Privacy Policy
This privacy policy explains what Superhero Universe does with information connected to this website. It describes the site as it works today. Last updated 14 October 2026.
Who we are
Superhero Universe is an independent collectibles store at 2/53 Salisbury Rd, Asquith NSW 2077, Australia. You can call +61 2 9443 5271 or email [email protected]. This website does not publish an ABN, a company number, or opening hours. Superhero Universe is not affiliated with, endorsed by, sponsored by, or officially connected with Marvel Entertainment, Marvel Studios, or The Walt Disney Company, and it is not the manufacturer of Marvel-branded products.
What this policy covers
This policy covers the pages of this website, including Home, Collections, category pages, Collector Guides, Product Details, About, FAQ, Contact, and the legal pages. It covers information you type into a form, names of categories you save in your browser, and the technical requests a page makes when it loads. It does not cover a third-party site you open from a link, and it does not cover your email provider after you send a message from your own mailbox.
Information you choose to give us
The contact form and the product inquiry form ask for a name, an email address, an optional phone number, a product category, an optional product name, an optional subject, and a message. You decide what to type. Please do not put payment card numbers, identity document numbers, or other sensitive information in the message. The site has no field for a card and no checkout.
A short form on the home page and the about page asks only for a name, an email address, and a category. Submitting that form does not send those details by itself. It opens the contact page with those fields filled in so you can add a message and continue.
How an inquiry is handled
When you submit the contact form or the product inquiry form, two things happen on your device. First, the browser stores a copy of the inquiry in local storage under a key used only by this site, and keeps up to twenty recent notes. Second, the browser opens a draft in your email application addressed to [email protected], with the subject and the details you entered. The website does not have its own mail server, and the page does not confirm that the draft was sent or received. If you close the draft without sending it, we do not receive the message.
If you do send the email, your email provider transmits it to that mailbox in the ordinary way. We then have the contents of the email you chose to send, including your address and anything you wrote. We use that correspondence to answer the question, to understand which category you asked about, and to keep a record of the exchange. We do not use it to create a customer account, because this website does not create accounts.
No category bookmark
Cards do not save a category name. There is no “Save category” control and no list of saved categories on the contact page. Opening “View Collectible” only opens another page. It is not an order, a reservation, or a wishlist stored on our servers. Clearing site data is still the way to remove an inquiry copy that a form has stored in this browser.
Inquiries saved in the browser
Saved inquiries can be reviewed and removed on the contact page and on the product details page. Those copies stay on the device where you created them. They are not synced to another computer. Anyone who can use that browser profile can read them, so use a private device if the note contains a personal phone number.
Information we do not collect on the site
The pages do not ask you to create a password. They do not run a shopping cart, and they do not collect card numbers, bank details, or a billing address through a payment form. They do not ask for a date of birth. They do not include a comments system, a review form, or a rating control. The scripts on this site do not set advertising cookies and do not call an analytics product.
Technical data
Because the site is a set of static pages, the scripts included with the site do not send your form text to an application server of ours. If a hosting provider serves the files, that provider may keep ordinary server logs, such as an IP address, the time of a request, and the address of the page requested. We do not operate a separate analytics dashboard on top of those logs. Your browser also stores the local data described above.
Fonts and other requests
Pages request the typefaces DM Serif Display and Rubik from Google Fonts. When a page loads, your browser contacts Google to fetch the font files. Google may process technical information such as the IP address of the request under Google’s own policies. We do not receive a copy of that font request. If you block third-party requests, the pages still work and fall back to other typefaces installed on your device.
Cookies
The scripts written for this website do not set cookies. Local storage is used for saved inquiries, as described above. A full explanation of cookies, local storage, and the Google Fonts request is in the cookie policy.
How we use information
If you email us, we use the message to reply, to identify the category you asked about, and to correct a misunderstanding about what the website does. We do not use inquiries to build a public profile. We do not sell personal information. We do not rent a mailing list. We do not add you to a newsletter, because this site does not run one. We do not use your details for automated decision-making.
Who else may see information
We do not pass form notes to a data broker. An email you send is handled by your email provider and by the provider that hosts the mailbox [email protected]. A font request is handled by Google, as described above. A host that serves the website files may process connection logs. We will also disclose information if the law requires it, for example a lawful request from an Australian authority. We do not disclose information for an unrelated commercial purpose.
Children
The website is written for a general audience of collectors. It is not directed at children under 16, and we do not knowingly ask a child to send personal information. If you believe a child has emailed us, contact [email protected] and ask us to delete that correspondence.
How long information is kept
A note in local storage remains until you remove it, until you clear site data, or until the browser removes stored data for this site. We do not set an expiry inside the script. An email you send is kept for as long as we need it to answer you and to keep a record of what was asked, and then it can be deleted from the mailbox. We do not promise a fixed number of days, because the site does not run an order system with a set retention schedule.
