Privacy policy

Who we are

Kiln is the website platform run by Zac Snowdon (ABN 65 401 350 511), a sole trader in NSW. We build websites for small businesses and run them on Kiln. This policy covers Kiln - the admin at admin.snowdontech.com and the websites it runs - and our own records.

Questions about your information: zacsnowdon@gmail.com.

People who sign in to Kiln

Business owners, their staff, and the designers who work with them have a Kiln login. For each login we keep:

• your name, email address, role, and which businesses you belong to;
• your password, stored only as a scrambled hash we cannot read;
• sign-in codes and sessions, also stored scrambled, which expire within minutes to 14 days;
• the internet address you sign in from, used only to stop password guessing, kept for 90 days;
• a record of what was changed on a business's website and by whom, so the business can see its own history.

One cookie keeps you signed in. Kiln uses no tracking or advertising cookies.

Customers of the businesses we host

When someone places an order through a website we host, we store it for that business: their name, phone number or email address, what they ordered, their pickup time and any notes.

The business decides what it is for, and the business's own privacy notice explains how it uses it. We handle it only on the business's behalf: we don't use it for anything else, we never sell it, and we never contact those customers ourselves beyond the order emails the business's website sends. Only the business's own owners and staff can see orders - designers who edit a website's words never see orders or customers. Customer details are removed automatically 12 months after the pickup date.

When someone sends a message through a website's contact or booking form, we pass it straight on to that business by email, and replying to it goes to the person who wrote it. We don't keep a copy: the business's own inbox is the record. Kiln notes only that a message came in - never who sent it, what it said or where it came from. To stop misuse, the internet address a message is sent from is counted for a day or two, then forgotten.

Words and photos

Businesses add the words and photos on their websites themselves. They are kept until the business deletes them; a deleted photo stays in a bin for 30 days in case it was a mistake, then it is gone.

Where it's kept and who helps us

• Cloudflare runs Kiln and the websites. Kiln's database and photos are stored in Cloudflare's Oceania region, and a copy of the database is made each night and kept for 30 days.
• Resend sends Kiln's emails: sign-in codes, invitations, order emails and the messages sent through websites' forms. Its servers are in Japan.
• Square, only if a business connects its Square till, under Square's own privacy policy.

Each handles information only to provide its service to us. Some of it is stored or sent outside Australia, as above.

Keeping it safe

• Everything is encrypted on its way to and from Kiln, and where it is stored.
• Every sign-in needs your password and a code sent to your email.
• Each business can only see its own information - a rule Kiln's automatic tests check every time Kiln changes.

If something ever goes wrong, we will tell the businesses affected as soon as we know, help them tell their customers and the regulator where that is required, and fix the cause.

How long we keep it

• Logins: while the account exists.
• Sign-in codes and sessions: minutes to 14 days. Sign-in addresses: 90 days.
• Customers' details on orders: 12 months after pickup, then removed automatically.
• Messages sent through websites' forms: not kept - they go straight to the business by email.
• Nightly copies of the database: 30 days.
• When a business leaves Kiln, we give it its information and then delete it, as our agreement with that business sets out.

Your information, your say

If you have a Kiln login, ask us to see, correct or delete your information. If you are a customer of a business we host, ask that business first - it decides what happens to your details - or ask us and we will pass it on. We will reply within 30 days.

If you are not happy with how your information has been handled, tell us first so we can put it right. If we don't, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.