Privacy policy

Effective 12 November 2026

FFP Digital is me, David Webster, working from Ipswich QLD. This page explains what I collect when you use this website or get in touch, what I do with it, and how to ask me about it. I follow the Australian Privacy Principles in the Privacy Act 1988.

What I collect

When you send an enquiry. The forms on this site ask for your name, your business name, your email address, your phone number, a message and, if you choose to answer, how you heard about us. You choose what to put in the message, so please leave out anything sensitive, such as health details about you or your patients.

Each form also sends some details you don't type in:

• which page you sent it from (trades, allied health, ServiceM8 or the home page), and the page you first landed on
• campaign tags from the link you arrived on, if it had any: utm_source, utm_medium, utm_campaign, utm_content, utm_term, the click IDs Facebook and Google add to ad links (fbclid and gclid), and gref, a tag I add to links I share myself (in guides, emails and posts)
• the website that sent you here, if one did, as its address without anything after the question mark (so no search terms), and the time you first arrived

These tell me which ad, post or website brought you here, so I can stop paying for the ones that don't work. They are kept in your browser only for the current visit (session storage) and are only sent to me if you submit a form.

When an AI assistant prepares an enquiry for you. Assistants such as ChatGPT, Claude or Perplexity can give you a link to my enquiry form with your details already filled in. The details travel in that link and only fill in the form in your browser; nothing reaches me until you check them and press Send. The form then also tells me it came from an assistant, and which one if it said.

When you call, text or email me. I get your number or email address and whatever you tell me.

When you browse the site. Some information is collected automatically. See the analytics and cookies sections below.

How I use it

• to reply to your enquiry, give you a quote and do the work you ask me to do
• to send invoices and keep the business records the law requires
• to understand how people use the site, and which ads and posts bring in real enquiries

I don't sell your details, and I don't add you to a mailing list. If I ever send marketing email, it will only be with your consent and every email will have a way to unsubscribe.

Who else handles it

I use a few services to run the site. They handle your information on my behalf:

• Web3Forms receives each form submission and emails it to me.
• Cloudflare hosts the site. Like any web host, its servers see your IP address and browser details when you load a page, and use them for security and to deliver the site. I also use Cloudflare Web Analytics, which counts page views without cookies.
• Google Tag Manager loads the measurement tools below, and Google Analytics 4 records how the site is used: pages viewed, roughly where you are (city level), your device type, and events such as a form being sent or a phone number being tapped.
• Microsoft Clarity records how visitors move around the site (scrolling, clicks and mouse movement) so I can see where a page is confusing. Text typed into forms is hidden from the recording. Microsoft handles that data under its own privacy policy.
• My email provider stores the enquiries and emails I receive.
• Amazon Web Services hosts FFP Content Engine, the tool I use to publish my own posts and videos (see below). It also receives enquiries sent from my enquiry form or by an AI assistant, and emails them to me through Amazon SES. It keeps no copy of what you wrote: only a scrambled (hashed) form of your email address and network address, for 30 days, so it can turn away spam. If it is unavailable, the form sends through Web3Forms instead.

Some of these companies store data outside Australia, mainly in the United States. I choose providers that protect personal information to a standard similar to the Australian Privacy Principles. Apart from these services, I only share your details if you ask me to, or if the law requires it.

Cookies and advertising

Google Analytics and Microsoft Clarity set cookies (small files in your browser) so they can tell a returning visitor from a new one. They don't identify you by name.

I may run ads on Facebook, Instagram and Google. When I do, I'll use the Meta Pixel and Google Ads tags, loaded through Google Tag Manager. These set cookies that let Meta and Google tell me when someone who clicked an ad later sends an enquiry, and may let them show you my ads on their platforms. Meta and Google handle that data under their own privacy policies.

How to opt out

• Block or clear cookies in your browser settings. The site still works without them.
• Install the Google Analytics opt out browser add on.
• Turn off personalised ads in Google My Ad Center and in your Facebook ad preferences.
• Visit youronlinechoices.com.au to opt out of interest based ads from many ad networks.

You can also contact me without using the forms at all: just text or email.

FFP Content Engine: Facebook, Instagram and YouTube

FFP Content Engine is a tool I built to publish FFP Digital's own posts and videos to FFP Digital's own Facebook Page, Instagram account and YouTube channel. I am its only user. It is connected only to those accounts, it does not access anyone else's Facebook, Instagram, Google or YouTube account, and it collects nothing from people who view, like or comment on my posts. More about the tool is on its own page: FFP Content Engine.

What it can do. When I connected it, I gave it permission to publish to the FFP Digital Page and Instagram account, and, through Google, to upload videos to the FFP Digital YouTube channel and view that channel's own videos. It uses these to publish the posts and videos I have approved (YouTube uploads are always private until I make them public myself), and to check that each one went up.

What it stores. The access tokens Facebook and Google gave it, kept in the tool's protected server settings and never in its code. For each post or video it published: the ID the platform gave it, its link, and whether it was live when last checked. The words, pictures and videos are my own content, written and approved by me before they go out.

How long. The tokens are kept until I remove the tool's access. Information the tool reads back from YouTube is refreshed or deleted within 30 days. If access is removed, the token and the information the tool read from that platform are deleted within 7 days.

Sharing. Nothing the tool reads from Facebook, Instagram or YouTube is sold, shared or used for advertising, and none of it is sent to any other service, including AI services. The tool runs on Amazon Web Services in Sydney. It sets no cookies on this website; its own admin screens use a sign in cookie for me only.

Removing access. Google access can be removed at any time from your Google Account at security.google.com/settings/security/permissions. Facebook and Instagram access can be removed in Facebook under Settings, Business integrations, or in Meta Business Settings.

Deleting your data. The tool holds no information about anyone other than FFP Digital. If you believe it holds something about you, or you want anything deleted, email hello@ffpdigital.com.au with the subject "Delete my data". I'll confirm what was held and delete it within 30 days.

YouTube and Google. Use of YouTube through this tool is also covered by the YouTube Terms of Service and the Google Privacy Policy.

How long I keep it

If an enquiry doesn't turn into work, I delete it within two years. If you become a client, I keep your contact details and our records for as long as we work together, then for five years after, because Australian tax law requires me to keep business records for that long. Analytics data is kept for no more than 14 months, and Clarity recordings for 30 days unless I save one to look at again.

Keeping it safe

Enquiries sit in password protected accounts that only I can get into, with two factor sign in turned on wherever the service offers it. No system is perfectly secure, but if something ever went wrong in a way likely to cause you serious harm, I would tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Seeing or correcting your details

You can ask me what I hold about you, ask me to correct it, or ask me to delete it. Email hello@ffpdigital.com.au. I'll reply within 30 days, and it won't cost you anything. If I can't do what you ask (for example, because I have to keep a tax record), I'll tell you why.

Complaints

If you think I've mishandled your information, please email me first and I'll respond within 30 days. If you're not happy with my answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Changes to this policy

If I change how I handle your information, I'll update this page and the date at the top.