Privacy Policy

Who we are

This website, burvic.com, is operated by Burvic (“Burvic”, “we”, “us”), the web design business of Matthew Williamson, a sole trader based in Sydney, New South Wales, Australia. Burvic is not a company. We are bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) and we handle personal information in line with them.

• ABN: [TO BE COMPLETED: ABN]
• Postal address: [TO BE COMPLETED: postal address]
• Email: hello@burvic.com
• Phone: 0405 503 114, Mon-Fri 9am-5:30pm Sydney time

Privacy questions, access requests and complaints all go to the same place: hello@burvic.com. Burvic is a one-person business, so there is no separate privacy officer sitting between you and the person who actually holds your data. Matthew Williamson reads and answers these himself.

What we collect, and where from

We only collect personal information that you give us, or that we need to run the parts of the site you choose to use. There are five collection points, and this is all of them.

We do not buy personal information from anyone, we do not scrape it, and we do not collect it from third-party data brokers. If you contact us by email or phone instead of using a form, we hold whatever you chose to tell us in that message.

Why we collect it

We use personal information for the reason you gave it to us, and for closely related things you would reasonably expect:

• To answer your enquiry and prepare a quote.
• To handle, respond to and track your support tickets.
• To deliver the work you have engaged us for, and to talk to you while we do it.
• To run your portal account, issue invoices and process payments.
• To send transactional emails: welcome and email verification, password resets, ticket confirmations and replies, invoices and receipts.
• To answer questions in the chat assistant.
• To keep the site working: spam traps and rate limits that stop the forms being abused.
• To meet our legal, tax and record-keeping obligations.

We do not use your details for marketing lists, we do not profile you, and we do not sell or rent personal information to anybody. Ever.

Who we disclose it to

We use a small number of service providers to run the site. Each one only receives what it needs to do its job, and none of them are advertising or analytics companies.

• Groq — the AI provider behind the chat assistant. Receives the recent messages in your conversation. See the next section.
• Stripe — payment processing in the client portal. On the payment page, Stripe's own script collects your card details directly in your browser and sends them to Stripe. We pass Stripe the invoice amount, the currency and the invoice number. We get back a payment result plus the card brand, last four digits and expiry.
• Google — only if you choose “Sign in with Google”. Google tells us your Google account ID, email, name and profile picture URL after you approve it.
• Hostinger — our hosting provider. Our website, database and email delivery run on their infrastructure, so they hold the data at rest on our behalf.

Beyond those, we may disclose personal information where the law requires it, or where it is necessary to establish or defend a legal claim.

Groq, Stripe, Google and Hostinger are international providers, so some of this information may be stored or processed outside Australia. We do not control where each provider routes or stores data, and we cannot promise that overseas recipients are bound by the Australian Privacy Principles. We are still confirming which regions hold our data at rest: [TO BE COMPLETED: hosting and data storage region]. If you would rather not have information handled this way, use email or the phone instead of the chat assistant and the portal.

Our pages also load images and icons from third-party image hosts. Loading those files tells the host your IP address and browser, as it would for any image on any website.

Chat messages and AI processing

This is the part most people want to know about, so here it is plainly. The chat bubble is not a person and it is not a local script. When you send a message:

• Your message, plus up to the last twelve messages in the conversation, is sent from our server to Groq, a third-party large language model provider, over the internet.
• Groq's model generates the reply and sends it back to us. Nothing about your enquiry is verified by a human before you see the answer.
• We then save the conversation on our server so Matthew Williamson can review what the assistant said. The saved record includes your messages, the assistant's replies, timestamps and the page you started on.
• Groq handles that data under its own terms and privacy policy, not ours.

Please do not type anything into the chat that you would not want handled by an external AI provider — no passwords, no payment details, no health or financial information, nothing confidential. If it needs to be private, email hello@burvic.com or call us instead.

Cookies, local storage and tracking

This site runs no analytics and no tracking scripts at all. There is no Google Analytics, no advertising pixel, no heatmap tool, no social media tracker and no cross-site profiling of any kind. That is deliberate, and it is worth saying out loud because it is unusual.

