Privacy policy

Who is collecting it, and who to contact

ETP Consulting Pty Ltd, trading as Evolution Web Studio, operating from Redlands and greater Brisbane, Queensland and working with small businesses anywhere in Australia. Privacy questions go to Tony Pope at hello@evolutionwebstudio.com or 0431 124 128. That address reaches a person, not a queue.

What is collected

From the enquiry form: your name, business name, email address, and optionally your phone number, current website address, a description of what you need, your timing, a budget band and how you found this site. Only your name, your business name, your email address and the description of what you need are required. Everything else is optional.

From the estimator: the ten answers you gave, the figure they produced, and the name, business name, email address and optional phone number you entered to see it. The answers are kept beside the figure on purpose, because a number with no record of what produced it protects nobody. If you then use the result screen, two more things are noted against the same reference: which of the extras you ticked to do yourself, so the figure I come back to you with is the one you were looking at, and your answer to whether the figure was in the range you had in mind. Neither one sends you anything, and both are kept and used exactly as the estimate itself is.

From the optional detail form for a Website Diagnostic or a Scope Sprint: the web address to be examined, your business name, your name and your email address, and optionally your phone number, what the business sells, anything you already know is wrong, up to three competitors, and your answers to the questions about whether the job fits the fixed price. Sending the form is optional and it is offered after you have paid. If you do send it, the web address, the business name, your name and the email address are required. When you open it from the page that follows a payment, that page’s address carries the payment’s checkout identifier, or for a Sprint booked here your booking reference, and the form sends that with what you type, so the detail is filed with your order and not as a stranger’s enquiry.

The free website score

The web address you type is read by this site’s own server, the way a search engine reads it: the page itself, its robots file, sitemap and llms.txt file, up to three pages it links to and up to fifteen of its links. The domain’s public email records are looked up too: whether it receives email, and its SPF and DMARC records. The result is kept for fourteen days under a long random code, so it can be emailed to you if you ask for the full report. That record holds the address that was scored, the day and the hour and what was found, and nothing about you. Your IP address is used, in the server’s memory only and never written down, to stop one visitor running more than a handful of scores in ten minutes. The address you type is never sent to any other company. Asking for the full report sends the code with the address the report should go to, and optionally a first name and a business name. The addresses scored and what was found are shown to me in my own console, which only a person signed in with an emailed link can open, so I can see how the score is used and which reports were asked for. An address scored without a request for the report is never used to contact that business.

The other free tools

The lost leads calculator, the Google Business Profile check and the website ownership checklist work out their answer in your browser and send nothing while you use them. Asking for the profile check’s tips sends your answers with the address the tips should go to. Asking for the calculator’s breakdown sends the seven numbers you typed with the inbox it should go to, and the server works the figures out again before anything is emailed. A trade checklist pack needs the trade and the state you choose and where to send it. A first name and a business name are optional on both.

If you arrived from one of my ads, asking for the score’s report, the calculator’s breakdown or the profile check’s tips is measured as set out under measuring my ads, and the form shows a box that stops it. The ownership checklist and the trade checklist packs are not measured.

The one email a tool sends, and how to stop more

What a tool’s form sends is recorded and kept exactly as an enquiry is, and the email it produces is a one off: asking for it does not put you on a list. Each of those emails says how to stop anything else arriving, by replying STOP or pressing its unsubscribe link. When you unsubscribe, this site keeps a scrambled form of the address (a one way hash, which cannot be turned back into it) so it can check before sending anything that you asked not to hear from it again. It keeps no list of the addresses themselves for that purpose.

Tips and offers, only if you tick the box

The form on each free tool has a box that reads “Send me tips and offers from Evolution Web Studio, unsubscribe anytime”. It starts unticked and it is optional: leave it alone and you get only what you asked for. If you tick it, this site’s own server writes down, against your email address, the time you ticked it, the exact words beside the box when you did, and the page the form was on, with the name and business name you gave on that form. That record is how I can show you, or anybody who asks, when you agreed and to what. It is kept on the site host in the same private store as the score’s results, it is shown to me in my own console, and it is used for one thing: sending you tips and offers from Evolution Web Studio, by email, from me.

