Privacy policy

What we collect, why, and how to get it removed.

Waterwise Directory is an Australian-operated, Perth-only directory. We try to collect the minimum needed to run the site, and we never sell your data. This page lays out what is actually happening behind the pages.

Who we are

Waterwise Directory is operated as a sole-trader business in Western Australia. Contact for privacy queries: install@waterwisedirectory.com.au.

What we collect

  • Visitor analytics (only if Google Analytics 4 is enabled on the site you are viewing). Page views, referrer, approximate location (country /city), and device/browser type. Your IP address is anonymised by Google before processing (anonymize_ip: true). GA4 sets a small number of cookies (typically _ga and _ga_*) with the flag SameSite=Lax; Secure.
  • Listing engagement events. When you click a contact button (phone, email, website, get-in-touch) on an installer profile, we record an anonymous event with a 16-character SHA-256 hash of your IP-plus-user-agent. The hash is not reversible and is used only to de-duplicate clicks so we can give honest engagement counts to listed installers. We honour the DNT: 1 Do-Not-Track header and skip bot user-agents.
  • "List your business" form. If you submit the listing form, we collect: business name, contact name, email, phone (optional), website (optional), suburbs you service, services you offer, ABN (optional), and any free-text message you include. This goes into our private leads table so we can contact you about onboarding.

What we don't collect

  • No payment information. We do not process payments on this site.
  • No sensitive personal information (health, racial, political, religious, etc.).
  • No third-party tracking pixels besides GA4 if enabled. No Facebook pixel, no LinkedIn pixel, no advertising network tags.
  • No raw IP address is stored long-term - GA4 anonymises it server-side, and our own analytics only stores the hash.

How we use the data

  • Visitor analytics: to understand which pages are useful and which suburbs people search.
  • Engagement events: to report honest contact-click counts to listed installers.
  • Lead form data: to reply to your listing enquiry and onboard you.

Who we share it with

  • Neon (our database provider). Your lead form submission is stored in a managed Postgres database hosted in the AWS Sydney region (ap-southeast-2). Neon is a US-incorporated company; the data itself sits on Australian infrastructure.
  • Vercel (our hosting provider). Vercel serves pages and may see request metadata (IP, user-agent, path) at the edge for routing and rate-limiting. Vercel does not receive a copy of your lead form data.
  • Resend (our email provider). When we reply to a listing enquiry, Resend handles the transactional email delivery. Your email address is shared with Resend only at the point of sending.
  • Google (only if GA4 is enabled). Visitor analytics go to Google Analytics 4 with IP anonymisation on. Standard Google terms apply.
  • We do not sell, rent, or trade your data to any third party.

How long we keep it

  • Listing engagement events: 24 months, then deleted.
  • Lead form submissions: retained until you ask us to delete them, or until the listing relationship ends.
  • GA4 data retention: set to 14 months in our GA4 configuration.

Your rights

Under the Australian Privacy Act 1988 (Cth) and equivalent rights under the EU GDPR, you can:

  • Ask what personal information we hold about you.
  • Ask us to correct it.
  • Ask us to delete it.
  • Object to specific uses.
  • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your data.

Email install@waterwisedirectory.com.au with the subject line "Privacy request" and we will respond within 30 days.

Cookies and browser storage

The site itself sets no first-party cookies. If GA4 analytics is enabled on the version of the site you are viewing, Google sets a small number of cookies for analytics (_ga, _ga_*) with SameSite=Lax; Secure. You can block these in your browser settings or via the global Do-Not-Track signal, which we honour.

Children

The site is not directed at children under 16. We do not knowingly collect personal information from children. If you are a parent or guardian and believe a child has submitted information to us, email us and we will delete it promptly.

Updates to this policy

We may revise this policy when the site adds or removes a service or changes a data processor. The "last updated" date below reflects the most recent change. Material changes will be flagged on the homepage.

Terms of serviceAboutBack to homepageLast updated 28 May 2026