What happens to your details when you contact me.

Three ways I end up holding something of yours.

• The free presence audit form on the home page. Your name, your business name, your phone number, a website or Google link if you have one, and a note about anything you want looked at. Only the name and the phone number are required. Leave the rest blank if you'd rather.
• The email signup on the home page. Your email address. Nothing else, and no name field, because I don't need one to send you a post.
• Contacting me directly. Call, text or email me and I have your number or your address plus whatever you chose to tell me. Same if you message me on LinkedIn, GitHub, TikTok or Facebook, or leave a Google review: that sits on the platform under the platform's rules, and I see what it shows me.

If you go on to become a client there is more, because the work needs it: the detail of the job, access to whatever system I'm fixing, your invoices, and the messages between us. I take what the job needs and nothing past it.

I don't ask for anything sensitive. No date of birth, no bank details on this website, no health or government identifiers. If a job ever needs something like that, I'll ask you for it directly and tell you why.

Nothing you type is sent to this website.

This is worth being precise about, because most privacy policies describe a server quietly swallowing your data. This site doesn't have one. There is no database behind it and no address that receives form submissions.

When you press Text it to me, the page writes your answers into a text message and opens your own messaging app with it already composed. When you use the email signup, it opens your own email app with the message ready. Either way you can read it before it goes, edit it, or close it and send nothing.

If you do send it, it travels the way any text or email you write travels: through your phone carrier or your email provider, to my mobile number or my inbox. Until you press send in your own app, I have nothing at all. That is why there's no "thanks, your details were submitted" screen. There was nothing to submit.

The one thing collected without you typing anything.

This site runs on a web server I rent and control. Like nearly every web server on the internet, it keeps an access log: the IP address a request came from, the time, the page asked for, and the browser identification string your browser sends.

I use it for two things. Checking the site is up and serving pages, and working out what broke when something breaks. I don't build a profile of you out of it, I don't sell it, and it isn't wired into any advertising system.

That log is the only automatic collection here. There is no analytics package, no tracking pixel, no tag manager and no advertising script anywhere on this site. The cookie policy goes through that in detail.

What I use your details for.

• To reply to you, and to do the audit or the work you asked me for.
• To send you the audit report once it's written.
• To quote, invoice, and keep the financial records the tax law requires.
• To email you when something useful lands here, and only if you joined the list.

That's the entire list. I don't use your details to target advertising at you on other platforms, and I don't feed them into an advertising system, because I don't run one.

You only hear from me if you asked, and stopping it is one message.

I'll email or text you if you contacted me and I'm replying, or if you asked to be on the list. That's the whole basis for it.

Joining the list happens by sending me an email from your own address, so the consent is your own message, in your own words, which is about as clear as it gets. Every email I send will say plainly that it's from me and how to stop it.

To come off the list: reply to any email with "stop", text 0412 517 647, or email me. No form, no reason required, and no attempt to talk you out of it. I'll action it the day I see it, and at the outside within five working days.

I don't sell your information, and here is everyone who touches it.

Nobody buys a list off me, because there is no list to buy. What follows is the honest and complete set of third parties involved, and they're involved because a message has to physically travel somewhere.

• My mobile carrier, if you send the audit details as a text message.
• Google, because my published address is a Gmail address, so anything you email me sits in Google's systems the same way email to any Gmail account does.
• The company that rents me the server, which physically holds the access log described above.
• Google Maps, if you visit the home page. The map near the bottom is a frame served by Google, so Google receives your IP address and browser details when the page loads, whether or not you touch the map. That one is covered properly on the cookie policy page.

I'll also hand information over if the law actually requires it: a court order, a warrant, or a legal obligation I can't refuse. I'd tell you that had happened unless I were prohibited from telling you.

If that list ever changes, because I add a booking system, an email platform or analytics, this page gets updated before the thing goes live, not after.

Not forever, and not "as long as necessary".

• Enquiries that went nowhere. Cleared out once I'm finished with them, and no later than 12 months.
• Client records. Seven years after the work ends, because tax law requires me to keep invoices and financial records that long.
• The email list. Until you unsubscribe. Then you're removed.
• Server logs. I don't archive them, and I delete them once they're no longer useful for diagnosing a problem.

The number of places it sits is small on purpose.

Your details live in my phone, my email account and my own machine. That's it. Fewer copies in fewer systems is the single most effective thing a business my size can do about security, and it's deliberate rather than accidental.

Those accounts carry long unique passwords and two factor authentication where the provider offers it. No system is perfectly secure and I won't pretend otherwise. If something of yours were exposed in a way likely to cause you harm, I'd tell you, and I'd notify the Office of the Australian Information Commissioner where the law requires it.

Ask for a copy, a correction, or deletion.

You can ask me what I hold about you, ask me to fix something that's wrong, or ask me to delete the lot. Text, call or email. You don't need a reason and there's no charge.

I'll come back to you inside 30 days, and realistically much faster than that. If your details are only in a text thread and an inbox, deleting them takes me a minute.

The single exception is a record I'm legally required to keep, such as an invoice still inside the seven year window. If that applies to you, I'll tell you exactly what I'm keeping and why, rather than quietly keeping it.

Come to me first, then go over my head.

Tell me what went wrong: 0412 517 647, or oscarjameschapman@gmail.com. I'll respond within 30 days, in writing if you want it in writing.

If I don't fix it, or you don't accept my answer, take it to the Office of the Australian Information Commissioner. The OAIC is the national privacy regulator and handles complaints about how businesses treat personal information. You'll find them at oaic.gov.au or on 1300 363 992. You don't need my permission and you don't have to tell me you're doing it.

One thing worth saying out loud: a business my size is often exempt from the Privacy Act, which generally applies to businesses turning over more than $3 million a year. I'm not using that as a reason to be careless with your details. The commitments on this page are the ones I keep either way.

The person responsible for all of the above.

If this policy changes, the date at the top changes with it. Nothing here reaches back to information I've already deleted.

I work at your business rather than from a shopfront, so there's no public street address to publish. Post is best arranged by texting me first.

Also here: terms of service and the cookie policy.