Your choices
You can browse every public page without submitting a form. You can refuse to send the email draft. You can delete saved inquiries with the button on the product details page. You can clear local storage in your browser settings. You can ask us, by email or by phone, what correspondence we still have from you and ask us to delete it. You can block Google Fonts in your browser. If you are in Australia, you may also contact the Office of the Australian Information Commissioner about privacy. This policy does not limit any right you have under the Privacy Act 1988 (Cth) that cannot be limited by a website notice.
Overseas visitors
The store address is in New South Wales, Australia. If you write to us from another country, your message is received in Australia. We do not operate a separate overseas office through this website.
Changes to this policy
If the way the site handles information changes, this page will be updated and the date at the top will change. A change to the wording does not rewrite an email you already sent. The current text is the one published at privacy-policy.html.
Contact about privacy
Privacy questions can be sent to [email protected], or you can call +61 2 9443 5271, or you can write to Superhero Universe, 2/53 Salisbury Rd, Asquith NSW 2077, Australia. Please say that the message is about privacy so it is not mixed with a product question.
How to read this notice
This notice is written for the website as it is published, not for a checkout, a membership club, or a mobile app. If a sentence describes a form, that form is the contact form or the product inquiry form. If a sentence describes storage, that storage is in your browser. If a sentence describes an email, that email is a message you send from your own mail application to [email protected]. Nothing in this notice is a product warranty, a price, or a statement that a figure is available.
The store name and the character names on the public pages are there so visitors can describe what they want to ask about. They do not change who receives a privacy question. A privacy question comes to Superhero Universe at the Asquith address, the phone number, or the email address above. It does not go to Marvel Entertainment, Marvel Studios, or The Walt Disney Company, because this store is not those companies and does not operate their mail.
The contact form, field by field
Name is the word you want us to use if we reply. It can be a first name. Email is the address your mail application will use as the sender of the draft, and it is also stored in the local copy so you can see what you wrote. Phone is optional. If you leave it blank, the draft simply omits it. Category is one of the types listed on the site, such as action figures, statues, toys, display figures, or gifts. Product name is optional and should be your own description. Subject is optional and becomes the subject line of the draft when you provide it. Message is the question. Required fields are marked by the browser when you try to submit an empty form. The page does not add hidden fields for advertising, for a customer number, or for a payment token.
Please write only what the question needs. A question about a shelf figure does not need a date of birth, a passport number, a tax file number, or a card number. The form will accept whatever text you put in the message box, so the limit is your choice. If you include something sensitive by mistake, you can delete the local copy on the contact page and, if you already sent the email, you can ask us to delete that correspondence.
The short form on the home and about pages
The home page and the about page have a shorter form. It asks for a name, an email address, and a category, then moves you to the contact page with those values filled in. That move happens in the browser address bar. It does not transmit the values to a server of ours, and it does not open an email draft by itself. The draft opens only when you submit the contact form or the product inquiry form. If you close the tab before that second step, the only trace is whatever your browser keeps in its own history.
What the submit button does, in order
First the browser checks that required fields are filled. If they are not, it shows its usual message and nothing is saved. If they are filled, the script reads the fields and places one entry at the front of a list in local storage under the key mc-inquiries. The list is cut at twenty entries, so an older note can drop off the end when a new one is added. The contact page and the product details page can show that list. Then the script builds a draft addressed to [email protected]. The subject is the subject you typed, or the category, or the words “Product inquiry” if both are empty. The body lines up the name, email, phone, category, product name, and message. Your mail application opens that draft. Sending it is a separate click in that application.
The page then clears the form and shows a note that a copy was saved and that a draft should have opened. The note does not say the message was delivered. We cannot see, from the website, whether you pressed send. If the draft does not open, the local copy is still there and you can email [email protected] yourself or call +61 2 9443 5271. A blocked popup, a missing mail application, or a browser setting can all stop a draft from appearing. None of those events creates an order.
What a card does not store
A category card does not write “Action Figures,” “Collectible Statues,” or any other name into local storage. There is no key for a saved-category list. The card does not store your name, your email, or a message. Nothing on the card is a basket, a price, or a message to the store. The only local copy is the one created when you submit the contact form or the product inquiry form.
Shared and public computers
Local storage belongs to the browser profile, not to a password on this website, because this website has no password. On a computer you share, another person who can open the same profile can read saved inquiries, including a phone number you typed. Use a private window if you do not want the copy kept, or remove the notes before you leave the machine. Private windows usually discard local storage when they close. We do not receive a signal that you did this.
When an email actually arrives
If you send the draft, your email provider carries it to the mailbox [email protected]. From that moment the message is correspondence. We read it to answer the question, to see which category you named, and to avoid giving you a fact the website does not state. We may quote your question back to you so the reply stays tied to what you asked. We do not publish the message. We do not add the address to a newsletter. We do not sell the address. We do not use it to build a public profile of your collection.
