Privacy

Sites and Servers is an Australian business. You can reach us at hello@sitesandservers.com.au. We handle personal information in line with the Australian Privacy Principles. This notice was last updated on 30 September 2026.

The forms

The contact, quote, app, build-it-yourself, growth plan and affiliate forms ask for your name and email address plus, if you choose, a phone number, a business name, a website address and a message. If you built a quote in the configurator, the configuration (package, page count, add-ons and hosting plan) is included with it. Nothing is sent until you press the button.

When you send a form, your entry goes to a small program on our own web server, which checks it and emails it to our mailbox from noreply@sitesandservers.com.au with your address as the reply-to. That email is the record. The server does not keep a copy of form entries in a database.

To keep the forms free of automated spam, three things happen. Each form includes Cloudflare Turnstile, a check that runs in your browser and tells our server that a person sent it. Turnstile is run by Cloudflare, Inc. in the United States and may set a cookie for that purpose and process your IP address and browser details. The form also has a hidden field that people never see but automated programs fill in; entries with it filled are discarded. Our server also counts submissions per IP address for an hour at a time to refuse floods. That count holds only the IP address and the times.

We do not add you to a mailing list and we do not sell or pass on your details.

The free website check

When you check a website, the address you enter is sent to Google PageSpeed Insights (Google LLC, United States) to measure it. Our server also fetches the site's home page, robots.txt and sitemap. The result is kept on our server for 24 hours per website address so repeat checks are quick. If you ask for the report by email, it is sent to the address you give and that address is used for nothing else.

The configurator

The price you build on the websites page is worked out in your own browser. Nothing you choose there is sent anywhere unless you book or pay for the build. Asking us to email you the price sends it too. The page address holds the configuration so you can come back to it; it never holds your personal details.

"Email me this price" asks only for an email address. We use it to send that price and a link back to it once. We keep a copy of the email as an enquiry. It is not added to a mailing list.

Payments and subscriptions

Website builds and plans are paid on a secure page provided by Stripe Payments Australia Pty Ltd. Your card details go to Stripe and never reach our server. We receive your name, email address, what you bought and whether the payment went through. Stripe keeps a customer record and your card. It uses them to charge a plan each month or year until you cancel and to start the hosting for a website we build on launch day. You can cancel from the billing page in your account or by emailing us. Stripe may process data overseas, including in the United States; its own privacy policy covers what it does.

Your customer account

If you are a client, you have an account at sitesandservers.com.au/account. It holds your name, business name, email address, your website and hosting details, domains, build progress, the requests you send us and, for affiliates, your referral code and referrals. Logging in works by email: we send a link that works once and expires. We store only a scrambled (hashed) copy of each link and of each session, plus the time and IP address of logins and actions so we can spot misuse. The account uses one cookie, set only when you log in, that keeps you logged in and is removed when you log out.

The old private build-progress links (addresses starting /track/) have been replaced by the account and now forward to the login page.

Referral links

If you arrive through an affiliate's link (an address ending in ?ref= and a code), that code is kept in a first-party cookie called ss_ref and a matching browser storage entry for 90 days. It is included with any form you send or payment you make in that time so the affiliate can be credited. It holds the code only. You can delete it in your browser at any time.

When you open a partner's link we store a code in your browser for 90 days and record the visit with a scrambled version of your IP address, so we can pay the partner who sent you. That record is a cookie called __Host-ss_rc, signed so it cannot be changed, plus a visit entry on our server holding the code, the date, the kind of device, the website you came from (its name only) and the page you landed on. The scrambled address changes every day and cannot be turned back into your IP address. A second scrambled version of the first part of your address is kept for 90 days to spot people referring themselves, then deleted. Visit entries are kept 13 months, then only daily totals remain. We do not use third-party tracking for this.

If you apply to be an affiliate, we keep your application (name, email, business, ABN if given, website and how you will refer people), the version of the program terms you accepted and when. Bank details for affiliate payments are entered in your account and locked in your browser with a key our website does not hold, so our server stores them but cannot read them.

Analytics and browser storage

This site uses Google Analytics 4, run by Google LLC in the United States, to count visits and see which pages and buttons are used. It sets cookies named _ga and _ga_ followed by an identifier that give your browser a random ID. We measure pages viewed, configurator choices, forms sent, checkouts started and payments completed with their amounts. IP addresses are truncated before storage. On the account page, analytics records the page as /account only, never the login link. To opt out, install Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout) or block cookies for this site; the site works the same either way.

After a payment, the thanks page stores a small marker in your browser (ss_purchase_ followed by the order reference) so the same purchase is not counted twice. There are no advertising scripts.

The server that delivers these pages records standard connection details such as your IP address and the pages requested, which are used to run and protect the site.

Who else handles your information

We use a small number of service providers, some of which store or process data outside Australia:

• Our hosting provider, on Google Cloud servers in Sydney, which stores this website, our email and the sites we host.
• Stripe, for payments (Australia, with processing that can include the United States).
• Google, for analytics and the PageSpeed test in the website check (United States).
• Cloudflare, for Turnstile spam protection (United States).

We only share what each one needs to do its job.

If you become a client

To build or host a website we need contact details, a domain name and sometimes logins to your existing hosting or accounts. We use them for that work only. Passwords are kept in a password manager, never in email.

As your host, your website's files, databases and mailboxes sit on our servers. We look at them only when we need to run, back up, fix or support the site or when the law requires it. Your website collects information from its own visitors, so it needs its own privacy policy; we can help you write one.

How long we keep things

Enquiries that do not go ahead are deleted from our mailbox after two years. Client records, invoices and payment records are kept for at least five years after the work ends, as tax law requires. Account login links expire within 24 hours and their records are cleared after a week. Session records end when you log out or after 14 days at most. Website check results are kept for 24 hours.

Your rights and complaints

You can ask what we hold about you, ask for it to be corrected or ask for it to be deleted (where the law does not require us to keep it) by emailing hello@sitesandservers.com.au. We reply within 30 days.

If you are unhappy with how we have handled your information, email us first and we will try to put it right. If you are still not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.