Last updated 2026-11-02
Privacy policy
Devinium is a Melbourne software consultancy, operating since 2007. This policy explains what information we collect when you visit devinium.com or get in touch with us, why we collect it, who it gets shared with, and how long we keep it.
Devinium currently sits below the AUD $3 million turnover threshold that makes the Australian Privacy Act 1988 strictly binding on a private business. We have chosen to operate to the Australian Privacy Principles (APPs) anyway, because the people who hire us deserve the same handling regardless of which side of that line we sit on. If our turnover crosses the threshold, nothing in this policy changes; the legal obligation simply catches up to the practice.
We have tried to write this in plain English. Where a section names a specific tool or vendor, that is deliberate. Vague claims about "secure cloud storage" or "industry-leading practices" do not survive contact with reality. The named vendor list does.
What we collect
We collect information in four places: when you submit a form, when you ask for results from one of our free tools, when you book a call, and when you load a page on the site.
From our contact form
When you submit the contact form on /contact/, we collect your name, email address, company name (if you provide it), and the message you write. We also receive standard attribution metadata that the form ships with the submission: the page you submitted from, any UTM tags on the URL, and your recent click path through the site. The latter exists so we can tell whether a submission came from an ad campaign, a blog post, or a direct visit. We also record whether you ticked the separate, optional box to get occasional notes from us. On our campaign pages the same form also asks your company size, budget range and when you want to start, each picked from a short list. It also sends the Google click id from the ad you clicked, if you came from one, so we can tell which ad led to your enquiry.
From the waitlist and checklist forms
When you join a product waitlist or ask for a checklist, we collect your email address, your name if you give it, and, if you answer them, the optional questions on the form (the systems you run, your team size and your field). For a waitlist we also record the tier you signed up for (a URL parameter that records which tier you were looking at). The same attribution metadata and optional notes box as the contact form apply.
From the free tools
The free tools on /tools/ work out your result in your browser, and nothing you enter is sent to us while you use them. If you ask for your full results by email, we collect your email address, your answers and result (for example the situation the tool named, your team size range and the systems you ticked), whether you agreed to hear from us, and the same attribution metadata as the contact form (the page you came from and any UTM tags on the URL).
When you book a discovery call
We use Calendly to schedule discovery calls. Calendly receives your name, email address, the slot you chose, and any free-text answers you provide on its booking form. The booking also appears on the Devinium team calendar after you confirm.
When you visit a page
PostHog records pageviews and click events against a random visitor identifier. Where analytics runs (see Cookies and analytics), PostHog keeps that identifier in a first-party cookie, so the pages of one visit are linked and a later visit from the same browser is recognised. Otherwise the identifier lasts only while the tab is open. Each PostHog event also records the network your connection comes from, as Cloudflare reports it: the network owner's name and number (your internet provider, or a cloud host such as Amazon) and the country. We use it to tell automated traffic from people. It does not include your IP address. If you arrived from one of our ads, we keep the ad\'s campaign tags and Google click id in your browser for the rest of that visit, so we can tell which ad brought you. Cloudflare Web Analytics is not currently enabled. If it is enabled in future, this section will be updated before that change ships.
We also run Google Analytics 4, which sets first-party cookies to recognise a returning browser and records the pages you view, how you arrived, your approximate location (derived from your IP address, which is not stored), and your device and browser type. We have turned on Google signals, which lets Google associate that visit data with the Google account of visitors who are signed in and have turned on Ads Personalisation, so we can see aggregated demographics and interests reports. See Cookies and analytics for how to opt out.
We also run Microsoft Clarity. It records pageviews, clicks and scrolling, and shows us which visits came from AI assistants such as ChatGPT, Perplexity and Copilot. It follows the same consent model as Google Analytics, described in Cookies and analytics below.
Session replay
PostHog records anonymised session replays. Two protections apply by default. Every input, textarea, and select field is masked in the recording, so anything you type into a form is never captured. The recording stops the moment you focus on the first form field on a page, so even masked form interactions are not part of the replay. The replay shows the shape of a visit (which sections you scrolled to, which links you hovered) and nothing more.
Microsoft Clarity also records session replays and heatmaps. It runs with strict masking, so the text on the page and anything you type are hidden in the recording.
Server logs
The site is served by Cloudflare Pages. Cloudflare retains short-lived edge logs that include IP addresses and request paths as part of its security and abuse-prevention service. Devinium does not maintain a separate access log of its own.
Why we collect it
Three reasons.