How tips and offers are sent, and how they stop

The list is never sold or shared. Those emails go out through the studio’s own business email, Google Workspace, named below, and if that ever changes this page changes first, under a new version. Every one of them carries a working unsubscribe link and you can also reply STOP; either one takes you off straight away, and only a fresh tick of the box puts you back on. The record of the tick is kept for two years after the last of those emails, so I can show that you agreed, and then deleted. Anybody who asked for a tool’s results before this box existed has not ticked it and is not on the list.

Asking about a site for sale

Your name and how to reach you, by email and optionally by phone, a message if you write one, and which of the sites you asked about. They are used only to answer you about that site and, if you go ahead, to complete its sale. They are not added to any list or used to offer you anything else, and they are kept for as long as set out under how long it is kept. Sales, visits and supplier details for a site are shown only after you agree in writing to keep them confidential, and nobody else’s details are ever passed to you.

When you pay or book

When you pay for something: your card details are entered on the payment provider’s own page and are never seen here. What comes back to me is your name, your email address, the phone number you typed there, the amount, the last four digits of the card and whether it succeeded. For a Website Diagnostic the checkout also asks for the web address you want examined, and optionally what is not working and an estimate reference, and those come back with the payment, because the address is all I need to start. Where there is one, the payment also carries the reference that joins it to anything else you sent me about the same job: a Scope Sprint booked here carries the booking reference this site makes when you pick your hour, and a payment made after sending the detail form carries that form’s reference. If a card is declined, or a checkout is opened and left without paying, the same details that reached the payment page come back, with the reason the payment provider gave, so I can get in touch and help finish it. Where that payment carries the reference on a detail form you had already sent, I match the two and ring or write to you using the contact details you gave on that form. Nothing is sent to you automatically when that happens, and if you tell me not to contact you about it, I will not.

When you book a Scope Sprint on this site: you pick the hour here and type the email address the invitation should go to, and optionally your name. This site hands that email address, the hour and your booking reference to Stripe to open the checkout, so you do not type them twice. Once the payment goes through, the hour, your name and your email address are put into the business calendar in the Google Workspace account named below, which sends you the calendar invitation with the meeting link. The hour itself is also written into a small private record on the site host, so the same hour cannot be sold twice: that record holds the hour, whether it is held or sold, the booking reference and the payment identifier, and not your name, your email address or your phone number.

From the site itself, an agreement and a project

From ordinary web serving: the hosting provider records standard server and request information, including IP addresses, as part of delivering and protecting the site. That is a function of the internet rather than a choice made here, and it is not combined with anything else or used to build a profile.

From this site’s own count of visits: nothing personal. What a row of that count holds, and what it is built not to hold, is set out under cookies and tracking.

When you sign an agreement: the legal name, ABN, ACN where there is one, trading name, address and GST registration of the business or person the work is for, and the name, position and email address of the person signing. When it is signed, the record adds the name typed to sign, the time, the boxes ticked and a fingerprint of the exact agreement that was on the screen. The detail is under agreements and signatures.

During a project: the business facts, content, images and account access you provide so the work can be done, plus the ordinary records of the engagement.

What is never collected

• Passwords or multi-factor authentication codes. Access is always by named invitation to an account you own.
• Card, bank or payment details. Those are typed on the payment provider’s page, and there is no card form on this site and never will be.
• Sensitive information as defined by the Privacy Act, including health, biometric, racial or ethnic, political, religious and sexual-orientation information. If a project would require collecting any of that, it is outside the standard product and the fit gate says so before a quote exists.

Why it is collected and what it is used for

To answer your enquiry, prepare a proposal, deliver an agreed project, invoice for it, keep proper business records and meet legal obligations. It is not used for unrelated marketing, and you are not added to a mailing list because you sent an enquiry or asked a tool for its results. The one list is tips and offers, you are on it only if you tick its box yourself, the box is never ticked for you, and every message carries a working unsubscribe.

