Privacy policy

What the contact form collects

The form on the contact page asks for your name, your email address and a message. A phone number, a website address, what you sell and where, and a monthly budget band are optional, and the form sends without them. It also records which page you sent it from, how long you spent on the page before you pressed send, and one hidden field that only an automated script fills in. The last two are spam checks. A person filling in the form never sees them.

What happens when you send it

The form posts to a handler on this site's own server, not to a third party form service. The handler emails the enquiry to one inbox we read, using Twilio to carry the message. There is no enquiry database on this site: the email is the record.

Before it sends, the handler runs two automated checks. Akismet, run by Automattic, checks the message for spam and receives your name, email address, message, IP address and browser details for that check alone. A rate limit caps how many messages one address can send in ten minutes, using a small file named after a one way hash of your IP address that holds nothing but the times of recent submissions. When a message is rejected as spam, the handler writes a line to the server log recording the email address and IP address it came from. When the alert file is present on the server, a one line summary carrying your name and email address is also pushed to the notification service we use, so a new enquiry is seen sooner.

What the analytics records

Google Analytics 4 runs on the live site only. The staging copy of this site carries no analytics tag at all, and the deploy script refuses a staging release that contains one. Analytics records the pages you view, an approximate location worked out from your IP address, your device and browser, and how you arrived. IP addresses are anonymised in the configuration. Three things are recorded beyond page views: starting the contact form, clicking the phone number, and reaching the confirmation page after an enquiry is sent. Analytics never receives your name, email address or message. Google Analytics sets its own cookies in your browser so a repeat visit can be told from a new one.

Nothing else on the page comes from a third party. The fonts are served from this site, and there is no advertising pixel, social media tag or chat widget anywhere on it.

Why it is collected

To reply to your enquiry, to price the work you asked about, and to see which pages help visitors and which need fixing.

Who sees it

The person who runs the business reads every enquiry. Twilio carries the message from the form to the inbox and does not use it for anything else. Akismet receives the details above for the spam check only. Google processes the analytics data under its own terms. None of it is sold, rented or passed to anyone else.

How long it is kept

Enquiry emails are kept for as long as it takes to answer them, then as an ordinary business record. The rate limit file holds submission times for ten minutes and is removed once they expire. Analytics data is kept under the retention setting on the Google Analytics property, which can be shortened on request.

Security

The form posts to this site's own handler rather than a third party service, and the automated checks above filter spam before a message reaches a person. The enquiry inbox is read by the person who runs the business.

Your rights, and how to ask

Under the Privacy Act 1988 (Cth) you can ask to see or correct the personal information held about you, or raise a concern about how it was handled. Call +61 2 9161 8000 or send a message through the contact page marked as a privacy request. If the answer does not satisfy you, you can take it to the Office of the Australian Information Commissioner.