Privacy Policy

Who we are

Surface Fix (operating in Victoria, Australia) is the business responsible for handling your personal information. You can contact us at hello@surfacefix.com.au or 0468 168 808.

For privacy questions, requests for access or correction, or to raise a complaint, email hello@surfacefix.com.au with the subject line "Privacy".

What we collect (APP 3)

When you submit a quote, we collect: your first name, last name, mobile phone number, email address, postcode, suburb (optional), the photos you upload of the damage, your description of the damage (optional), the service vertical you selected (bath, stone, tile, or floor), and your preferred service window.

When you become a customer, we add: your full service address, any additional contact phone or email you provide, and the records of the repair work performed (date, scope, photos, invoice, payment record).

We do not collect government identifiers (Medicare, driver licence) or sensitive information (health, religion, sexual orientation, political views).

For website analytics, our hosting and analytics providers may collect your IP address, browser type, pages visited, and referrer. We do not link this to your contact details unless you submit a quote.

How we collect it

Directly from you when you complete the quote form, message us, call us, or accept a quote.

From our website automatically via cookies and analytics (Google Analytics 4, Microsoft Clarity, and, when we run paid advertising, the Meta Pixel and Google Ads tags). Bot protection (Cloudflare Turnstile) processes a token from your browser to verify you are a human.

If you arrive from one of our ads, we record the ad click identifier (for example Google gclid or Meta fbclid) and the campaign details in the link you clicked (the source, medium and campaign name), so we can measure which ad led to your visit. These are stored with your enquiry and are kept in your browser for up to 90 days.

We do not buy or rent personal information from third parties.

Notification at collection (APP 5)

The quote form tells you, at the point of submission, that we use your photos and contact details to prepare a quote and contact you about it. This policy is linked from the form and from the site footer.

How we use it (APP 6)

To prepare a written quote and contact you about it (email and SMS).

To plan and complete the repair if you accept the quote.

To invoice you, accept payment, and meet our record-keeping obligations.

To follow up after a job (review request, guarantee reminder, satisfaction check).

To improve our service (de-identified aggregate metrics: conversion funnel, response times, postcode coverage).

To measure and improve our advertising. When you submit a quote, we tell our advertising platforms (Google and Meta) that a lead occurred, matched using identifiers (your email, phone, name, and postcode) that are hashed in your browser first, so we never send them your readable contact details. This lets us see which ads work and cut wasted ad spend. You can opt out of this sharing (see "Cookies and advertising" below).

We will not use your photos for marketing without your explicit, written consent. If we ask to use a before/after photo on our website or in advertising, you can decline and we will not use it.

Who we share it with

Service providers we engage to run Surface Fix: Convex (database hosting, AU region), Vercel (web hosting), Resend (transactional email delivery), Twilio (SMS and voice), Stripe (card payments), Xero (accounting), Slack (internal team messaging for incoming leads), Cloudflare (bot protection and DNS).

Independent repair contractors we engage to carry out your job: to prepare a quote, we share the photos you send us and your suburb and postcode. If a contractor is assigned to complete your repair, we also share your address and a contact number so they can attend and coordinate the visit. We never share what you pay us with the contractor. Each contractor is bound by confidentiality and privacy obligations.

Advertising platforms, while we run paid ads: Google (Google Ads) and Meta (Facebook and Instagram). We send these platforms conversion events (for example, that a quote was submitted) with hashed identifiers (email, phone, name, postcode) and the ad click identifier you arrived through. The identifiers are hashed in your browser before they reach us or the platform. We share these only to measure and optimise advertising.

Each provider is bound by their own privacy and security obligations. We share only the data needed to deliver the service we use them for.

We do not sell your personal information to anyone.

Cross-border disclosure (APP 8)

Some of our service providers store data outside Australia: Resend (United States), Stripe (United States), Slack (United States), Cloudflare (global edge network).

When we run paid advertising, we also disclose conversion events and hashed identifiers to Google and Meta (United States) to measure and optimise that advertising, as described in "Who we share it with".

These providers are bound by privacy frameworks comparable to the APPs. By submitting personal information to us, you consent to this overseas disclosure for the purposes set out above.

How we keep it secure (APP 11)

Personal information is encrypted in transit (TLS 1.2 or higher) and at rest within our hosting providers.

Photos are scrubbed of GPS coordinates and other metadata before they reach any internal channel.

Access is restricted to team members who need it to do their job, behind multi-factor authentication.

We monitor for unauthorised access and follow the Notifiable Data Breaches procedure under the Privacy Act if a breach occurs.

How long we keep it

Photos: 12 months after the related job is completed, then permanently deleted from our storage.

Leads that do not convert: 18 months from submission, then de-identified.

Customer records, quotes, jobs, and invoices: 7 years from the last interaction (this matches tax and accounting record-keeping obligations).

Audit logs (system events): 7 years for accountability and dispute resolution.

Backups: encrypted, retained for 35 days on a rolling basis.

Your right to access and correction (APP 12 and 13)

You can ask us for a copy of the personal information we hold about you. Email hello@surfacefix.com.au with the subject line "Access". We will respond within 30 days, and there is no charge for routine requests.

You can ask us to correct information that is inaccurate, out of date, incomplete, irrelevant, or misleading. Email hello@surfacefix.com.au with the subject line "Correction". We will respond within 30 days.

You can ask us to delete your information. We will do so unless we are required to retain it for legal or tax reasons (in which case we will explain the retention period that applies).

Anonymity and pseudonymity (APP 2)

You can browse our website anonymously. However, we need your real contact details to send you a written quote and complete a repair, so anonymous quote submissions are not possible.

Direct marketing (APP 7)

We send transactional messages (quote ready, appointment confirmation, invoice, guarantee follow-up) without needing to ask. These are not marketing.

If we send marketing in future (newsletters, promotions), each message includes an unsubscribe link. Reply STOP to any SMS to opt out of further SMS.

Cookies and advertising

We use cookies for: keeping you logged into draft quote forms (localStorage), session identification (random anonymous string in your browser), Google Analytics 4 (page views, conversion events), and Microsoft Clarity (session replay for usability research, with text masking on PII fields).

While we run paid advertising, we also use the Meta Pixel (measures ad conversions, sets the _fbp cookie, and the _fbc cookie when you arrive from a Meta ad) and Google Ads conversion measurement (sets _gcl cookies when you arrive from a Google ad).

Strictly necessary cookies (CSRF, session, Turnstile) are always set. Other cookies are loaded only after the page renders. We do not show a cookie banner because under Australian law, behavioural analytics and advertising measurement are permitted with clear disclosure (this policy). For our Australian audience we set Google Consent Mode to allow measurement.

To opt out: you can block or clear cookies in your browser, and you can ask us to exclude your information from advertising-platform sharing by emailing hello@surfacefix.com.au with the subject line "Privacy". Opting out does not affect your quote or repair.

Notifiable Data Breaches

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in line with the Notifiable Data Breaches scheme. Our breach response procedure is documented internally and reviewed at least annually.

Complaints

If you believe we have breached the APPs, email hello@surfacefix.com.au with the subject line "Privacy complaint". We will acknowledge within 5 business days and respond substantively within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

Changes to this policy

We may update this policy from time to time. Material changes will be notified by email to active customers and posted at the top of this page. The "last reviewed" date above shows when this version was last updated.