Privacy policy

This policy explains what ozburbs collects, why, and your choices. We handle personal information in line with the Australian Privacy Principles.

Who we are

ozburbs is an Australian online directory of local businesses. For anything about your information, email privacy@ozburbs.com.

What we collect

• Account details: your name, email address and a one-way hash of your password (we never store the password itself). If you sign in with Google, see "Google user data" below.
• Profile: after signing up we ask you to confirm your name, choose your home suburb, and optionally add a mobile number. Your home suburb sets your default area; your mobile is never shown publicly and is only used to contact you about your account or listings.
• Business listings: what you enter, which is published once approved. The enquiry email on a listing is never shown publicly.
• Reading your website: if you give us your business's website (or Facebook or Instagram page), we read its public home, contact and about pages to fill in your listing: the business name, phone, email, address, opening hours and ABN the pages state, and copies of the logo and up to six photos. The pictures are stored with our storage provider (Cloudflare R2) and shown on your listing; ones you remove, or never save, are deleted (unsaved ones within a day). We keep a record of which website was read and when, for the daily limit.
• Your mobile and claiming a business: to claim a listing you verify your own mobile with a code we text you. A claim keeps your request, the messages between you and our team, and the documents you attach (for example ABN papers or an invoice). Documents are stored privately: only you and our staff can open them, and each time staff open one is recorded. They are deleted if you withdraw the claim, or when the listing or your account is deleted. When a claim is approved, the person who ran the listing before is told that it moved, not who you are.
• Your map pin: if you place a pin on your listing's map we store that point, and use it to work out the suburbs you serve. Visitors see it only if you also choose to show your address; otherwise your page shows the area you cover around your suburb. "Use my location" asks your browser for your position once, to move the pin; we keep only the pin you save.
• Pictures you upload: a logo and photos you add from your phone or computer are shrunk and re-saved in your browser before they are sent, which removes the information stored inside phone photos, including where they were taken. We store them with Cloudflare R2 and show them on your listing; ones you remove, or never save, are deleted (unsaved ones within a day).
• Confirming a business email: when you confirm your listing's email, we send a 6-digit code to it and keep only a scrambled (hashed) form of the code for 15 minutes, with the address it went to.
• Enquiries: the name, email, optional phone and message a visitor sends a business. They go to that business.
• Security records: for every sign-in, the time, method, IP address, approximate location (country, region, city, postcode and time zone), the network provider and the browser. The location comes from our hosting provider (Cloudflare) and, when it has none, from ipinfo.io, which receives only the IP address. We keep these to protect accounts and investigate abuse; our staff can see them.
• Visit counts for businesses: views, unique visitors, phone taps and website clicks on each business page, and roughly where visitors came from (our search, a suburb page, a search engine, social media or a link). A visitor is counted once a day with a code made from the IP address and browser that changes every day and cannot be turned back into either; we do not store the IP address or the page you came from. Automated traffic is not counted.
• Searches: what is searched for on ozburbs (words, category and suburb) and how many results came back, without any visitor or IP address, to see what people look for.
• Site analytics: on public pages we may use Google Analytics and glai.io to count visits and see which pages are useful. They receive the page address, your browser and approximate location. They never run on your dashboard or the admin area.

Google user data

If you choose "Continue with Google", we ask Google only for the basic sign-in scopes openid email profile. Google returns your Google account id, your email address and whether Google has verified it, your name (full, given and family name), your language setting and the address of your profile picture. We do not access your Gmail, contacts, Drive, calendar or any other Google data.

We use this only to sign you in, to create or find your account, and to show your name and picture in your dashboard (and to our staff in the admin area). We store your Google account id, email, name, given and family name, language setting and the address of your profile picture with your account, and refresh them each time you sign in with Google; we do not store the picture itself or any Google token (the one-time access token is used to read your profile and then discarded). We do not share Google user data with anyone except the providers that host our service under contract, when the law requires it, or with a buyer of the service. It is never sold, never used for advertising, and never used to train AI models.

It is kept while your account exists and deleted with it: delete your account from the Account page, or email privacy@ozburbs.com and we will delete it within 30 days. You can remove ozburbs's access at any time at myaccount.google.com/permissions.

ozburbs's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

AI drafting tools

Business owners can ask AI to create their listing from their website, draft a listing description or a reply to an enquiry, and our moderators can ask it to check a listing waiting for review. Only then, the text needed for that draft is sent to the AI provider we use for the tool (Anthropic, OpenAI, Google or xAI) through their paid API:

• Create my listing: the public text of your website's pages we read (or the sentence you typed), the facts we found on them, and our list of categories. Phone numbers, emails and addresses are taken from your pages by our own code, never written by the AI.
• Listing description: the notes you type, and your listing's name, categories and suburb.
• Enquiry reply: what you want to say, your listing's name, and the customer's first name and message. Never the customer's email address or phone number.
• Listing check: the listing's text and contact details as the owner entered them for publication.

The draft is shown to you to edit; nothing is published or sent without you. We keep a record of each use (which tool, when, the size of the request and its cost), not the text itself. The provider handles the request under its own API terms.

How we use it

To run the directory, send the emails you expect (confirming your address, welcome, resetting your password and telling you when it changed, enquiry notices and a copy for the sender, listing received, approved, sent back, taken down or reinstated, changes our team makes to your account, a confirmation when you delete your account, and confirmation codes), keep a copy of these notices in your dashboard inbox for 90 days (you choose per notice whether you get the email, the inbox copy or both; decisions about your listing or account are always emailed), keep the service secure, and moderate listings. We do not sell personal information and do not run advertising.

Who we share it with

Our hosting and storage provider (Cloudflare), our email provider (Mailgun), our SMS provider (Mobile Message, which receives the mobile number and the code when you confirm your business's mobile) and ipinfo.io (IP address location, only when our hosting provider gives none) process data on our behalf, as do Google Analytics and glai.io for visit counts. Maps are drawn from OpenFreeMap (map data from OpenStreetMap): when a page shows a map, your browser loads the map pictures from them, which shares your IP address with them as for any website. Enquiries are shared with the business you contact. Our staff can read a listing's enquiries to deal with spam, abuse or a support request; each time they do is recorded. We disclose information when the law requires it.

Cookies

Sign-up, password reset, enquiry and report forms show a picture code we make ourselves: no third-party captcha service sees you, and we keep only a random code id for a few minutes so each code works once.

One essential cookie keeps you signed in. Your browser may remember which sign-in method you used last, on your device only. Google Analytics, when it is on, sets its own cookies to tell visits apart; blocking them in your browser does not affect the site.

Your choices

You can edit your details and listings at any time, and delete your account (with all listings, stats and enquiries) from the Account page. To ask for a copy of your information or a correction, email privacy@ozburbs.com.

Contact

Questions or complaints: privacy@ozburbs.com. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner.