Home › Privacy
PrivacyPrivacy policy
We collect very little, we tell you exactly who sees it, and you can have it deleted by asking.
This policy explains what personal information oowl collects through this website, why, where it goes and how long we keep it. It is deliberately short, because we deliberately collect very little.
Last updated: 30 September 2026.
Who we are
Mohamed Arshad Shafan trading as oowl, ABN 35 545 025 212 — trading as oowl, based in Melbourne, Victoria, Australia. Contact: [email protected].
What we collect, and when
If you submit the enquiry form
We collect your business name, your name, your email address, and optionally your phone number, team size, what prompted your enquiry and any message you write. We use this to reply to you and to prepare for the call. Nothing else.
If you email or call us
We hold whatever you send us, for as long as we need it to deal with your enquiry or to meet our record-keeping obligations.
When you browse the site
Our host, Cloudflare, processes your IP address and request metadata to serve the page and protect the site from attack. We use Google Analytics 4 (property G-Q6RYCEDEVM) to count visits and see which pages are read. Analytics data is aggregated; we do not use it to identify individuals, we do not run advertising or remarketing pixels on this site, and we do not sell or share anything with data brokers.
Where your enquiry goes
We use a small number of processors and no others:
| Processor | What it does | What it sees |
|---|---|---|
| Cloudflare | Hosting, CDN, bot protection (Turnstile), and the database your enquiry is stored in (D1) | Request metadata, IP address, your form submission |
| Resend | Sends the notification email so we see your enquiry | The contents of your enquiry |
| Google Analytics 4 | Aggregate site statistics | Page views, referrer, approximate location, device type |
Some of these processors operate infrastructure outside Australia, which means your information may be processed overseas.
Turnstile instead of CAPTCHA
The enquiry form is protected by Cloudflare Turnstile. It checks that the submission comes from a real browser rather than a script. It does not ask you to identify traffic lights, and it is not used to build an advertising profile of you.
How long we keep it
Enquiries that do not become work: deleted within 12 months. Enquiries that become client work: retained for the life of the engagement and then for 7 years, to meet Australian business record-keeping requirements. Analytics: retained on Google's standard retention setting for the property.
Cookies
This site sets no cookies of its own. Google Analytics sets its own cookies to count returning visits; blocking them in your browser will not break anything on this site.
Your rights
You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Email [email protected] and we will respond within 30 days.
If you are not satisfied with how we have handled your information, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au/privacy/privacy-complaints.
Data breaches
If we suffer a data breach involving your personal information that is likely to cause you serious harm, we will assess it promptly and notify you and the OAIC as required under the Notifiable Data Breaches scheme. We advise other businesses on exactly this obligation, so holding ourselves to it is the minimum.
Security of this site
This site enforces HTTPS with HSTS, ships a strict Content Security Policy, and carries no third-party scripts beyond Google Analytics and Cloudflare Turnstile. If you find a security issue, our disclosure policy is at /.well-known/security.txt.
Changes
If we change this policy we will update the date at the top. We will not make a material change quietly.