Privacy Policy

Last updated: 6 July 2026

Who we are

Hills Plumbing & Gas operates https://www.hillsplumbingandgas.com.au. We're a Queensland-based, QBCC-licensed plumbing & gas business servicing the Gold Coast and Tweed area. This policy explains what personal information we collect, how we use it, where it's stored, and your rights under the Australian Privacy Principles (APPs).

What we collect

Quote forms — name, phone number, email (optional), suburb, and a description of the job you need done.
Phone clicks & quote submissions — we count how many people tap our phone number or submit a quote form each day. This is an anonymous counter, no personal data is stored against it.
Server logs — your IP address, user-agent, the page you requested, and the time of the request, kept for security + abuse detection. These are retained for ~60 days.
Error reports — if a page crashes in your browser, we log the error message + stack trace so we can fix it. We don't log the contents of forms you were filling in. Retained for ~60 days.
Analytics — anonymised page-view + visit-duration data if Google Analytics is enabled (we currently don't set any cookies that would identify you personally).

How we use it

To respond to your quote request, ring you back, and arrange the job.
To send job confirmations, invoices, and follow-up safety advice.
To improve the site and understand which pages help customers most (which suburbs need more content, which questions get answered, etc).
To comply with QBCC, ATO, and other legal record-keeping obligations (we are required to keep records of every job for 6 years).
To detect and block spam / abuse of the quote form + upload tools.

Who we share it with

We never sell your information. We share it only with the service providers below — each one is required to handle data securely and only for the purpose we've engaged them for:

Vercel (hosting + edge CDN, Sydney region) — every page request, server log, and uploaded photo passes through Vercel's infrastructure. Vercel Privacy Policy →
Vercel Blob — stores public photos and videos uploaded through our admin (job galleries, before/after shots). These are public-read URLs by design.
Vercel KV (Upstash Redis, AU region) — stores anonymous daily-count tallies for phone-click + quote-submit events, error log entries (60-day TTL), and per-IP rate-limit counters (60-minute TTL).
Sanity (content + leads database) — stores the structured record of your quote submission so we can manage it through our admin. Sanity Privacy →
Resend (email delivery) — sends the quote email to us, and if you provided your email, the confirmation back to you. Resend Privacy →
Cloudflare Turnstile (spam protection) — verifies the quote form was submitted by a real person, not a bot. No tracking cookies set.
Google Search Console — we connect our admin to Google's Search Console API (OAuth, read-only) to see which search queries surface our pages. The OAuth refresh token is stored in Vercel KV. No customer PII is shared with Google through this channel.
Google Analytics + Microsoft Clarity (analytics) — anonymised page-view data only, only loaded if we've configured the integration. Currently not active by default.

All of the above are reputable global services with their own published privacy policies. Some are based outside Australia (mainly the US). By using this site you consent to your information being processed in those jurisdictions.

How long we keep it

Quote leads in Sanity: indefinite by default, but we will destroy on request, and we plan to auto-archive leads older than 24 months.
Server logs + error reports in Vercel KV: 60 days.
Rate-limit counters: 60 minutes (auto-expires).
Daily analytics counts: 90 days rolling.
Uploaded photos in Vercel Blob: until we remove them from the gallery (administrator-controlled).
Tax / QBCC compliance records: 6 years as required by law.

Your rights

Under the Australian Privacy Principles you can:

Ask us what information we hold about you.
Ask us to correct anything that's wrong.
Ask us to delete your information (subject to our legal obligation to keep QBCC + tax records for 6 years).
Withdraw consent for marketing or follow-up communications at any time.
Complain to the Office of the Australian Information Commissioner if you believe we've mishandled your information.

Email sales@hillsplumbingandgas.com.au for any privacy request and we'll respond within 30 days.

Cookies

We don't use tracking cookies. The site sets one HttpOnly cookie (hp-session) only when an authorised operator (the owner) logs into our admin — that cookie identifies the admin session and is not used for anything else. We also briefly set a short-lived (10-minute) cookie during the Google Search Console OAuth handshake to prevent CSRF attacks.

If we later enable Google Analytics or Microsoft Clarity, those tools may set their own cookies. We'll update this policy and surface a clear opt-in before that happens.

Security

The site is served exclusively over HTTPS with HSTS preload. Admin endpoints require authentication. Passwords are compared in constant time. The Vercel Blob store, Sanity database, and KV instance are all access-controlled and isolated to this project. We rate-limit the quote form, error report endpoint, and login route to prevent abuse.

Children

The site is intended for adults arranging plumbing services for property they own or manage. We don't knowingly collect information from anyone under 16.

Changes

When we change this policy we'll update the "last updated" date at the top. Material changes that affect how we use existing data will also be announced via the contact email of any active leads.

Contact

Privacy questions: sales@hillsplumbingandgas.com.au or call 0472 657 042.