What the site does store in your browser:

• Local storage, burvic-theme — remembers whether you chose the light or dark theme. Until you choose, we simply follow your device setting.
• Session storage, burvic-chat — keeps your chat conversation going as you move between pages in the same tab. It is cleared when you close the tab.
• A session cookie — only in the client portal at /account, and only to keep you signed in. It is marked Secure, HttpOnly and SameSite.
• Stripe cookies — Stripe's script may set its own cookies on the portal payment page for fraud prevention. Those are Stripe's, governed by Stripe's policy.

The theme and chat entries are not cookies, are never sent to our server, and can be cleared at any time from your browser settings.

How we store and protect it

• The whole site is served over HTTPS. Older, weaker TLS versions are refused.
• Portal accounts, tickets and invoices are held in a MySQL database on our hosting account. Enquiries and chat transcripts are held as files on the same server.
• The data directories and internal API files are not publicly reachable; requests for them are refused by the server.
• Passwords are stored as one-way hashes and re-hashed when the standard moves on. Nobody at Burvic can read your password.
• Portal sessions use Secure, HttpOnly, SameSite cookies, and forms are protected against cross-site request forgery.
• Full card numbers never touch our server. They go from your browser to Stripe.

No system is perfectly secure, and we will not pretend otherwise. If a data breach ever happened that was likely to cause you serious harm, we would notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

How long we keep it

• Chat transcripts: 30 days. This one happens by itself. A transcript is deleted about 30 days after it was last updated, by code running on our server.
• Project enquiries: 24 months from the last time we heard from you about that enquiry. That is the retention period Burvic applies as a matter of policy; we review and clear old enquiries by hand rather than by an automatic process.
• Support tickets: 24 months after the ticket is closed, so we can see what has happened to your site before. This period is also policy that we apply by hand, not an automatic deletion.
• Portal accounts: kept while the account is open. Ask us to close it and we will remove it, apart from anything we must keep.
• Invoices, payments and receipts: 7 years. Financial records are kept for 7 years, which covers the Australian Taxation Office record-keeping requirements that apply to us.

When we no longer need personal information for any purpose set out here, and no law requires us to keep it, we destroy it or de-identify it. Apart from chat transcripts, that clean-up is done by hand rather than on a timer, so if you want your enquiry, your tickets or your account removed sooner, email hello@burvic.com and we will do it.

Accessing and correcting your information

Under APP 12 and APP 13 you can ask us for a copy of the personal information we hold about you, and you can ask us to correct anything that is wrong, out of date or incomplete. Email hello@burvic.com and tell us what you need.

• We will respond within 30 days, as the Privacy Act requires.
• We may need to confirm your identity first, so that we are not handing your information to somebody else.
• Access is free. If a request is unusually large we will tell you about any cost before we do the work, and never charge for making the request itself.
• If we refuse access or a correction, we will tell you why in writing and how to challenge it.
• If you have a portal account, you can view and update your own details there at any time.

You can also ask us to delete information. We will do that wherever we are not required to keep it.

Making a complaint

If you think we have mishandled your personal information, tell us first. Email hello@burvic.com with “Privacy complaint” in the subject line and set out what happened. We will acknowledge it, investigate it properly and write back to you with an outcome within 30 days.

If you are not satisfied with our answer, you can escalate it to the Office of the Australian Information Commissioner (OAIC), which regulates the Privacy Act:

• Online: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992

You do not need our permission to go to the OAIC, and you will not be treated any differently by us for doing it.

Anonymity, and children

You can browse this entire website without telling us who you are. You can also ask a general question by phone without giving a name. We do need contact details to quote on a project, to raise a support ticket or to run a portal account, because there is no way to do those things anonymously.

Our services are sold to businesses and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we will remove it.

Changes to this policy

If what we do with personal information changes, we will change this page and update the date at the top. The version published here is always the current one. If a change is significant and affects existing clients, we will tell you directly rather than relying on you to re-read the page.