Privacy
This privacy notice explains how Gardvale (ABN {{ABN}}) handles personal information in line with the Australian Privacy Principles (APPs).
Who we are
Gardvale is a free external domain check for Australian small businesses. The operator entity is Gardvale (ABN {{ABN}}).
What we collect
- Domain names you submit for a scan, plus scan results derived from public records.
- Email addresses if you use account, verification, digest, or support features (not required for a basic anonymous scan). See also Email policy.
- IP addresses (stored hashed) for rate limiting and abuse prevention — purged every 24 hours.
- Cookies / local storage only as needed for bot protection (Cloudflare Turnstile) and basic session function. We do not use advertising trackers on the free check.
- Optional search API responses if a search provider key is configured (off by default; no search-engine scraping).
Why we collect it
- to run and display the domain check you request;
- to enforce rate limits, bot checks, ownership verification, and opt-outs;
- to operate and secure the service;
- to respond to contact or complaints when you write to us;
- to disclose information when required by law (for example a court order or lawful regulator request).
We do not sell personal information. Scan results are not used to make claims about insurance products or pricing.
Overseas providers
We use these providers to operate Gardvale:
- Vercel — application hosting and edge delivery (United States / global edge);
- Neon — Postgres database (Sydney, Australia);
- Resend — transactional email when enabled (United States);
- Cloudflare — Turnstile bot checks and, if used, DNS or CDN (global).
Where personal information is disclosed overseas, we take steps reasonable in the circumstances to ensure APP-comparable handling (APP 8).
Retention and deletion
- Anonymous / free scans: about 30 days, then deleted or anonymised, unless a longer period is required for security or legal reasons.
- Accounts: you can request self-serve account and data deletion. We aim to complete deletion of account personal data within 30 days of a verified request. Backups that may still hold residual copies roll off within 35 days.
- Hashed IP rate-limit events: purged every 24 hours.
- Aggregate, non-identifying statistics (for example counts of scans by outcome, with no domain or personal identifiers) may be kept indefinitely to improve the service.
Access, correction and complaints
You may ask to access or correct personal information we hold about you, request account or data deletion, or make a privacy complaint by emailing privacy@{{DOMAIN}}. For abuse reports, contact abuse@{{DOMAIN}}.
We aim to respond to privacy complaints within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) — see oaic.gov.au.
How we send email (double opt-in, identity, unsubscribe, and no cold email to scanned domains) is described in the Email policy.