Your Privacy

1. Who we are

KoalaDigital Pty Ltd (ABN 39 614 832 450), “we” or “us”, is a software engineering business in Sydney. We provide:

• Professional Website Review: an expert review of a business's website, with a written report.
• Website Support & Integration: fixing, improving and connecting websites and online systems.
• SAM Engine: local Google and Meta (Facebook and Instagram) advertising, Focus Funnels (focused landing and booking pages), booking forms, dashboards and monthly reports, and posting to our clients' social pages.
• Senior Software Engineer On Demand: engineering for software teams.

This policy covers koaladigital.com.au, the sites and tools we build and run (including the SAM Engine), and the connections we make to Meta and Google for our clients. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for clients and their customers in New Zealand, the Privacy Act 2020 (NZ). Questions or requests: bach@koaladigital.com.au.

2. What we collect

Only what we need for the work. Depending on how you deal with us:

When you contact us

Your name, business, email, phone or WhatsApp number, and what you tell us in your message, including any files you send.

Website reviews

Your website's address and its public pages (including screenshots we take of them), your answers to our questions, and your contact details, so we can write and deliver your report.

Website support, integration and engineering

Access you give us to your systems (for example hosting, a website builder, code, email or booking tools). Those systems may hold personal information about your customers or staff; we only look at what the job needs.

SAM Engine

• When you start an engine: your name, business name and type, suburb, website, what you want more of, email and (if you give it) mobile.
• Payments: card payments are processed by Square (and, for some older services, Stripe). We never see or store your full card number; we receive a receipt with the amount, date and the card's brand and last four digits.
• The settings you choose, such as your daily advertising budget, and the progress of your build.
• Advertising and page data from Google and Meta, when you give us access to your accounts (see sections 7 and 8).

Businesses we may work with

To offer our services, we collect business contact details that are publicly available (for example from public business registers, directories and businesses' own websites), and notes of our conversations. If you'd rather we didn't contact you, tell us and we'll stop.

This website

koaladigital.com.au doesn't use analytics or advertising trackers. It sets only the cookies it needs to work: one that keeps you signed in to your own SAM Engine page, and sign-in cookies for our own staff tools. Our hosting providers keep standard server logs (such as IP addresses) for security.

We don't ask for sensitive information (such as health, religion or political views), and our services aren't directed at children.

3. How we collect it

• From you: in messages, forms, calls, meetings and when you order a service.
• From accounts and systems you connect to us, such as Google Ads, Meta, your website or booking tools.
• From public sources, such as business registers, directories and public websites.
• From your customers, through the websites and forms we run for you (see section 9).

4. How we use it

• To provide what you've asked for: reviews, support, engineering, building and running your SAM Engine, ads, posts and reports.
• To take payments, send receipts, and keep business and tax records.
• To talk to you about your work, and to send your engine's private link and updates.
• To keep our systems secure and to meet legal obligations.
• To tell you about our own services. You can opt out of marketing at any time, by replying “stop” or emailing bach@koaladigital.com.au.

We don't sell, rent or trade personal information, and we don't use it for anyone else's advertising.

5. Who we share it with

Only the providers that help us do the work, each bound by its own privacy and security terms:

• Square and Stripe (payments)
• Resend (email delivery), Meta's WhatsApp (messages)
• Neon (database), Netlify and Vercel (website hosting), GitHub (code)
• Google and Meta, when we run ads or pages for you, through the access you've given us
• AI tools (such as Anthropic and OpenAI) that help us write, design and build. We keep personal information out of them wherever we can, and only use business services that don't train their models on what we send.

We may also disclose information where the law requires it, or to a buyer if our business is sold (who would then be bound by this policy).

6. Storage outside Australia

Several of these providers store or process information outside Australia, mainly in the United States and in other countries where they run data centres (including in Europe and Asia). We choose established providers with strong security, and we take reasonable steps for them to handle your information consistently with the Australian Privacy Principles.

7. Facebook and Instagram (Meta) data

When a client gives our business access to their Meta ad account, Facebook Page or Instagram account, our app connects to Meta's Marketing API and Pages API. Through that access we may receive: ad account and campaign settings and results, ad creative, audiences and leads from the ads, Page posts and their reach, and comments and messages on the Page if we're asked to manage them.

• We use this data only to run that client's advertising and pages, publish posts they've approved, and report results to them.
• We don't sell, license or share it with anyone else, don't use it to build profiles of people, and don't use it for decisions about anyone's eligibility (for example for housing, credit, employment or insurance).
• We don't use Facebook Login on our websites, so we never receive anyone's Facebook profile through them.
• We follow Meta's Platform Terms and Developer Policies.
• We delete Meta data when it's no longer needed, when the client removes our access, or when asked (see section 13).

8. Google data

With a client's permission we connect to their Google Ads account through our Google Ads manager account, to run their ads and prepare reports. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: we use it only to provide those services, don't transfer it except as that policy allows, and don't use it for advertising to anyone else.

9. Your customers' information

When we build and run a website, Focus Funnel or booking form for a business, the enquiries and bookings their customers make (such as names, contact details, booking details, and children's first names and ages where a booking form asks a parent for them) are that business's information. We hold and process it on their behalf, only to run the service, and they're responsible for telling their customers how it's used. A customer of one of our clients can contact that business, or us, about it.

10. Keeping it safe

We use encrypted connections, limit access to the people who need it, protect our accounts with strong passwords and two-step sign-in, and keep keys and passwords in a password manager, never in our code. Card numbers are handled only by our payment providers. If a data breach is likely to cause serious harm, we'll notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

11. How long we keep it

While you're a client or in conversation with us, and afterwards only as long as we need to: business and tax records for the period the law requires (usually five to seven years). Everything else we delete or de-identify when it's no longer needed, or when you ask.

12. Seeing and correcting it

You can ask what personal information we hold about you, and ask us to correct it, by emailing bach@koaladigital.com.au. We'll respond within 30 days, free of charge, unless the law allows us to refuse (we'd tell you why).

13. Deleting your data

To have your data deleted: email bach@koaladigital.com.au with “Delete my data” and the name, email or business you used with us. We'll delete it within 30 days and confirm by email, keeping only what the law requires us to keep (such as payment records).

If you gave us access to a Facebook Page, Instagram account or Meta ad account:

1. Remove our access: in Meta Business Suite, go to Settings → Partners (or the Page or ad account) → KoalaDigital → Remove. From then on we can't see or change anything there.
2. Email bach@koaladigital.com.au and we'll delete the Meta data we'd kept (reports, copies of posts and ads, audiences, leads) within 30 days.

Google Ads: remove the link to our manager account in your Google Ads account (Admin → Access and security → Managers), and email us to delete what we'd kept.

14. Complaints

If you think we've mishandled your information, email bach@koaladigital.com.au. We'll acknowledge it within a few days and respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).

15. Changes and contact

We'll update this policy when what we do changes, and show the date at the top. For anything about your privacy: bach@koaladigital.com.au, KoalaDigital Pty Ltd, Sydney, Australia.