email address, and profile image. We keep that account record so you can sign in and, if you choose, start a business claim.

Saved listings are stored in your browser on that device. They are not a profile we publish.

If you write a review, we keep the text, the rating, and any receipt or photo you attach as evidence. Contact details and payment numbers inside that evidence are not placed on the public listing. A review can be held back when it includes threats, personal contact details, or other material our review rules exclude.

Business listings

Most listings begin as research drawn from public sources: business names, websites, places, products, markets, and statements the business has already published. An ABN and the ABN holder’s legal name are shown when we have them.

A listing is not a statement that we have verified every claim on it. Missing evidence stays unknown. It is not treated as a negative finding.

After a claim is approved, the business can edit its public description, website, place, categories, materials, capabilities, market appearances, and products. The ABN and legal name stay as published register facts. Later research updates do not overwrite those owner-edited fields.

Checking that you own the business

“This is my business” asks you to sign in with Persona and then complete a photo-ID check. Stripe Identity collects the document and a matching live selfie. We compare the name on that check with the ABN holder’s name, in memory, at the time of the decision.

If the ABN is held by a person and your Persona email uses the same domain as the business website, that match can approve the claim immediately. Free email hosts such as Gmail, Outlook, Yahoo, iCloud, and BigPond never qualify. A company, trust, or association cannot be matched to a photo ID by name, so those claims wait for a person to review them.

When the check is finished we delete the identity evidence. Stripe is instructed to redact the verification. We do not keep the document, the photograph, the name read from the identity document, or any licence or passport number. We keep only the method used — photo ID, email domain, or both — and whether that method succeeded or failed.

Payments

If you buy with “Buy on EMMI”, Stripe processes the card payment. We store the order: the product, the business, the amount, the platform fee, the currency, and whether the payment succeeded. We do not store your card number.

Payout details for a claimed business are collected by Stripe on the connected account. We store the Stripe account identifier and whether transfers are active. We do not store bank-account numbers.

How we use it

We use this information to:

• publish and correct the public index
• run Persona sign-in and, after a claim is approved, the separate business login
• decide a claim and then delete the identity document
• take payment, deduct the stated fee, and pay the maker
• moderate reviews and keep a record of admin decisions
• protect the service against misuse

Who else handles it

We use service providers to run EMMI. Persona and the business login are provided by Clerk. Payments and the photo-ID check are provided by Stripe. The database is hosted by Convex. Map tiles are requested from the map provider when you open the map, which can see your IP address.

We do not sell personal information. We share it with a provider only so they can perform the service described here, or when the law requires it.

Where it is stored

EMMI is published for people in Australia. Our providers may store or process information in Australia and overseas, including the European Union and the United States. Stripe’s identity check happens on Stripe’s systems and is then redacted.

How long we keep it

Account and order records are kept while the account or the record of the sale is needed, including for tax and dispute handling. Claim records keep the method and the outcome, not the identity document. Review evidence that is only for moderation is not left on the public page.

You may ask us to delete a Persona account. We will delete or de-identify the personal information we can, and we will keep what we still need for a legal obligation, an unresolved payment, or a record of a claim decision.

Access, correction, and complaints

You can ask for a copy of the personal information we hold about you, and you can ask us to correct it, by writing to privacy@socii.au. A claimed business can also correct its public page from the business studio. The ABN and the legal name are register facts and are not edited there.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy, we will update the date at the top. Continued use of EMMI after that date is use under the updated policy.