Privacy Policy

1. Who we are

Web Gecko (ABN 32 300 992 377) builds and runs websites for small businesses in Queensland and across Australia.

Contact us at hello@webgecko.au, on 0494 737 600, or in writing to PO 4034, Forest Lake QLD 4078. Our address is Suite 4034, Unit 9/235 Forest Lake Blvd, Forest Lake QLD 4078.

The same person handles privacy questions and complaints. Use any of those details and it reaches us.

2. Two kinds of information, and why the difference matters

Yours. Information about you as our client, or as someone who has asked us for a quote. We decide what happens to it, and this policy governs it.

Your customers'. Information your website and your phone line collect from the people who contact you: names, numbers, enquiries, bookings, job photos. We hold that on your behalf and on your instruction. It is your business's information, not ours. We do not use it for our own marketing and we never sell it. Your own privacy policy governs what your business does with it.

3. What we collect about you

• Who you are: business name, contact name, ABN and trading details
• How to reach you: email, phone and business address
• Your trade licence number, where your trade needs one shown on advertising
• Billing: what you were invoiced and what you paid. Card and bank details are entered on Stripe's own page. We never see them and we never store them
• Your signature record: if you sign an agreement online we keep the name you typed, your IP address, your browser, and the times it was sent, opened and accepted
• Technical information: website analytics, IP address, browser type and which pages were viewed
• Content: the text, images and material you give us for your site or your socials
• Our conversations: emails, messages and notes about your job
• Phone calls: if we call you, we may record the call so we can review it internally. The recording and its transcript stay on our own computer and its encrypted backup, are never shared or used in marketing, and are deleted if you ask

3a. Free website checker and emailed reports

The checker stores your submitted public website address and generated report on Cloudflare for up to 24 hours. Report requests expire after one hour. If you request a full report, we also record the email address you enter, your website, overall score, request time, delivery reference and your marketing consent choice as a lead for up to 12 months.

Resend delivers the report to the address you enter, from hello@webgecko.au. A copy goes to our team at the same mailbox. Emailed copies remain in the recipient mailboxes and are handled as correspondence under this policy. Optional mobile performance testing sends the submitted public website address to Google PageSpeed Insights. Cloudflare Turnstile and rate limits protect the forms from abuse.

Requesting a report does not subscribe you to marketing. The separate marketing checkbox is optional and starts unticked. We record the choice, wording and request time. Reply to hello@webgecko.au to withdraw consent, ask what we hold, correct your details or request deletion. Report leads are separate from quote submissions and do not authorise a purchase or website build.

3b. Your client portal

If we give you a portal, signing in to it creates the records below. They sit in your website's Cloudflare storage, and we use them only to run your portal and keep your account safe.

• Your account: your email address and a salted one-way hash of your password. We never store or see the password itself
• Your devices: for each sign-in, a rough description of the device taken from your browser (for example "iPhone, Safari"), the approximate city and region Cloudflare works out from your IP address, and the time. You see this list in your portal and can sign other devices out. A sign-in lasts up to 7 days. A device you ask us to remember is remembered for 30 days
• Sign-in alerts: when your portal is opened on a new device, we email you the device, the approximate city and the time
• Failed sign-ins: a count against your account and against the IP address used, kept for 15 minutes to stop password guessing
• Breach check: when you set a password, your portal checks it against Have I Been Pwned's list of leaked passwords. Only the first five characters of a one-way hash of the password are sent. Your password, your email address and the full hash are never sent. If the check cannot run, the password is accepted without it
• Authenticator app: if you turn one on, we store the secret key it shares with your phone so the portal can check its codes. Turning it off deletes the key
• Phone notifications: if you turn them on for a phone, we store the address that phone's push service gave your browser (Google, Apple, Mozilla or Microsoft, depending on the device), with the device description and the time. The notification we send through that service is empty. Your phone then asks your portal what came in, using your own sign-in, so no enquiry details pass through the push service. Turning notifications off for a phone deletes its address
• What you record: whether an enquiry became a job, and the average profit per job you enter, so your reports can show what the service earns you

When your portal access ends, we delete your account, sign-ins, remembered devices, authenticator key and notification addresses.

4. What we hold about your customers, for you

• Name, email and phone, from a form on your site or a booking
• Their enquiry, in their own words
• Booking details: date, time and the job they want done
• Missed-call rescue: the text thread that follows a missed call, and any voicemail. The recording itself stays with the phone provider
• Job photos. Photos uploaded through your portal are stored privately. Only you, through your portal link, and we can see them. A photo appears on your website only when we put it there for you
• Review requests you send from your portal: the customer's name and email address, the date, and your confirmation that they agreed to be asked. The email carries an unsubscribe link, and we keep a record of who unsubscribed so they are not asked again

5. How we collect it

Most of it comes straight from you, when you ask for a quote, sign up, use your portal, or send us content.

Some arrives through the systems we run for you: a form on your site, a booking, a missed call.

Some we collect from public sources when we are looking for businesses to approach. That means Google Business Profile listings, the Australian Business Register, and business websites. It is business contact information, and for a sole trader it is still personal information, so we tell you here rather than leave it unsaid.

If we contact you off a public listing and you ask us not to contact you again, we stop and we record it so it does not happen twice.

6. Why we use it

• To deliver the work you engaged us for
• To quote, invoice and take payment
• To talk to you about your job, including drafts and approvals
• To send service notices, such as an invoice or a renewal
• To meet our legal and tax obligations
• To fix problems and improve how the service runs

We do not use your personal information for marketing you did not ask for, and we do not sell it to anyone.

7. Who we share it with, and where they hold it

We use other companies to run the service. Each one only gets what it needs to do its job, and each is engaged to handle it on our behalf.

