Privacy policy.

Who I am

1. This site, edwardglush.com, is run by Edward Glush, a sole trader based in Melbourne, Victoria, Australia. Postal address: Suite 1208, 530 Little Collins Street, Melbourne VIC 3000.
2. "I" means me. There is no staff, no agency and no data team. The person who reads your enquiry wrote this page.

The law this policy follows

1. Australian privacy law is the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles in it.
2. As a small business I may fall under the small-business exemption in that Act. I follow the Australian Privacy Principles regardless.
3. Where I build a site or an automation for you, this policy covers my handling of your data as a client. It does not cover what your site or your systems do with your customers' data. That policy is yours to publish. I will help you write it.

What I collect, and from where

Information reaches me through this site in three ways. Each is listed with what is captured.

1. The contact form. Whatever you type in the name, email, website address, "what is going on" and message fields, plus which page the form was on. The server adds the date and time, the address of the page that sent you to the form (the referrer), and your browser's user-agent string (the name and version of your browser and device). It does not record your IP address in the enquiry.
2. The form has two spam traps. One is a field hidden from people that bots tend to fill; if it has anything in it, the entry is discarded. The other is a timestamp written into the page when it loads; if the form is submitted in under two seconds, the entry is discarded. Neither trap stores anything about you.
3. Server logs. Like every web server, mine records each request: the IP address it came from, the page requested, the time, the browser's user-agent string and the referrer. These logs exist for security and to diagnose faults.
4. Payments. When you buy something on this site, the card form is served by Stripe and your card number goes from your browser to Stripe. Card numbers never touch this server. What I receive back from Stripe is your name, email address, the amount, a payment reference and, for subscriptions, the last four digits of the card and its expiry so I can tell you which card is on file.
5. Email you send me. Anything you write to me by email is kept in my mailbox like any other correspondence.

What I do not collect

Third-party resources this site loads

1. Every page loads the Font Awesome icon stylesheet from the cdnjs content delivery network, operated by Cloudflare, and the Fraunces, Sora, DM Sans and JetBrains Mono typefaces from Google Fonts.
2. When your browser fetches those files, Cloudflare and Google see your IP address, your browser's user-agent string and the page that requested the file. Their handling of that request is governed by their own privacy policies.
3. Nothing else on this site is loaded from a third-party server. Scripts and stylesheets other than the two above are served from this domain.

Why I collect it and what I do with it

1. Contact form entries and emails exist so I can reply to you, and so a lead is never lost if an email fails to send. I use them to answer your enquiry, to prepare a quote if you ask for one, and for nothing else.
2. Payment details exist so I can issue an invoice, deliver what you bought, and, for subscriptions, charge the agreed amount each month.
3. Server logs exist to keep the site secure and to find faults. I look at them when something is wrong.
4. I do not use any of it for profiling, automated decision-making or advertising.

Where it is stored and for how long

1. Contact form entries are written to a folder on the web server as a plain-text file before any email is sent. A copy is then emailed to me. If the email fails, the enquiry is still on disk.
2. I keep contact form entries for 24 months from the date received, then delete them. If you ask me to delete yours earlier, I do, within ten business days, unless I need it to complete work you have paid for or to meet a legal obligation such as record-keeping for tax.
3. Server logs are kept for a short rolling period, long enough to diagnose a fault or investigate abuse, and are then overwritten. I do not archive them.
4. Invoices and payment records are kept for the period Australian tax law requires, currently five years.
5. Client work. Anything you give me to do a job is kept for the length of the engagement and for 24 months after, so the migration promise and any warranty period can be honoured, and is then deleted on request.
6. The web server is a single machine that I administer myself. Nobody else has access to it.

Who else sees it

1. Stripe processes payments. Stripe is a United States company and stores payment data in the United States and in other countries where it operates. Stripe's privacy policy is at stripe.com/privacy.
2. An email delivery service carries the copy of each enquiry from the server to my mailbox. That service is operated from the United States. It sees the content of the enquiry in transit and for a short delivery log.
3. Cloudflare and Google see the requests described in section 5 when your browser loads icons and fonts.
4. Where I use a third party's system in your own accounts to do work for you, for example your booking system or your analytics, that system already holds your data under your agreement with it, not mine.
5. I disclose personal information to nobody else, except where the law requires it.

Access, correction and deletion

1. You can ask me what I hold about you. I reply with a copy within ten business days, at no charge.
2. You can ask me to correct anything that is wrong. I correct it and tell you when it is done.
3. You can ask me to delete what I hold, subject to section 7.2. I delete it and confirm by email.
4. You can ask me to stop contacting you at any time, and I stop.
5. All of these requests go through the contact form at /contact, or by reply to any email I have sent you. I may ask you to confirm from the email address the record is attached to, so that I do not hand your details to someone else.

Complaints

1. If you think I have mishandled your information, tell me first through /contact. I acknowledge within two business days and give you a written answer within 30 days.
2. If you are not satisfied with my answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. The OAIC is the regulator for the Privacy Act and its service is free.

Data breaches

1. If I become aware that your personal information has been accessed or disclosed without authority and that is likely to cause you serious harm, I tell you what happened, what was involved and what I have done about it, as soon as I can and within the timeframes the Notifiable Data Breaches scheme sets.

Changes to this policy

1. If I change how this site collects or uses information, I update this page and change the date below. Where a change materially affects what I do with details I already hold, I email the people concerned.
2. This policy took effect on 18 September 2026.