Who else touches it

Only the service providers needed to run the business, each named rather than left as a category:

• Netlify, which hosts this site, runs the small functions that receive its forms and keep its count of visits, and holds the records described below.
• Google Workspace, which is the business email and calendar, and is where a form notification lands, where a reply is written, where a booked Scope Sprint is put in the diary and its invitation sent from, and where the studio’s own records of enquiries and estimates are kept.
• Stripe, which takes card payments. You give your card details to Stripe, not to me, and Stripe is the one holding them.
• Xero, which raises and records invoices, holding your business name, contact details and the amount.
• The Australian Business Register, which can be asked to confirm a business’s legal name, entity type and GST registration when an agreement is prepared. It is sent the ABN and nothing else, and what it returns is already public.
• Meta Platforms, and only for an estimate, a Website Diagnostic brief, or a request for the website score’s report, the lost leads breakdown or the Google profile check’s tips, that arrived from one of my Facebook or Instagram ads. It is sent a scrambled copy of your email address and, where you gave one, your phone number, your IP address, your browser details, the ad click code from the web address and the reference on your estimate or brief, or for a tool request a code made for that request, so that it can tell me the ad produced one. It is sent by my server, never by your browser, and one box on the form stops it entirely. The detail is under measuring my ads.

Each is used for its own function. Nothing is sold. The only thing handed to an advertising platform is the measurement described above, only for an estimate, a brief or a tool request that came from an ad, only from my server, and only until you tick the box that stops it. If a provider on this list changes, this page changes with it, under a new version.

Where it goes overseas

Yes, and here is where. Netlify and Google are United States companies and hold data there, and Google also processes in other countries where it operates facilities. Stripe states that it may transfer personal data to countries including the United States and India. Xero publishes that it replicates data between data centres in different locations without naming them, and its current stated position is recorded in my own supplier register, which you can ask for.

Meta Platforms processes outside Australia, including in the United States and Ireland, and receives only what is described below.

That is normal for cloud services and it is disclosed here rather than buried. No provider is used for a purpose other than the one it is named for above.

Measuring my ads

I advertise on Facebook and Instagram. An advertising platform that cannot see whether an ad produced anything optimises for clicks, so one thing is sent back to Meta, and this is exactly what it is.

When. Only when you arrive here from one of my ads and then send the estimate form or the Website Diagnostic brief, or ask for the website score’s report, the lost leads breakdown or the Google profile check’s tips by email. Not on a page view, not while you use a tool, not on any other form, and never if you reached this site any other way: my server checks that the visit came from an ad before it sends anything, because only a visit from an ad is shown the box that stops it.

What. A hashed copy of your email address and, where you gave one, your phone number, your IP address, your browser’s user agent, the ad click code from the web address you arrived on, the reference on your estimate or brief (for a tool request, a code made for that request when you arrived from the ad), and which form it was. Hashing turns an address into a scrambled code that cannot be read back; Meta can only match it against details it already holds, and learns nothing from it if it does not.

What it is for, and nothing else. So Meta can tell me which ad it came from. It is not used to build an audience from you, to advertise to you afterwards, or to follow you anywhere.

How. The connection is made by my server, after your submission has been recorded. Your browser never loads anything from Meta on this site, and no cookie is set. There is no pixel and no advertising script on any page here; the content security policy this site sends to your browser forbids one, and a build check refuses to publish the site if one is ever added.

How to stop it. Tick Don’t send my details to Meta on the estimate form, the Diagnostic brief or the free tool’s email form and none of it is sent. The box is there, unticked, on each of those forms whenever you have arrived from an ad, under a line saying what happens, and the full list of what is sent opens from “What is sent” beside it. Ticking it costs you nothing: you still get your estimate or your report, and your brief still reaches me. You can also ask me afterwards and I will tell Meta to delete it.

The ad click code and the campaign parameters are read from the address of the page you land on and held in your browser’s memory for as long as the tab is open. If you follow a link from the Website Diagnostic page to its sample report or the estimator, they are carried in the address of that link, the same way they arrived, and in nothing else. They are not stored on your device, and the click code is not kept in my own records either: those keep only that a click code was present, and which ad the visit came from.

Where a submission is recorded

A form submission is written to three places, and all three are described here rather than only the obvious one.

Where it arrives. In an ordinary browser a form is sent to this site’s own intake, which writes it into the communications record below and sends a notice to the business mailbox, where a person reads every one. If that intake does not answer, or your browser runs no script, the host’s form store receives it instead and sends its own notification. Either way it holds what you typed, and either way it is read by a person rather than filtered out by software.

