Privacy Policy

Who we are

J Westfallen & S.J Wright (ABN 35 393 871 646), a partnership trading as Brand Kits, of New South Wales, Australia. We build brand-led websites for small businesses. In this policy, "we", "us" and "our" mean Brand Kits.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

What we collect

When you send a brief

The brief form on our homepage and on /brief collects:

• your website address, or your business name if you're starting from scratch;
• your industry and what you want the site to do;
• your email address, and your phone number if you choose to give it.

Only the email address is required — it's how we send your concept back.

When you book a call

Bookings run through Cal.com. You give Cal.com your name, email address and a time; we receive those booking details.

Automatically, when you use the site

• Your IP address. Our server reads it to rate-limit the brief form so it can't be used to spam us. It is not stored against your submission in normal use; it is written to our server logs if a submission is rate-limited or caught by our spam trap.
• Server logs. Brief submissions are written to our hosting provider's log stream as a backup, so a genuine enquiry isn't lost if email delivery fails. Those log entries contain what you submitted, including your email address and phone number.
• Analytics. We use Cloudflare Web Analytics, which is cookieless and does not fingerprint or track you across sites. It tells us page views and referrers, not who you are.
• A domain check. When you type a website address into the brief form, your browser asks Cloudflare's public DNS resolver whether that domain exists. Only the domain is sent — nothing about you.

Information that is already public

To build your free homepage concept and audit your site we look at your existing website and other publicly available information about your business — including the logo, images and wording you already publish. We only use material that is already public, and only to build and show you your concept. We don't ask for logins and we don't go behind them, we do not buy personal information, and we do not scrape or collect information about your customers.

Concepts we publish are served with a noindex instruction and a robots exclusion, so search engines can't index them and your concept can never be mistaken for your real site. What that permission covers, and how to withdraw it, is in section 2 of our Terms.

Cookies

We don't set tracking or advertising cookies, and there is no cookie banner because there is nothing to consent to. Cal.com may set cookies when you open the booking calendar; those are governed by Cal.com's privacy policy.

How we use your information

• To build and send you the free homepage concept and audit you asked for.
• To reply to you, and to talk through the work if you want to go ahead.
• To deliver, host and support your website if you become a customer.
• To keep the site secure and stop automated abuse of our forms.

We do not sell your information. We do not share it for anyone else's marketing. We won't add you to a mailing list from a brief submission — if we ever start sending anything beyond a direct reply, we'll ask first.

Who else handles it

We use a small number of service providers to run the business. They only get what they need to do their job:

• Cloudflare — hosts the website and our email/API infrastructure, provides the cookieless analytics, and runs the DNS lookup described above. Requests are processed on their global network.
• Brevo — sends the notification email carrying your brief to us.
• Cal.com — runs call bookings.

Some of these providers store or process data outside Australia, including in the United States and the European Union. By sending us a brief you agree to that transfer. We take reasonable steps to use providers with appropriate data protection commitments.

How long we keep it, and how to have it deleted

Two commitments here, and we mean them literally:

• If you decide not to go ahead, we delete the working data. The homepage concept we built for you and the material we gathered to build it are removed from our servers. You can ask us to do that sooner at any point, without giving a reason — you don't have to wait until you've decided.
• You can ask us to remove your contact details at any time — email hello@brandkits.com.au and we'll delete them.

Two practical caveats, so this is honest rather than tidy: emails you've sent us and our replies remain in our mail history unless you ask us to delete those too, and automated server logs age out on our hosting provider's rolling retention window — a matter of days — rather than being deleted individually.

If you become a customer, we keep records we're legally required to keep — invoices and tax records for seven years under Australian law.

Keeping it safe

The site runs over HTTPS everywhere, with a strict content security policy. Access to your information is limited to the two people who run Brand Kits and the service providers listed above. No system is perfectly secure, but if a data breach ever put you at likely risk of serious harm, we'd tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Accessing or correcting your information

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email hello@brandkits.com.au. We'll respond within 30 days, as the Privacy Act requires. There's no charge for asking.

Complaints

If you think we've mishandled your information, tell us first at hello@brandkits.com.au and we'll try to sort it out. If you're not satisfied with how we've handled it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

Changes to this policy

If we change how we handle personal information, we'll update this page and the date at the top. Material changes will be obvious rather than buried.

Contact

J Westfallen & S.J Wright, trading as Brand Kits (ABN 35 393 871 646) — hello@brandkits.com.au