Privacy policy
We keep only what we need.
We collect only what we need to answer you, do the work and bill for it. We don't sell it and we don't use it for advertising. On our website, Google Analytics shows us how people find and use it, and nothing more. If you ask, we'll show you what we hold about you, correct it, or delete it.
Last updated: 29 September 2026
Who we are
Esk Works is a web design and software business in Launceston, Tasmania, trading as ESK WORKS, ABN 27 899 695 961. In this policy, "we" and "us" mean Esk Works.
Contact us about anything in this policy at hello@eskworks.com.au or 0461 372 453.
What we collect
When you visit our website. We use Google Analytics, through Google Tag Manager, to see how people find and use our site. It records the pages you visit, how you got to us, your device and browser, and roughly where you are, down to your city. It sets cookies so it can tell a return visit from a new one. It doesn't tell us who you are, it doesn't keep your IP address, and we don't use it for advertising. You can block it in your browser's privacy settings or with Google's opt-out add-on.
Like every web server, ours also records the IP address, time and page of each request. We use those logs only to keep the site secure and running.
When you contact us. Our contact form asks for your name, email address and message. It also asks for your business name, phone number and project stage, but you can leave those out. If you email or call instead, we keep what you send us.
When you become a client. To do the work and bill for it, we keep:
- your business name and ABN;
- a contact name, email address, phone number and postal address;
- your domain and the plan you're on;
- our invoices to you, and a record of what you've paid;
- our emails with you, and the content you give us for your website.
When we register a domain for you, the domain is registered in your name. The registration details go to the registrar and the .au registry, as auDA requires.
When we run your website's contact form. A visitor's enquiry passes through our form service to you, and we don't keep a copy. Resend, the service that delivers it, keeps a record of each message for 30 days and then deletes it. You then decide what happens to it, and your own privacy policy applies to it.
When you connect your Instagram account. See Instagram feeds.
We don't ask for sensitive information such as health details, and we never need your passwords. If you give us one to get something done, we use it once and ask you to change it afterwards.
How we use it
We use what we collect to:
- answer your enquiry and quote for work;
- build, host and look after your website;
- send invoices, and keep the tax records the law requires;
- let you know about your site, your domain and your plan;
- keep our systems secure.
We don't use it for anything else unless you agree, or the law requires it.
Who we share it with
We don't sell or rent personal information to anyone.
Our client records, our form service and the websites we look after run on our own systems, hosted in Sydney, Australia.
We use a few outside services to run the business: an email provider, a service that delivers contact form enquiries, a domain registrar, and Google Analytics. Each one handles information only to provide its service to us. Our email and form enquiries are held in the United States and Japan, and our website analytics in the United States. We choose services with strong security, and we stay responsible for your information while they hold it for us.
We also give information to someone else when the law requires it, for example to the Australian Taxation Office.
Instagram feeds
If your website shows your Instagram posts, it does so through our feed service. You connect your account yourself, by logging in on Instagram. We never see your Instagram password.
Read-only access. We ask Instagram for one permission only, to view your profile and your posts. We can't post, comment, read your messages or change anything on your account.
What we hold, and why:
| What | Why |
|---|---|
| Your Instagram user ID and username | To know which account belongs to which website |
| An access token from Instagram | To fetch your posts. We renew it automatically so the feed keeps working |
| Your recent posts: captions, images or videos, links and dates | To show them on your website |
We show your posts on your website and nowhere else. We don't use them for advertising or profiling, and we don't share them with anyone.
Disconnecting. You can disconnect at any time, from Instagram under Settings > Apps and websites, or by asking us. Within 24 hours we delete your access token and every post we hold. We do the same when your plan with us ends.
Asking us to delete your data. Email hello@eskworks.com.au. We delete your Instagram data within seven days and confirm by email once it's done.
Meta's own use of your information is covered by the Instagram Privacy Policy.
Email we send you
We email clients about their work, their website and their invoices. We don't send newsletters. If we ever start, we'll send them only to people who agree to receive them, and every one will have an unsubscribe link that works.
How long we keep it
| What | How long |
|---|---|
| Enquiries that don't become work | Two years after we last hear from you |
| Client records and emails | While you're a client, then two years |
| Invoices and payment records | Five years, as tax law requires |
| Web server logs | 14 days |
| Google Analytics data | Up to 14 months |
| Contact form enquiries, in Resend's delivery records | 30 days |
| Instagram data | Until you disconnect, or your plan ends |
After that we delete it.
How we protect it
- Everything we run is served over HTTPS.
- Our systems are behind strong, unique passwords, and our client records are behind a login.
- Only Esk Works can see client records.
- We keep only what we need, which is the best protection there is.
If a data breach puts you at risk of serious harm, we'll tell you as soon as we know, along with what happened and what you can do.
Seeing, correcting or deleting your information
Ask us at hello@eskworks.com.au and we'll show you what we hold about you, correct it, or delete it. We'll reply within 30 days, and usually much sooner. There's no charge.
We can't delete invoices and payment records before the law allows us to. We'll tell you if that applies.
Complaints
If you think we've mishandled your information, email hello@eskworks.com.au and tell us what happened. We'll look into it and reply in writing within 30 days.
If you aren't satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes to this policy
When we change this policy, we'll update the date at the top. If a change affects how we use information you've already given us, we'll email you first.