Website Smash is run by Daniel Dimsey in Melbourne, Australia. This policy says what we collect, why, who we share it with and what you can ask us to do with it. We follow the Australian Privacy Principles, and the UK and EU GDPR where they apply to you.
Visiting this website
This website sets no cookies and runs no analytics or advertising trackers. Our hosting provider keeps standard server logs (IP address, browser, page and time) for security and to fix problems, and deletes them on a rolling basis.
The booking calendar on the book a call page is provided by Calendly. If you book, Calendly collects your name, email and answers under its privacy notice and passes them to us so we can hold the call. Links to YouTube take you to YouTube, where Google's privacy policy applies.
When you build a site or create an account
We collect what you give us to build and run your site: your business name, trade, phone, service areas, logo, photos and words, and the email you sign in with. Payments are handled by Stripe; we never see or store your full card number. We use your email to send sign-in links, receipts and messages about your site, never to sell anything unrelated, and you can opt out of anything that isn't about your account.
Leads on sites we host
When someone sends a form on a site we host for a business, we collect what they type (name, phone, email, message), the page and the time, on behalf of that business, and pass it to them. That business decides what happens to the enquiry; contact them about it first. We help them answer requests to see or delete those details.
Who we share it with
Only the providers we need to run the service, under terms that protect the data: Railway (hosting, United States), Stripe (payments), Resend (email), Calendly (call booking), and the domain registrar when you buy a domain through us. Some are outside Australia, so your information may be stored or processed overseas. We never sell personal information.
How long we keep it
Account and site details are kept while you're a customer and deleted within 90 days of you leaving, except records the law makes us keep (such as payment records for tax). Leads are kept while the business's account is active.
Your rights
You can ask to see, correct or delete the information we hold about you, or object to how we use it. Contact us and we'll reply within 30 days. If you're not happy with our answer you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority.
Security
Everything is sent over HTTPS, passwords are stored hashed, access to customer data is limited to the people who run the service, and backups are encrypted. If a breach is likely to cause serious harm, we tell the people affected and the regulator as the law requires.
Changes
If we change this policy in a way that matters, we update the date at the top and email account holders.