Privacy notice

Who we are

SJDrage is Samuel Drage, a sole trader in Brisbane, Australia. We build and look after websites for small businesses, and we run the update desk your business uses to change its own site. For anything in this notice, write to [email protected].

The two things this covers

1. The public website we host for a business. Visitors' details reach us only when they send an enquiry through a form on the site.

2. The update desk, the private page where people at the business change the site themselves.

What we hold, and why

People who use the update desk

• Your email address and name, so the desk knows who is allowed in and who asked for each change.
• Each change you ask for: the fields you typed, the words you wrote, and any photos or PDF files you attached.
• With each request, the address of the connection it came from and the browser used. We keep those so that if a login is ever misused we can tell.
• Sign-in itself is handled by Cloudflare Access. It sends a code to your email each time and keeps a record of when you signed in.

We use all of this to make the change you asked for, to show you what is waiting and what went live, to email you when something is waiting for your say, and to keep the site safe.

Visitors who send an enquiry through the site

Their name, contact details and message go by email to the business's inbox. We do not keep a copy once it has been delivered.

Where it lives

• Cloudflare (United States company) runs the sign-in, stores requests and uploaded files in a private store in its Oceania region (Australia), and serves the website itself.
• Our own server, rented from Contabo GmbH in Germany, checks each request and builds the site.
• Resend (United States) sends the emails the desk and the site's forms send.
• GitHub (United States) holds a private copy of the site's files and the record of changes, which is how any change can be undone.

How long

• Uploaded originals: deleted 90 days after the change they belong to has gone live or been dropped. The smaller copies made for the site stay as long as the listing does.
• The record of each request: deleted 12 months after it was made.
• Your email address on the desk's list: until the business asks us to remove it, or the service ends.
• The site's own files and change history: for as long as we look after the site, then handed over or deleted as the business asks.

Your rights

If you are in the United Kingdom or the European Union, UK GDPR and the GDPR give you the right to see what we hold about you, to have it corrected or deleted, and to complain to the Information Commissioner's Office. If you are in Australia, the Privacy Act 1988 gives you similar rights and the Office of the Australian Information Commissioner hears complaints.

The business you work for decides why your details are collected; we hold them on its behalf. Ask the business first, or write to us directly at [email protected]. We answer within a month.

Companies that handle data for us

Cloudflare, Inc. (sign-in, storage, hosting). Contabo GmbH (our server). Resend, Inc. (email). GitHub, Inc. (private file history). Each is bound by its own published terms and processes the data only to do the job named above.

Changes to this notice

The date at the top moves when the notice changes. Anything that changes what we hold or why is told to the business before it happens.