A second record, so a lost enquiry is visible. A notification can land in spam or be filed by a rule, and then nobody knows an enquiry existed. So a small function records that a submission arrived: the time, which form, the submission identifier and the reference shown on your own screen, and the NAMES of the fields you filled in. It does not record what you typed. If a webhook to the business owner’s own systems is configured, that second copy does carry the submission, and it goes nowhere else. Where that is switched on, it writes a row into a private worklist in the Google Workspace account named above, and for an estimate it also files a document there holding your details, the figure and the answers that produced it, so the estimate exists as a record rather than only as a message. That account is Tony Pope’s own and nothing is shared out of it.

The point of the second record is that a missing enquiry shows up as a discrepancy between two records rather than as an absence in one. It is a receipt, not a copy.

A browser-sent security report. This site tells your browser to load nothing from anywhere except this site, and your browser reports it if that rule is ever broken. Those reports are logged so a blocked script or font is visible rather than silent. Four things are kept from each one and nothing else: which rule fired, the host that was blocked, the path of the page it happened on, and whether the rule blocked it or only reported it. The report your browser sends can also include a fragment of the blocked code and the page you came from; both are discarded before anything is written down. No report is ever tied to you and none is stored beyond the log.

The communications record. A private business record of what has passed between us: your submission as you wrote it, the reply that was sent back to you, and whether that reply actually went out. It is kept so that neither of us has to rely on memory about what was asked and what was answered, and so a reply that failed to send is visible rather than silent. It holds what you typed and the reply that was written back, and it deliberately does not hold your IP address or your browser details: the host adds those to every submission and they are removed before anything is written down, because they are not something you told us. It is on the site host, it is not readable from a public web page, it is not part of anything published, and it is read by Tony Pope in the studio’s own console, which only a person signed in with an emailed link can open. Nothing in it is ever added to a mailing list or used for any purpose other than answering you and keeping proper business records.

The reply, and who sends it. When you leave an email address you get an acknowledgement, and if you ran the estimator you get the estimate with every answer that produced it. That letter is recorded before it is sent and the outcome of the attempt is recorded after, so a letter that did not arrive can be found and sent again.

Agreements and signatures. If we go ahead, the agreement is prepared in the same private record and emailed to the person who will sign it, as a link that works only for that email address. The link is what identifies who signed, so no IP address and no browser details are kept for a signature either. What is kept is the agreement exactly as it was shown, the name typed to sign, the position given, the time, the email address the link was sent to, the boxes ticked, a fingerprint that proves which version was signed, and when the link was first opened (an email provider’s security scanner can open a link too, so that line records the link, not a person). Both of us receive the same signed copy. A signed agreement is kept as long as project and financial records are kept, below, because it is one.

Decisions made by software on this site

Two things here reach a conclusion without a person in the loop, and both are disclosed rather than left to be discovered.

The scope check takes eight answers about your job and returns whether it fits the standard product. It can return a decline. It runs entirely in your browser and none of your answers are sent anywhere, so it uses no personal information at all.

The estimator takes ten answers about your job and returns a price range or a fixed express price. It uses the answers you gave plus the name, business name, email address and optional phone number you entered. It decides which product your job looks like and what that costs, and it can decide that your job is outside the express tiers. The estimate is calculated automatically from your answers, and I read every one of them myself before any work is agreed. You can ask for a person to go through it with you at any point, and the number is not held against you if an answer turns out to have been wrong.

Neither decides whether you can buy, and neither ends the conversation: every result is an indication that a person then checks, and the record of the answers exists precisely so a wrong answer can be corrected by talking. From 10 December 2026 the Privacy Act requires this disclosure where software makes a decision that could significantly affect somebody. My own assessment is that a fit indication and a price range routed to a human conversation sit below that line, and the section is published anyway, because a reader deciding whether to trust a number is better served by knowing how it was produced than by my view of a threshold.

How long it is kept

Enquiries that do not become projects are kept while the enquiry is live and then for a reasonable period afterwards in case you come back. Project and financial records are kept for as long as business and tax record-keeping requires, then deleted. If you ask for your information to be deleted, anything not required to be retained will be.

The communications record described above has a retention window with a command behind it rather than only an intention, and running it reports exactly what it removed. A statement that records are cleared out on a schedule is worth nothing if nothing ever clears them out.