Provider	What they do	Where the data can be held
Cloudflare	Website hosting, form capture, spam filtering, photo storage	United States, and any country where Cloudflare runs servers, including Australia
Stripe	Payments and subscriptions	Australia and the United States
Twilio	Text messages and voicemail	United States
Resend	Sending email	United States
Google	Your Google Business Profile, and your business details when we build your site with Google Stitch	United States, and other countries where Google runs data centres
WorkPost, Supabase and connected social platforms	Authorised account connections, content storage and scheduled social publishing. Buffer may retain historical records from earlier use.	Australia and overseas, depending on the connected platform and configured hosting region; ask us for the providers and regions used for your service
Email and website hosting providers	Correspondence and website hosting, including Google Workspace or the configured mail/hosting provider	Depends on the service and provider; we confirm relevant locations for your engagement
Anthropic and OpenAI	Writing and editing your website from your brief, and drafting social posts from your job notes and photos	United States
Push services: Google, Apple, Mozilla and Microsoft	Delivering portal notifications to your phone, if you turn them on. Each receives your phone's notification address and an empty message, nothing about you or your customers	United States, and other countries where each runs servers
Have I Been Pwned	Checking a new portal password against leaked passwords. It receives the first five characters of a one-way hash, sent from your website's server, not from your device	Served through Cloudflare's network worldwide
Backblaze	Off-site backup. It is encrypted on our machine before it is uploaded, so Backblaze cannot read it	United States

We may also share information with our accountant or lawyer where it is needed, and with a regulator or a court where the law requires it.

This is a disclosure outside Australia under APP 8. We take reasonable steps to make sure these providers handle information consistently with the APPs, and each is bound by its own data processing terms. You should know the limit of that. Once information is held overseas, Australian privacy law may not protect it the same way. It may also be reachable by that country's courts and agencies.

If you would rather we did not use a particular provider, tell us. Some of them are the service, so the honest answer may be that we cannot deliver that part of it.

8. Where it is held

• Cloudflare, for your website, form enquiries, portal data and photos
• On our own computers in Australia, for your client, job and invoice records
• In an encrypted off-site backup

9. How long we keep it

We keep information while needed to deliver services, meet legal obligations and resolve claims. Most Australian tax records must generally be retained for five years, with longer periods for some records. We assess the applicable rule and starting date rather than applying one period to every record.

Operational messages, photos and contacts are reviewed for deletion or de-identification when no longer needed. Copies may remain in provider systems, correspondence and protected backups until their retention cycle ends. Signed agreements and necessary financial evidence are preserved. Ask us for the retention and deletion status of your records; expiry of a link does not delete every underlying copy.

10. Keeping it safe

We use HTTPS for public services, restrict access to people who need it and encrypt our off-site backup before upload. Payment details are entered with Stripe. Portal passwords are stored only as salted one-way hashes, a new device needs an emailed code or an authenticator code before it can open your portal, and you can see and sign out every device signed in to it. These controls do not make all files or all communications encrypted; public photo links can be opened by anyone who has the link.

No system on the internet is perfectly secure, and we do not pretend otherwise.

11. If there is a data breach

We act promptly to contain and investigate suspected breaches. Where the Notifiable Data Breaches scheme applies, we conduct a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days after becoming aware of grounds to suspect an eligible breach. We do not wait for that deadline when an eligible breach is already established.

Where notification is required, we notify the OAIC and affected people as soon as practicable, taking account of applicable exceptions and effective remedial action. We also assess contractual duties to tell clients and explain practical protective steps.

12. Getting a copy, or fixing it

You can ask for a copy of the personal information we hold about you, or ask us to correct it, at any time. Email hello@webgecko.au or call 0494 737 600.

There is no self-service login for this. We put it together by hand and respond within 30 days.

In some cases the Privacy Act lets us refuse access. If that happens we tell you why, in writing, and how to challenge it.

13. Deleting it

Ask us to delete your information and we assess what is no longer needed, what we must retain and any copies held by providers or in backups. We preserve necessary tax, transaction, agreement and dispute evidence, including identifying information where needed. We explain what was removed, what remains, why and any follow-up needed. A local deletion is not a promise that every provider or backup copy has disappeared.

14. Marketing, unsubscribing and calls

Marketing emails and texts follow the Spam Act 2003. Every marketing email carries who sent it, how to reach them, and an unsubscribe link, and every marketing text offers a STOP reply. Unsubscribe and we action it within 5 business days.

Messages your system sends your own customers are sent by you, not by us. You need their consent. See section 12 of our Terms and Conditions (WG-TNC-001).

We contact clients to operate their service. Marketing calls require an appropriate lawful basis and any necessary separate consent; buying a service does not automatically give unlimited marketing permission. Tell us to stop marketing by any means and we record and action that request.

15. Cookies and analytics on this site

Webgecko.au uses Google Analytics to understand page visits and interactions such as quote requests and clicks on phone or email links. Analytics can use cookies and send device, browser and interaction data to Google, including overseas processing. We do not sell personal information. You can restrict cookies or analytics through your browser settings or an analytics blocker.

Our host and Cloudflare keep standard server logs, which include IP addresses, and Cloudflare may set a cookie that tells a person from a bot. Both exist to keep the site up and secure.

16. Making a complaint

Contact us first, using any of the details in section 1. We investigate and respond within 30 days.

If our answer does not satisfy you, complain to the Office of the Australian Information Commissioner. Their website is oaic.gov.au and their line is 1300 363 992. Complaining to them costs nothing and you do not need our permission.

17. Changes to this policy

The current version is always the one on this page, with the date at the top. If we change something that affects how we handle your information, we tell you.