To reply to you. If you submit a form or book a call, we need your name and email to write back. If you ask about a specific kind of project, the message body is what tells us whether we are the right consultancy for the job.
To understand where inquiries come from. Attribution metadata (UTM tags, referrer, click path) tells us whether an inquiry came from a paid ad, an organic search, a LinkedIn post, or a referral. We use that to decide where to spend time and money on outreach. It is not used to build a profile of you.
To improve the site. Pageview and click data tells us which pages people actually read and which sections they skip. Session replays (anonymised, form-masked) tell us where the site is confusing or broken. We act on the aggregate, not on individual visits.
How long we keep it
By record type below. Where a vendor publishes a retention default we give the exact number; where it does not, we tell you what we actually do.
Contact and waitlist submissions. Your submission is kept on your ActiveCampaign contact record, with a notification copy in the Google Workspace inbox, for the lifetime of the working relationship and a reasonable period after, so we can answer follow-up questions or pick up where we left off. If you ask us to delete them, we delete both.
Free-tool and checklist sign-ups. Your ActiveCampaign contact record is kept until you unsubscribe and ask us to delete it, or until it has been inactive long enough that we clear it out. Unsubscribing stops the emails straight away; if you also want the record gone, ask and we delete it.
Calendar bookings. Calendly retains records of completed bookings indefinitely, until manually deleted. The corresponding event on the Devinium team calendar persists for the duration of the engagement and is archived after.
PostHog analytics. On the PostHog free-tier plan we run, session replays are retained for up to 30 days (the plan's configurable maximum) and event data for up to 1 year (the free-plan default). Because the PostHog identifier is random and form fields are masked, there is no link from any of those records back to your identity unless you also submitted a form.
Google Analytics. Event-level data is retained for up to 14 months, then deleted automatically. Aggregated reports are kept after that, with no link back to an individual visit.
Microsoft Clarity. Session replays are kept for 30 days from the time of recording. Clarity keeps any replay we mark as a favourite, and a random sample it selects, for up to 9 months. These are Clarity's own limits.
Server logs. Cloudflare retains edge logs for a short window as part of its abuse-prevention service. Devinium does not separately archive those logs.
Your rights
Under the Australian Privacy Principles, you have the following rights over information we hold about you. We honour these regardless of whether the Privacy Act strictly binds Devinium at any given moment.
- Access. You can ask what information we hold about you. We will reply within a reasonable time with a copy.
- Correction. If anything we hold is wrong, you can ask us to correct it. We will.
- Deletion. You can ask us to delete records we hold about you. We will delete the records on our side, and where a subprocessor stores a separate copy (ActiveCampaign, Calendly, PostHog, Microsoft Clarity, and Google Workspace), we will ask that vendor to delete their copy too.
- Opt out. You can ask us not to send you any further email, ever. See the next section for what that means in practice.
Send any of these requests to hello@devinium.com. We do not charge a fee. We do not require a particular form. A short note is enough.
Marketing emails
If you submit the contact form, we reply to that form, and that is the end of the standard interaction. We add you to our occasional-notes list only if you tick the separate, optional box for it. The same goes for the waitlist and checklist forms: joining a waitlist gets you an email when the product is ready, and asking for a checklist gets you the checklist.
Occasionally we email past inquiries by hand, one at a time, when something we are working on is genuinely relevant to a conversation we had before. Those are not bulk sends. Every such email contains a one-line opt-out at the bottom. If you reply with "please stop", we record that against your contact in our records and you do not hear from us again.
If you ask for your results from one of our free tools, we email you those results once. That is all, unless you also choose to hear more. Hearing more is a separate choice, never pre-ticked and never required to get your results: you tick a box, or press a button, that names the short follow-up series you will get and says occasional notes follow it. We record when you opted in and the wording you saw. All of these are sent through ActiveCampaign. Every email has an unsubscribe link, and unsubscribing takes effect straight away.
Children's data
Devinium does not knowingly collect information from anyone under the age of 16. Our site is aimed at business buyers. If you believe a child has submitted a form here, write to hello@devinium.com and we will delete the record.
Changes to this policy
We update this page when something changes about how the site works (a new subprocessor, a new analytics tool, a change to retention). The "Last updated" date at the top of the page changes every time the substance changes. We do not version-bump the date for typo fixes.
We do not email past contacts when we update this page. If a change materially affects information you already gave us, we will send you a single notice email at the address on file.
Contact us about privacy
Privacy questions, access requests, correction requests, and deletion requests all go to the same place:
Devinium Pty Ltd. ABN 94 668 433 707. 31 Queen Street, Melbourne, VIC 3000.