How it is protected

Multi-factor authentication on every account that holds it, least-privilege access, encrypted transport, and no copies kept on devices that do not need them. No system is perfectly secure and nobody honest claims otherwise. If a breach ever occurred that was likely to cause serious harm, you would be told, along with what happened and what to do about it.

Cookies and tracking

No cookies are set for anyone visiting this site, and no identifier is created for you. The one cookie this site can set is the sign in cookie for the studio’s own console, which only the people who run the studio can open.

Nothing loads from anybody else. No analytics service, no tag manager, no advertising pixel, no remarketing tag, no session recorder, no heat map, no chat widget, no third-party font, no embedded video. Every file on every page comes from this site, and the instruction this site gives your browser forbids anything else. That is why the fonts are served from here and the booking page is a link you press rather than a window inside this one.

The site’s own count of visits

This site counts its own visits. When a page opens, and when one of eleven named things is pressed or sent, your browser sends one short note to this site’s own address. This is everything a row of that count holds: the page; the day and the hour, never the minute; which of those things happened; whether you arrived from another page of this site; the website you came from, as its name only and never the page you were on; the campaign words on the address if you followed an ad or a tagged link; whether a Meta or a Google ad click code was on the address, never the code itself; and whether the window was the width of a phone, a tablet or a desk.

What is deliberately not in it. No cookie and no identifier. The count does not read or keep your IP address. Your browser’s own description of itself is read once, to tell a person from a search crawler, and is not written down. So a row holds nothing that joins it to another row, tells a second visit from a first, or matches it to an enquiry you sent. The name each row is filed under holds the day, the hour and a random number, and nothing else. It is a count of visits and it cannot become a record of you.

The eleven named things. A phone number tapped, an email address tapped, a payment button pressed, a booking link pressed, an enquiry form sent, the estimator run, the scope check run, a free tool started, a free tool finished, an email address given on a free tool, and a next step pressed on a free tool. Nothing you typed is included in any of them, only that it happened and on which page. Which tool it was is the page it happened on, so the tool’s name is not sent either.

Where it is kept and who sees it. On this site’s own host, in a private record that no web page can read, shown to Tony Pope as totals in the studio’s console. It is not sent to an analytics company, an advertising platform or anybody else, and it is not sold. The rows are kept for as long as they are useful for seeing how the site is doing, because a row with nobody in it has nothing in it to expire.

No banner, and how to stay out of the count

That is why there is no cookie banner. A banner exists to buy your permission to store something on your device or to follow you. Nothing is stored for the count and nobody is followed, so there is nothing to ask for, and being asked to click a box for the privilege of reading a page is a cost paid by every visitor for the benefit of the site owner. If that ever changes, a banner will appear and this section will be rewritten under a new version first.

Why it is here at all. Because without it nobody can say which page produced an enquiry, and a website nobody can measure is a website nobody can improve on purpose. It is also not recoverable retrospectively: a count only starts on the day it is switched on. That argument is made on this site as a paid recommendation about other people’s websites, and it would be hard to make honestly while declining to follow it here.

If you would rather not be counted. This site honours Global Privacy Control and the older Do Not Track setting: if your browser sends either one, the counting code stops before it sends anything, and this site’s server drops the note if one arrives anyway. A blocker you have installed may stop it too, and nothing on this site behaves differently or asks you to turn it off.

Some things are kept in your browser, in the tab you have open, and none of them is a cookie or a tracker. The estimator keeps your answers in sessionStorage, which is this browser tab, on your own device, so that pressing back does not wipe what you typed. Once you send the estimator, the same tab storage also holds the contact details you entered to see the figure, the estimate reference and the figure itself, so the enquiry form can be filled in for you. The Scope Sprint brief uses it to carry the name and email address you just typed, and your booking reference, onto the next page, where you pick the hour, so you are not asked for them twice. All of it is cleared when you close the tab, and none of it is sent anywhere except when you press the button that says it will be.

Access, correction and complaints

Email hello@evolutionwebstudio.com and say what you want: a copy of what is held, a correction, or deletion. Include enough for me to find you, which is usually the email address you used. There is no charge and no form.

You get an acknowledgement within two business days and an answer within thirty days, normally a great deal sooner. If I refuse any part of a request you are told which part and why, in writing.

If you are unhappy with how a privacy matter has been handled, say so to me first and it goes to Tony Pope rather than to a queue. If that does not settle it, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au.

