Privacy Policy

What we collect from this website

• Analytics. We use Cloudflare Web Analytics and Umami (Umami Cloud), both of which are cookie-free and do not fingerprint or track individuals across sites. They report aggregate page views, referrers and country.
• Google Ads conversion measurement. We advertise on Google Search, and every page loads the Google Ads tag, which sets cookies so Google can tell us when a visit from one of our ads leads to a consultation booking, a search in our EOL checker or a click on our email link. When you book a consultation, your email address and phone number are hashed (one-way encoded) in your browser and the hashes are sent to Google, which matches them against signed-in Google accounts to attribute the booking to an ad (“enhanced conversions”). Google receives the hashes, not the readable details. See Google’s privacy policy and how Google uses information from sites that use its services. You can turn off ad personalisation at adssettings.google.com or block the tag with a content blocker; the site works without it.
• Consultation bookings. Our booking form collects your name, business name, email, phone number, what you would like to discuss and the time you choose, plus the page and campaign that brought you to it. These are passed to our scheduling provider, Cal.com, which creates the booking and sends you the calendar invite. The form may use Cloudflare Turnstile to check that you are not an automated bot.
• Chat assistant. Our site assistant (“dAIve”) receives the messages you send so it can answer your questions. Each message is automatically accompanied by connection details — your IP address, browser and operating system type, browser language, the page you were viewing and the time of the message. We use these to operate the chat, diagnose faults and prevent abuse.
• Email. If you email us, we retain that correspondence.

We do not sell personal information. Apart from the hashed booking details used to measure our Google ads, described above, we do not use it for advertising or profiling.

What we collect during an engagement

Delivering network and security work necessarily involves access to technical information about your environment — device inventories, configurations, logs, network diagrams and, where relevant, user account names. Some of this is personal information.

• We collect only what the engagement requires.
• We prefer read-only access and time-limited credentials wherever the work allows it.
• We do not extract, copy or retain client business data beyond what is needed to produce the agreed deliverable and its supporting evidence.

Why we collect it

We collect, hold, use and disclose personal information only for these purposes:

• To respond to your enquiry and work out whether we can help you
• To scope, quote, deliver and support the services you engage us for
• To produce the assessment reports and documentation you have asked us for
• To invoice you and keep the tax and financial records we are required to keep
• To meet our legal, insurance and professional-indemnity obligations
• To measure which of our Google ads lead to consultation bookings

We do not use personal information for any secondary purpose you would not reasonably expect, and we do not sell it or rent it. We do not use it for advertising or profiling, except for the Google Ads conversion measurement described above.

How we store it

Engagement records are stored on encrypted devices and in access-controlled cloud storage with multi-factor authentication. Credentials supplied for an engagement are held in a password manager and destroyed, or rotation is requested, at the end of the engagement.

Who we disclose it to

We do not disclose your information to third parties except: to the service providers who host our infrastructure, schedule bookings and measure our advertising; where you have asked us to work alongside your existing IT provider or MSP; or where required by law.

Overseas disclosure. We are likely to disclose personal information to recipients outside Australia, because some of our providers are based overseas:

• Cloudflare, Inc. — website hosting, privacy-preserving analytics, and the AI model that powers our chat assistant. Cloudflare is headquartered in the United States and operates a global network.
• Cal.com, Inc. — consultation scheduling. Cal.com is headquartered in the United States and stores booking details (your name, contact details, message and booking time) on its platform.
• Umami Software, Inc. — website analytics via Umami Cloud, a cookie-free service that does not collect personal information. Umami is headquartered in the United States.
• Google LLC — Google Ads conversion measurement: cookie and visit data from the Google Ads tag, and hashed email and phone number when you book a consultation. Google is headquartered in the United States.
• Chat assistant platform. The chat automation backend (dAIve’s server) is operated by us on infrastructure we host in Melbourne, Australia. Chat messages are processed to generate replies by Cloudflare’s AI service, covered by the Cloudflare disclosure above.

We do not otherwise transfer personal information overseas. If that changes, we will update this page and name the countries involved.

How long we keep it

Enquiries that do not proceed are deleted within 12 months. Chat transcripts and the connection details recorded with them are also deleted within 12 months. Engagement records and deliverables are retained for seven years to meet tax, professional-indemnity and audit-evidence obligations, then destroyed.

There is no fixed statutory retention period for chat records. The Privacy Act (APP 11) requires us to destroy or de-identify personal information once we no longer need it for any lawful purpose; 12 months is the retention period we have set for chat data.

Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Accessing and correcting your information

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. Email [email protected] and we will respond within 30 days.

Making a complaint

If you believe we have breached the Australian Privacy Principles, email [email protected] with the word “complaint” in the subject line and enough detail for us to investigate. What happens next:

• We acknowledge your complaint in writing within 5 business days.
• We investigate, which may include asking you for further information, and respond substantively within 30 days.
• Our response will explain what we found, what we have done about it, and what we will do differently.

If you are not satisfied with our response, or we have not responded within 30 days, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or by phone on 1300 363 992.

Changes

We will update this page if our practices change, and update the date at the top.