Privacy

Cirrus Digital is a web design business in Melbourne, run by Tim Hewitt as a sole trader. We handle personal information in line with the Privacy Act 1988 and the Australian Privacy Principles.

Questions about this policy go to tim@cirrusdigital.com.au.

We collect only what we need for the work, and in the ways below.

• When you visit this site: the pages you view, your browser and device, an approximate location, and your IP address. Our host keeps short-term server logs, and Google Analytics records visits using cookies.
• When you book a call: your name, email address and anything you write in the booking form.
• When you email us: your message and contact details.
• When we research clinics: information clinics publish themselves, such as their website, business listing and published contact details. We use it to audit the clinic's website and to contact the clinic about our work.
• When you become a client: your contact details, the content and files you send us, your answers to our intake forms, and billing details.

Card and bank details for payments are collected and held by our payment provider. We never see or store them.

• To reply to you, run calls, and prepare proposals and reports.
• To build, host and maintain client websites.
• To send invoices and collect payment.
• To understand how people use this site, so we can improve it.
• To keep the site and client portals secure.

We don’t sell personal information, and we don’t use it for advertising.

When we build or look after a clinic’s website, enquiries and bookings made by that clinic’s patients belong to the clinic. The clinic’s own privacy policy covers them. We access that information only when the work requires it, and use it for nothing else.

We use service providers to run the business. Each receives only what it needs to provide its service.

• Vercel: website hosting.
• Neon: our database, hosted in Sydney.
• Google: email (Google Workspace), Google Analytics, and public business listing data.
• Cal.com: call bookings.
• Stripe: invoicing and payments.
• An email delivery provider for messages sent from our client portal.
• Our accountant and accounting software, for tax records.

We also disclose information when the law requires it.

Our database and our website servers are in Sydney. Some of the providers above store data overseas, mainly in the United States. We choose providers with established security and privacy practices.

Google Analytics sets cookies to count visits and see which pages are used. It runs on this site’s public pages and never on client portals. You can block it with your browser settings or with Google’s opt-out add-on.

Client portals set one cookie that keeps you signed in for up to 90 days.

Access to client information is limited to us and protected by passwords, encryption in transit and at rest, and our providers’ security controls.

We keep personal information while we need it for the work, and financial records for as long as tax law requires. After that we delete it or remove anything that identifies you.

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to stop contacting you. Email tim@cirrusdigital.com.au and we’ll respond within 30 days.

If you’re unhappy with how we handled a privacy concern, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We update this policy when the way we handle information changes. The date at the top shows the latest version.