Where this business sits under the Privacy Act

This practice is below the annual turnover threshold at which the Australian Privacy Principles bind a small business. It applies them anyway, in full, and this policy is written to the same content requirements as one that had no choice.

That is not generosity and it is worth being plain about why. A studio that holds the keys to other people’s domains, hosting and customer enquiries has no business holding itself to a lower standard than the one it asks its clients to meet. The threshold also does not protect anybody from the separate right to sue over a serious invasion of privacy, which applies to every business of every size.

Client sites

Where a website is built for a client, the client is responsible for their own site’s privacy handling. The data schedule in the project agreement records what their forms collect, which processors are involved, what tracking is present, how long data is kept and what is excluded, and the client approves it before launch. Sensitive or regulated intake is not built into the standard product.

Changes to this policy are published below with a version number and a date. Material changes affecting an active project are told to that client directly rather than left to be discovered.

Every version of this document

Changes are published here with a version number, a date and a note saying what moved. Nothing is edited quietly.

Version 1.19, 23 October 2026

A new section, tips and offers, only if you tick the box. Each free tool's form now carries an unticked, optional box reading "Send me tips and offers from Evolution Web Studio, unsubscribe anytime". Ticking it is recorded by this site's server against the email address with the time, the exact words shown beside the box and the page the form was on, with the name and business name given on that form, and is used only to send tips and offers by email from the studio's own business email, until the person unsubscribes or replies STOP. The record of a tick is kept for two years after the last of those emails. The short version and the section on why information is collected now say the same, in place of the sentence saying there is no mailing list. Anybody who asked a tool for its results before the box existed is not on the list.

Version 1.18, 23 October 2026

The free website score section now names everything the score reads: the page, its robots file, sitemap and llms.txt file, up to three linked pages and fifteen links, and the domain's public email records (whether it receives email, and its SPF and DMARC records). Those records are public facts about the domain, looked up the way any mail server looks them up, and nothing about you. The profile check's sentence now says it sends your answers rather than a number of them, because it asks more questions. Nothing new is collected about a person and nothing is kept longer.

Version 1.17, 23 October 2026

The free website score section now says that the addresses scored and what was found are shown to me in my own console, which only a person signed in with an emailed link can open, so I can see how the score is used and which reports were asked for, and that an address scored without a request for the report is never used to contact that business. Nothing new is collected and nothing is kept longer: the fourteen days are unchanged.

Version 1.16, 21 October 2026

Asking for the website score's report, the lost leads calculator's breakdown or the Google Business Profile check's tips by email is now measured for my ads, in the same way as the estimate and the Website Diagnostic brief, but only when you arrived from one of my Facebook or Instagram ads and only until you tick the box that stops it. The short version, the free tools section, the Meta entry under who else touches it and the section on measuring my ads now name those three requests. For a tool request Meta is sent a code made for that request in place of an estimate reference, and no phone number, because a tool form does not ask for one. The ownership checklist and the trade checklist packs are not measured. The notice on each measured form is now one line saying what happens, with the full list of what is sent opening from "What is sent" beside it, and the box under it is unchanged.

Version 1.15, 20 October 2026

Asking about a site for sale. The section now says the details are used only to answer you about that site and, if you go ahead, to complete its sale; that they are not added to any list or used to offer you anything else; how long they are kept, by pointing to the existing retention section; and that a site's sales, visits and supplier details are shown only after a written confidentiality agreement, with nobody else's details ever passed on.

Version 1.14, 20 October 2026

The free tools and the sites for sale. A new section says what each free tool reads and keeps: the website score reads the address you type from this site's own server and keeps the result for fourteen days under a random code, holding nothing about you; your IP address is used in memory to limit how many scores one visitor runs and is never written down; the lost leads calculator and the ownership checklist send nothing unless you ask for the figures by email; the trade checklist packs take the trade, the state and your email address. It says that a tool's email is a one off that does not add you to a list, how to stop anything else arriving, and that an unsubscribe keeps only a one way hash of the address. It lists what a buyer's enquiry about a site for sale collects. The count of visits now names eleven things rather than seven: a free tool started, a free tool finished, an email address given on a free tool and a next step pressed on a free tool join the list, and the tool's name is never sent because the page already says which tool it was.

