What Is Collected, and Why

Probably not because it has to. The Australian Privacy Act has long exempted businesses under three million dollars of annual turnover, and a business this size sits well inside that. Reform to remove the exemption has been announced and widely written about, and the regulator's own published guidance still describes the threshold as current, so the honest answer is that the position may change.

The page is here regardless. A business that builds other people's data pipelines, and writes their privacy pages for them, should be able to say plainly what it does with yours. It would be a poor advertisement to be the only site in the portfolio without one.

What you type. Your name, your email address, and your message. Optionally your company and your website, if you fill those in. On a Partner enquiry, a note about any criterion you do not meet, if you choose to write one. There is no phone field and none is asked for.

What the form records around it. The page that referred you and your browser's user agent string. Both are stored with the enquiry. Neither is used to build a profile of you, and neither is shared.

A hidden field. The form carries a field that is invisible to people and attractive to bots. If it is filled in, the submission is discarded. Nothing about you is recorded when that happens.

Every enquiry is scored out of one hundred against a fixed rubric, and both the score and the reasons for it are stored alongside your message. It weighs things like whether there is enough detail to respond usefully and whether the enquiry matches the kind of work offered here.

It decides nothing on its own. It orders a list so that a reply is not governed by who happened to write last, and every enquiry is read by a person. It is mentioned here because a score held about you is personal information, and a privacy page that quietly omitted it would be the kind of page this one is trying not to be.

Stored. The enquiry is written to a Supabase database, hosted outside Australia, reachable only with a server-side key that is never sent to your browser.

Notified. Your name, email, company, website, message and score are sent to a private Telegram channel, so that an enquiry is seen the same day rather than the next time an inbox is opened.

Acknowledged. A plain text reply is sent to your email address through Resend, an email delivery service. It quotes your own message back to you so you have a record of what was sent, which means the text of your message passes through Resend as well.

There is no advertising pixel, no marketing tag, and no third party building a profile of you as you read. This site sets no cookies of its own, which is why you are not being asked to dismiss a cookie banner.

It does count visits. Two measurement scripts run: a first-party collector on infrastructure belonging to the same group, and Vercel Web Analytics. Both are cookieless, both record that a page was viewed rather than who viewed it, and neither can recognise you on another site or on your next visit.

Your information is never sold, and it is never passed to anyone for their own marketing.

Only the services needed to run the business: Supabase for the enquiry store, Telegram for the notification, Resend to deliver email, Vercel for hosting and visit counts, and Google Workspace for the mailbox your reply arrives from. Each holds data under its own terms and several store it outside Australia. They process it on this business's behalf and for no other purpose.

Enquiries that turn into work are kept for as long as the engagement runs and for seven years afterwards, which is the ordinary business records period. Enquiries that go nowhere are kept for two years, long enough to recognise a returning conversation, and are then deleted.

The acknowledgement email sits in your inbox and in the sending mailbox for as long as either of you keeps it.

Email hello@wizardworks.io and ask. You can have a copy of everything held about you, have it corrected, or have it deleted. There is no charge and no form to fill in, and you will get an answer within thirty days.

Deletion means deletion: the database row, the Telegram message and the mailbox thread. If something cannot be removed, such as a figure that has already gone into accounting records, you will be told that plainly rather than have the request quietly half-done.

If data held here is lost or exposed in a way likely to cause you harm, you will be told, and told what was involved rather than a reassuring summary.

If you are unhappy with how a privacy matter has been handled, raise it at hello@wizardworks.io first. If that does not resolve it, the Office of the Australian Information Commissioner at oaic.gov.au takes complaints about businesses operating in Australia.

If what this site collects changes, this page changes in the same commit and the review date above is updated. That is a rule the codebase enforces on itself rather than an aspiration: the analytics on a client site were added and its privacy page corrected in a single pull request on 24 September 2026, for exactly this reason.

The terms cover the commercial side: what is agreed, what it costs, what you own and who may name you as a client.