Privacy policy

1. Who we are

Streetfront is a business run by Andres Esteban Fontiveros Rodriguez, trading as Streetfront (ABN 71 463 939 713), based in Melbourne, VIC, Australia ("we", "us"). We build and look after websites for small businesses. You can contact us about privacy at [email protected].

2. Our approach and the Privacy Act

The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) set rules for handling personal information. Many small businesses with an annual turnover of $3 million or less are exempt from the Privacy Act. Even if that exemption applies to us, we choose to handle personal information in line with the APPs, and this policy explains how.

We only collect personal information that we need to reply to you, provide our services, and run our business. We don't sell personal information, and we don't use it for anything unrelated to our services.

3. What we collect

When you contact us

If you email us or use our get-started form, we collect what you send: usually your name, business name, type of business, email address, current website and your message. Our form currently works by opening your own email app, so your details reach us as a normal email.

When you become a client

Business details: business name, ABN, address, opening hours, services, fees and booking link.
Details about you and your team that you choose to put on your website: names, roles, professional registration details, short bios and photos.
Domain registration details required by the .au rules (the registrant is your business, and auDA's registry rules apply).
Access you grant us to services such as your Google Business Profile or domain. We ask for delegated "manager"-style access where available, and we never ask for your passwords.
Our email correspondence with you, including change requests and approvals.

Payments

Payments are processed by Stripe. Stripe collects your card or bank account details directly. We don't see or store full card numbers or full bank account numbers. We can see limited information such as your name, email, billing details, payment status and the last four digits and brand of your card.

Sensitive and health information

We don't need, and ask you not to send us, any health or other sensitive information about your customers or clients. If you're a health practitioner, please don't include details about the people you treat in emails to us.

4. How we use it

To reply to your enquiry and send you the information you asked for.
To build, host and maintain your website, carry out change requests and provide the services in your plan.
To bill you, keep records and meet our legal and tax obligations.
To keep our services and systems secure.
To send you service emails (for example invoices, notices of changes to our terms or prices, and confirmations of completed work).
If you join the AI Phone Assistant waitlist, we use your email only to tell you about this product, and you can opt out anytime.
Occasionally, to email businesses about our services in line with the Spam Act (see section 11).

We share personal information only with service providers who help us run the business, and only as needed:

Stripe: payment processing and subscriptions.
Our email provider [to confirm: Google Workspace or Zoho Mail]: to send and receive email.
Our hosting provider [to confirm: Cloudflare Pages or Netlify]: to host our website and our clients' websites.
Domain registrars and the .au registry: to register and renew domain names in our clients' names.
A form-handling service, if we start using one for our get-started form [none at the time of writing].
Professional advisers (such as an accountant or lawyer), and government authorities where the law requires it.

6. Overseas disclosure

Some of our service providers store or process information outside Australia. Depending on the provider, this may include the United States, countries in the European Union and other locations where they run data centres. We choose established providers that publish security and privacy commitments, and we take reasonable steps to make sure they handle personal information consistently with the APPs. By contacting us or becoming a client, you understand that your information may be handled overseas in this way.

7. Our website, cookies and analytics

Our own website does not set cookies and does not use advertising or tracking tools. Like all websites, our hosting provider automatically records basic technical information (such as IP address, browser type, pages requested and the date and time) to deliver the site and protect it from abuse.

If we add website analytics in future, we'll prefer a privacy-friendly, cookie-free option and update this policy first.

8. Websites we build for clients

For websites we build and host for clients, the client is responsible for its own website's privacy policy and for the personal information its visitors send it. Contact forms on client sites send enquiries to the client's email. We act as the client's service provider, and we don't use those enquiries for our own purposes. We recommend that clients don't collect health or other sensitive information through website forms, and we add a note to that effect on the forms we build.

9. Security and how long we keep it

We take reasonable steps to protect personal information from misuse, loss and unauthorised access. These include two-factor authentication on our accounts, limiting access to what's needed, and using reputable providers. No system is perfectly secure. If we become aware of a data breach that's likely to cause someone serious harm, we'll tell the people affected and take steps to contain it, and we'll notify the Office of the Australian Information Commissioner (OAIC) where the law requires.

We keep enquiry emails that don't lead to work for up to 24 months, then delete them. We keep client and billing records for as long as we provide services and afterwards for as long as tax and other laws require (generally at least 5 years). We then delete or de-identify them.

10. Access and correction

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We'll respond within 30 days. If we can't give you access or make a correction, we'll explain why in writing. We don't charge for these requests.

11. Email and the Spam Act

We follow the Spam Act 2003 (Cth). When we send a commercial email:

we only send it with your consent. This can include consent the law infers when a business has conspicuously published its email address and our message relates to that business.
we clearly identify Streetfront as the sender and include our contact details.
we include a simple way to unsubscribe (replying "unsubscribe" always works), and we honour unsubscribe requests within 5 working days.
we don't buy email lists or use address-harvesting software.

Service emails to clients (invoices, notices and confirmations of work) continue while you're a client.

12. Questions and complaints

If you have a question or complaint about how we've handled your personal information, please email [email protected] with the details. We'll acknowledge it within 5 business days and aim to resolve it within 30 days.

If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992. (Note: if we're exempt from the Privacy Act as a small business, the OAIC may not be able to investigate, but we'll still do our best to resolve your concern.) For complaints about spam, you can contact the Australian Communications and Media Authority (ACMA) at www.acma.gov.au.

13. Changes to this policy

We may update this policy from time to time. We'll post the new version here with a new "last updated" date, and we'll email clients about any significant changes.