A reply, when one is sent, comes from that mailbox or by a return phone call if you left a number and a call is a sensible way to answer. The reply is about the question. It is not an invoice. It does not become a confirmation of stock unless the words of the reply say so. If we need a clearer description, we may ask you to write again. We do not ask you to pay through the website, because the website has no payment page.
Security of the pages and the mailbox
The pages are static files. The inquiry script runs in your browser and does not post the form to an application we operate. That removes one common place a form can be intercepted, and it also means we do not have a database of unsent drafts. The protection of a message you do send depends on your email provider and on the provider that hosts the mailbox. Use a current browser. Do not send card numbers. If you think an email to us was not from you, contact us by phone at +61 2 9443 5271 and say so.
Hosting logs, in plain words
Whoever serves the HTML files may record the ordinary facts of a connection: the time, the page address, the browser type, and an IP address. Those records are a normal part of running a public website. This site does not add its own analytics script on top of them, and it does not show us a dashboard of visits. We do not use those logs to identify the author of an unsent form, because the form text never arrives in the log. If a host keeps logs, the host’s own policy governs that copy. We do not sell log data.
Google Fonts, in plain words
The typefaces are requested so headings and paragraphs match the layout. The request goes from your browser to Google. We do not receive your IP address from that request. Blocking the request does not block the text. It only changes the letters to a typeface already on your device. The cookie policy describes the same request. We do not use fonts to follow you from this site to another site.
Australian privacy context
The store address is in New South Wales. If you write to us, you are writing to a business in Australia. The Privacy Act 1988 (Cth) and the Australian Privacy Principles set rules for many organisations that handle personal information. This notice describes what this website actually does so you can see the collection, the use, and the way to reach us. It is not a certificate, and it does not claim a government registration that the site does not publish. Where the Act gives you a right that a website notice cannot take away, that right remains.
In ordinary language, the collection is the email you choose to send and the local notes you choose to keep. The use is answering you. The disclosure is limited to the providers who carry the email or the font file, a host who serves the pages, and a disclosure the law requires. Access and correction mean you can ask what correspondence we still have and ask us to fix or delete it. You can also delete the browser copy yourself without asking us, because that copy never left the device until you sent mail.
Complaints
Write to [email protected] with the word privacy in the subject, or call +61 2 9443 5271, or post a letter to Superhero Universe, 2/53 Salisbury Rd, Asquith NSW 2077, Australia. Say what happened and what you want changed. If you are not satisfied, you can contact the Office of the Australian Information Commissioner. This page does not set a fee for that complaint and does not require you to use a special form of ours before you contact them.
Children, in more detail
Collectors include families, but the forms are not built for a child to open an account or to join a list. We do not ask for a school, a parent’s card, or an age. If a message appears to come from a child under 16, we will delete it when a parent or guardian asks us to, or when we can see that it should not have been sent. The public pages can still be read without a form.
Changes, in more detail
A change to this page is published by replacing the text at privacy-policy.html and by changing the date at the top. We do not email a list of past visitors about a wording change, because we do not keep that list. An inquiry you already sent stays an inquiry under the facts of that email. A later edit does not turn it into an order and does not pull new data out of your browser.
A short account of a normal visit
You can open Home, Collections, a category, a guide, the FAQ, and the legal pages without typing anything. No account is created by reading. If you submit an inquiry, the browser keeps the copy described above and opens a draft. If you send the draft, we receive the email and use it to answer. If you do not send it, we do not receive the text that stayed on the device. That is the whole path. There is no second path in which a card quietly posts a category name to an advertising partner.
You may ask for the correspondence we hold, ask for a correction, or ask for deletion, using [email protected], +61 2 9443 5271, or the street address 2/53 Salisbury Rd, Asquith NSW 2077, Australia. Say which email address you used so we can find the right thread. We will not ask you to create a password to make that request. We will not ask for a card number to prove who you are.
Records we do not keep
We do not keep a mailing list, a loyalty file, or a record of every page you opened. We do not keep the text of a form you filled and then abandoned, because that text never left the browser. We do not keep card numbers, because we do not ask for them. We do not keep a copy of your font request. The records we do keep are the emails and calls you actually send, for as long as we need them to answer and to remember what was asked. You can ask for those to be deleted. The browser copy is yours to delete without us.
If you use more than one browser, each browser has its own local storage. An inquiry saved in one is not visible in another, and it is not combined by us into a single profile. That is a limit of the way the site is built, and it is also a privacy limit: we cannot reconstruct an unsent inquiry from a phone call unless you tell us what you wrote.
Visitors outside Australia are welcome to read the pages and to write to the store. Their message is handled in Australia at the Asquith address. We do not run a separate privacy desk in another country through this website, and we do not transfer form text to an overseas checkout, because there is no checkout. The font request may be answered by Google from whatever location Google uses for that service. That is the third-party transfer described above, and it is optional in the sense that the pages still show their words if the request is blocked. A person who only reads the public pages gives us no form text at all. Reading this notice does not create an account.
Related pages: Cookie Policy, Terms & Conditions, Disclaimer, Contact.