Release preview: seller details and the support mailbox are being confirmed. Pro purchases are not open yet.

Legal

Privacy policy

Last updated 11 October 2026. Ratehaul is operated by [Trading name], a sole trader in Western Australia.

Short version: this site sets no cookies of its own; Lite sends nothing to us; Pro sends its licence key to our licence check, which asks Payhip, our checkout provider, whether the key is valid; support email may be processed by an AI assistant; and we never sell data.

This website

If page counting is switched on, we use Cloudflare Web Analytics to count page views. It does not set cookies, does not fingerprint your browser and does not track you across sites. We see aggregate counts of pages and referrers. Cloudflare's own privacy policy applies to how it handles that data.

Fonts. Pages load the Inter typeface from Google Fonts, so your browser requests it from Google, which receives your IP address and browser details under Google's privacy policy.

Error notes in your browser. If a page hits a script error, the site keeps a short note of it (up to the last 50) in your own browser's local storage under the name ratehaul_errors. It is never sent to us automatically; it is there so we can ask you for it if you report a problem. Clearing this site's data in your browser removes it.

The website sets no cookies of its own. The buy buttons load Payhip's checkout; when you buy, Payhip and its payment processor collect your name, email and payment details under their own privacy policies. We receive your name, email, the product bought and the order number. We never see your card number.

The plugin

Rate requests (Lite and Pro). To quote a price the plugin sends your store's origin postcode, the customer's destination postcode (or country for international), and the parcel's dimensions and weight from your web server to Australia Post's PAC API. The request also carries your PAC API key, as Australia Post's API requires, so Australia Post receives the key, those inputs and your server's IP address, and handles them under its own terms and privacy policy. Nothing about the request, the customer or the order is sent to Ratehaul.

Licence check (Pro only). When you enter or change a licence key, and afterwards when Pro is next used once a day has passed since the last answer, the plugin sends the licence key and the Pro product identifier from your web server to Ratehaul's licence check, a small service we run on Cloudflare Workers. It passes the key to Payhip (payhip.com), which issued it when you bought Pro, and answers only "valid", "not valid" or "could not check". The request does not include your site URL (the plugin sends its own user-agent, "Ratehaul/" and its version, instead of WordPress's default, which contains the site address), your customers' data, order data or rate data.

Cloudflare receives your server's IP address with each request and processes it under its own privacy policy. The licence check uses that IP address for Cloudflare's rate limiting (at most 20 checks a minute from one address), so Cloudflare keeps a short-lived count against it. Our own code for the licence check does not write the key, the IP address or the result to any storage or log. Payhip's privacy policy applies to its part. The plugin stores the result (valid or not, the time, and a hash of the key) in your own WordPress database.

If Payhip says the key is not valid (for example after a refund), Pro's extra features switch off at the next licence check and the plugin behaves like Lite. If a check cannot be completed, a key that was previously confirmed as valid on your site keeps Pro on for about 72 hours after its last successful check, and the plugin tries again when Pro is next used after an hour. Because each failed check is remembered for an hour, Pro can stay on for up to one more hour after the 72 hours before a further failed check switches it off. A key that has never been confirmed, including a new or changed key, gets no such grace: Pro stays off until a check succeeds.

Updates. Pro does not check for updates and sends no update request to anyone. New Pro versions are supplied through your Payhip purchase (a download link and an email to the purchase address) during the 12-month updates period. Lite updates will be served by wordpress.org under its policy once Lite is listed there.

Debug log. If you turn on the debug log, the plugin writes its Australia Post requests and responses (postcodes, weights, dimensions and prices) to your own WooCommerce logs on your server. We never receive that log unless you send it to us.

Nothing else. The plugin has no telemetry, no usage tracking and no advertising. The only outside services it contacts are Australia Post (both editions) and Ratehaul's licence check on Cloudflare, which asks Payhip (Pro only).

Support email

If you email us we keep the conversation so we can help you again later and so we can see patterns in problems. We keep support email for two years, then delete it.

AI-assisted support. Support replies are drafted, and routine replies (setup questions, licence re-sends and the like) may be sent, by an AI assistant that reads the support mailbox. To do that, the text of your email and anything you attach is sent to the AI provider we use and processed under that provider's terms. [Shaun to complete before the mailbox goes live: provider name, where the data is processed, and whether support email is excluded from the provider's model training.] Refund requests, complaints, and anything about legal, security or privacy matters are read and answered by a person.

Before you send a screenshot or a log, blank out your Australia Post API key, your Pro licence key, and any customer's name, address, email, phone number or order details. The support page lists what we need. If a key reaches us by mistake we will tell you and ask you to rotate it.

Advertising and tracking

This site carries no advertising-network tags, conversion pixels or cross-site tracking. If we ever run paid advertising and want to measure it, we will first update this policy to name the tag, what it records and how to opt out. Until this policy says otherwise, there is none.

What we do not do

• We do not sell, rent or trade personal information to anyone.
• We do not send marketing email unless you ask for it.
• The plugin does not send your PAC API key or customer rate inputs to Ratehaul. Australia Post receives the information described above; support information is handled as described under Support email.

Australian Privacy Act

As a small business we may not be an "APP entity" under the Privacy Act 1988 (Cth), but we handle personal information as if the Australian Privacy Principles applied: we collect only what we need, we keep it secure, we use it only for the purpose we collected it, and we delete it when no longer needed. You can ask what we hold about you or ask us to correct or delete it by emailing us.

Contact

support@ratehaul.com.au (planned mailbox; not yet verified). If you are not satisfied with our response you can contact the Office of the Australian Information Commissioner at oaic.gov.au.