Version 1.13, 8 October 2026

Google Analytics has been removed and this site now counts its own visits. Versions 1.1 to 1.12 said Google Analytics counted page views here with every storage permission set to denied. It was sent the address of each page opened, the address of the page before it and the type of device and browser, and because it was allowed to store nothing it reported none of it, so on 8 October 2026 it was taken off every page. In its place the site keeps its own count: the page, the day and the hour, what happened, the website a visit came from, any campaign words on the address and the size class of the screen, with no cookie, no identifier and no IP address, and it is sent to nobody else. Google Analytics is removed from the list of who else touches your information, Netlify's entry now says it keeps the count, the paragraph about browser security reports no longer mentions measurement addresses because there are none, and the cookies section is rewritten to say what a row of the count holds and what it is built not to hold. That section now also names the one cookie this site can set, which is the sign in cookie for the studio's own console, and says plainly what is kept in the tab you have open: the estimator's answers and, once it is sent, your contact details, the estimate reference and its figure, and for a Scope Sprint your name, email address and booking reference. Earlier versions named the scope check there, which keeps nothing, and left out what the estimator keeps after it is sent. The paragraph about browser security reports now lists the fourth thing a report has always kept, which is whether the rule blocked something or only reported it. The scope check's own sentence now says none of your answers are sent anywhere, where it said nothing is, because the count notes that the check was run. The promise that a banner will appear before anything is stored on your device for measurement is unchanged, and nothing is.

Version 1.12, 6 October 2026

The form for a Website Diagnostic or a Scope Sprint is now optional and is offered after payment, where it used to come first, and the policy says so. It adds that when the form is opened from the page that follows a payment, that page's address carries the payment's checkout identifier, or for a Sprint the booking reference, and the form sends it so the detail is filed with the order. The payment paragraph says the Diagnostic's checkout asks for the web address again, with what is not working and an estimate reference as optional fields, lists the phone number typed at the checkout, and describes the reference a payment can carry in place of saying every payment carries one from a brief. The Sprint paragraph calls its reference a booking reference, because the booking page makes it and no form has to be sent first.

Version 1.11, 2 October 2026

A Website Diagnostic or Scope Sprint brief now asks for your name as well as the web address, the business name and the email address, and the policy lists it as required. The payment paragraph adds that when a card is declined or a checkout is left unpaid and the payment carries the reference on a brief, the two are matched and the contact details given on that brief are used to ring or write about it. Until this version the follow up could only use what reached the payment page, which for a checkout left unpaid is nothing. It also says that anyone who asks not to be contacted about it will not be.

Version 1.10, 2 October 2026

The estimator's result screen records two things after the estimate itself, and the policy now says so. The collection paragraph for the estimator adds that the extras a person ticks to do themselves are noted against their reference, so the figure they are answered with is the one on their screen, and that their answer to whether the figure was in the range they had in mind is noted the same way. The budget answer has been recorded since 1 October 2026 and was not listed until this version. Neither sends the person anything, and both are kept and used exactly as the estimate itself is. The collection section also gains two sub-headings, When you pay or book, and From the site itself, an agreement and a project, so a reader can find the paragraph they want; no other wording under them changed.

Version 1.9, 30 September 2026

A declined card and an abandoned checkout are now told to the business, so the payment paragraph says so: the details that reached the payment page come back with the reason the payment provider gave, so the business can get in touch and help finish it, and nothing is sent to the buyer automatically when that happens.

Version 1.8, 30 September 2026

The Scope Sprint is now booked and paid on this site, so the policy says what that moves and where. A new paragraph, When you book a Scope Sprint on this site, says the email address, the hour and the brief reference are handed to Stripe to open the checkout, that after payment the hour, the name and the email address go into the business calendar in Google Workspace, which sends the invitation, and that the site keeps a small record of which hour is held or sold that holds the brief reference and the payment identifier and no name, email or phone number. Google Workspace's entry now says a booked Sprint is put in the diary from there. The payment paragraph says a Sprint payment carries the brief reference as a Diagnostic's already did. The tab storage paragraph names the Sprint brief carrying the name and email onto the booking page.

