Privacy Policy

1. What we collect

We collect personal information only when you provide it to us directly, or when it is collected automatically through our website.

Information you provide

• Enquiries and bookings: your name, email, phone and business name when you enquire about our services or book a discovery call.
• Project communications: business details, brand assets, content, and any staff names or photos for your website.
• Invoicing details: your name, business name, ABN and billing address, to issue invoices and receive payment.

Information collected automatically

• Analytics: anonymised, aggregated data about how visitors use our site (pages visited, time on site, approximate country, referring source). It is not linked to an identifiable individual, and none of it loads until you accept the cookie banner.
• Form context: when you submit a form, our server attaches the approximate location (country, state or region, city, time zone) and your browser's user-agent string to the submission, worked out on our side so it cannot be faked by the page. Your IP address itself is not written into the record; it is passed to Cloudflare's bot check and to our own records system, where it is used only to limit how many submissions come from one address in a minute.
• Free tool results: the Free Website Audit, Speed Check and Accessibility Check record the address you enter, the scores worked out, and the approximate location and device our server reads from your connection. The Cost Calculator, Ads versus SEO Calculator and Google Business Profile Scorecard record only the numbers and options you set. We never record your name, email, phone, or free-text, from any tool.

We do not collect sensitive information such as health data, financial account numbers, credit card details or government identifiers.

2. How we use your information

We use personal information only for the purpose for which it was provided:

• to respond to your enquiry and discuss your project;
• to deliver the agreed services and issue invoices;
• to send project updates and follow-up communications related to your engagement;
• to send marketing about our services, where you have opted in or we have an existing business relationship (you can opt out at any time);
• to improve our website using anonymised analytics; and
• where a free-tool result shows a problem we could fix, to contact that business about it (you can ask us to stop at any time).

We will never sell, rent or trade your personal information to third parties.

3. Our use of AI tools

We use AI tools (such as Claude and ChatGPT) in our day-to-day work to help us design, write and build. Your project's working content, and the copy or briefs you supply, may pass through these tools so we can produce the work. We never load a client's own customer database, or any patient, health or other regulated data, into them. These tools act as processors for us and do not use your information for their own purposes under the terms we hold with them.

4. Who we share your information with

We do not share your personal information with any third party for their own purposes. It may be processed by the following services solely to deliver our work to you:

• Cloudflare: our hosting provider, and the provider of the Turnstile bot check on our forms (which decides whether a submission is human by looking at your IP, user-agent and connection fingerprint, not to identify, profile or target you).
• Google Workspace (Apps Script, Sheets, Appointment Schedule): form submissions are logged to a private Google Sheet and emailed to the Webstallion inbox; booking a call creates a calendar event.
• Our own customer records system (crm.webstallion.com.au): every enquiry is also saved to a system we built and run ourselves, behind a sign-in restricted to our own email addresses, so an enquiry is never lost if one service fails. It is not a third-party product.
• Google Analytics and Ahrefs: anonymised website analytics.
• AI providers (such as Anthropic and OpenAI): as described in section 3.
• Your bank or financial institution: to the extent necessary to process bank-transfer payments.

We do not use human subcontractors and do not outsource any part of our client projects.

5. Custom CRM and software

Where we build custom software or a custom CRM for you, it runs on your own hosting. We do not hold your live customer data after handover, and we build these only for non-regulated industries for now (no patient or health data). During the build we handle only the sample or setup data needed to build and test the system.

6. Overseas data transfers

Some of the providers above are based outside Australia: Cloudflare (United States, with a global edge network), Google (United States), Ahrefs (Singapore and the European Union), and AI providers such as Anthropic and OpenAI (United States). By using our website or engaging our services, you acknowledge that some of your data may be processed in countries outside Australia. We take reasonable steps to ensure that overseas recipients handle your information in accordance with the Australian Privacy Principles.

7. Cookies and browser storage

We keep our use of cookies and browser storage minimal. Your cookie-banner choice and your light/dark theme preference are each stored in your browser's localStorage and never leave your device. Google Analytics and Ahrefs do not load at all unless you accept the banner. We do not use advertising cookies or tracking pixels. You can clear cookies and localStorage at any time through your browser settings.

8. Marketing and the Spam Act 2003

We may send you marketing about our services if you have opted in, or we have an existing business relationship and the communications relate to similar services. Every marketing email includes a clear, functional unsubscribe link; if you opt out, we stop within 5 business days. This does not affect transactional communications about an active project. We comply with the Spam Act 2003 (Cth).

9. Data security and breaches

We take reasonable steps to protect the personal information we hold from misuse, loss, and unauthorised access. Our measures include HTTPS/TLS for all data in transit, hosting on Cloudflare Pages with edge security, access to client files restricted to authorised people, and no storage of card details. No method of electronic transmission or storage is completely secure, so we cannot guarantee absolute security.

If we become aware of an actual or suspected breach of personal information we hold, we will contain and assess it, notify affected individuals by email as soon as practicable, notify the Office of the Australian Information Commissioner where the breach is likely to result in serious harm, and take remedial action to prevent a recurrence. Our annual turnover sits below the $3M threshold that compels participation in the Notifiable Data Breaches scheme, but we apply the same notification standard voluntarily.

10. Data retention

• Enquiry and contact data: up to 2 years from the date of initial contact, then securely deleted.
• Project files and communications: for the duration of the project and up to 2 years thereafter.
• Invoicing records: 7 years, in accordance with Australian tax law.
• Analytics: anonymised and aggregated, retained indefinitely.
• Free-tool results: up to 2 years, then deleted.

11. Children, your rights and changes

Our services are directed at businesses, not people under 18, and we do not knowingly collect information from children. Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you may ask to access or correct the personal information we hold about you, ask us to delete it (subject to records we must retain, such as tax records), and opt out of marketing at any time. To exercise these rights, email [email protected] and we will respond within 30 days. If you are not satisfied with how we handle your request, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au. We may update this policy from time to time, and will update the "last updated" date at the top when we make material changes.

12. Contact