Version 1.7, 30 September 2026

Agreements are now prepared and signed on this site, so the policy says what that records. A new paragraph, Agreements and signatures, says the agreement is emailed as a link that works only for the signer's address, that the link is what identifies who signed, and that no IP address or browser details are kept for a signature. It lists exactly what is kept: the agreement as shown, the name typed, the position, the time, the address the link went to, the boxes ticked, a fingerprint of the version signed, and when the link was first opened, with a note that an email scanner can open a link too. The collection section gains what an agreement asks for, and the Australian Business Register is named as a recipient of an ABN when a business's details are confirmed. The communications record paragraph now says it is read in the signed-in console; until this version it still said a terminal.

Version 1.6, 24 September 2026

The Website Diagnostic brief is measured the same way as the estimate, and the server checks who may be measured before it sends. An ad now points at the Website Diagnostic, so a brief sent by somebody who arrived from that ad is reported to Meta exactly as an estimate is, with the same notice and the same unticked box on the brief. The When, What, How to stop it and Meta recipient paragraphs name the brief beside the estimate, and a sentence says the ad's parameters are carried in the address of a link from the Diagnostic page to its brief, sample or the estimator, and in nothing else. The When paragraph also says the server now checks a visit came from an ad before sending, because until this version it did not: version 1.5 promised a Lead only for a visit from an ad, and an estimate from a visitor who typed the address in could be sent without that visitor ever being shown the box. The collection section gains the brief's fields, which it never listed, and drops a sentence saying the Diagnostic checkout asks for the web address, which stopped being true when the brief moved in front of the payment. Nothing new is collected from anybody, and nobody new receives it.

Version 1.5, 23 September 2026

Measuring the ads. The studio is starting to advertise on Facebook and Instagram, and version 1.4 said there was no advertising tracking and that nothing is handed to an advertising platform. Both sentences stop being true the moment an ad produces an estimate, so this version is published before the first dollar is spent rather than after. What is added: Meta Platforms as a named recipient, a section setting out exactly when a Lead is sent, what it contains, what it is for and how to stop it, and the overseas processing line. What is NOT added is as important: no pixel, no advertising script, no cookie and no browser request to Meta from any page here, because the send is server to server and the content security policy forbids the other kind. The estimator's paragraph now says plainly that a person reads every estimate before any work is agreed.

Version 1.4, 22 September 2026

Where a form submission arrives. Forms are now sent first to this site's own intake, which writes them into the communications record and notifies the business mailbox, with the host's form store as the fallback. The change exists because the host's spam filter was found filing genuine Diagnostic briefs where nobody would read them. Nothing new is collected, nobody new receives it, and retention is unchanged. The Netlify line now describes what Netlify actually does here, and no longer says there are two forms.

Version 1.3, 11 September 2026

The opening paragraph names who the operator works with, and it read "Queensland, and remote across Australia". The practice serves small businesses anywhere in Australia and always has, so the sentence now says that. No change to what is collected, who receives it, how long it is kept or any right under it: the only thing that changed is the description of the market, which is a correction rather than a new position. Recorded as a version because this paragraph is inside the fingerprinted body and a published term that can change silently is a term nobody can rely on.

Version 1.2, 11 September 2026

Enquiries and estimates are now filed into the studio's own Google Workspace, where the operator's worklist and the estimate documents are kept, so the Google Workspace entry names that and the second-record section says what gets written there. Nothing new is collected and no new company receives anything: the recipient was already named for mail and calendar, and this says what else it holds. Published before the capture was switched on, because a disclosure that arrives after the first record is written is late.

Version 1.1, 11 September 2026

Google Analytics 4 was installed. Version 1.0 said this page would be rewritten under a new version before analytics went live, so this is that rewrite: Google Analytics is added as a named recipient with what it receives and what it is never given, the cookies section now states that consent mode is denied for every storage category so no cookie is written and no client identifier is kept, the seven measured actions are listed, and the Global Privacy Control and Do Not Track behaviour is published. No cookie banner, because nothing is stored to consent to.

Version 1.0, 11 September 2026

First version under the register. Adds the payment processor as a named recipient, the Diagnostic's single collected field, and the automated decision section that the Privacy Act requires from 10 December 2026.

The visible text of this document is fingerprinted when the site is built and checked against the version above. Change a word without adding a version here and the build fails, so the change cannot reach the internet. A list of changes nothing enforces is a list of the changes somebody remembered to write down.