Privacy
This page explains what happens to anything you send us. The short version is first; the detail follows, including the parts we do not control.
The short version
- What we get: what you typed, and your email address only if you choose to give it.
- Who touches it: Basin stores it in Canada, with some processing in the United States. An automated spam filter reads it before we do, and Postmark in the United States carries the notification email to our inbox. Nobody else.
- How long: 30 days at Basin and in our inbox. Postmark holds its own copy for 45 days by default, and that one is not ours to shorten.
- To have it deleted: email hello@custodara.com and we will, without asking why.
What we collect
If you fill in the form, we receive what you typed and — only if you choose to give it — your email address. There is no account, no login, and no tracking of you across other websites. Please don’t name a client, a property address, a lender or anyone else — we only need the shape of what stopped you. Someone you name here never visited this site and cannot ask us for their information back, and nothing between your browser and our inbox will stop or redact it. If a message does name someone, tell us and we will delete the whole message rather than keep it.
Sent with the form, in the same message: the site or link that brought you here, any campaign tag on the link, and which page you were on. We use this to understand which channels people arrive from. Because it travels with your message, treat it as attached to what you wrote.
If you only read the page, we count the visit. We use GoatCounter, which sets no cookies and does not track you between sites. It records the page you viewed, where you came from, your country, your browser’s language, and the width of your screen. Your IP address is used to work out your country and to tell repeat visits apart; GoatCounter holds it in memory for up to eight hours and does not store it. The counting script itself is delivered by a content delivery network, bunny.net, which sees the request for it.
Where it goes
We have accounts with two services, and neither stores anything in Australia. Each of them uses others in turn. We looked for a free form service that stores submissions in Australia and did not find one we could use.
| What | Service | Stored in |
|---|---|---|
| Form submissions | Basin (Moonshot Ventures Inc.) | Canada, with some processing in the United States |
| Notification emails | Postmark, via Basin | United States |
| Spam checking | SpamCheck.ai, which is Basin’s own service, and possibly other Basin vendors | Canada, possibly also European Union and United States |
| Visit counts | GoatCounter | Finland and Germany |
The table says where things are kept. It is not the whole list of parties a message passes through on the way. The form posts to Basin through Cloudflare, which Basin uses as its firewall and lists in the United States; Cloudflare does not publish what, if anything, it retains of a request like this. Every submission is also read by an automated spam filter before we see it: SpamCheck.ai, which is Basin’s own service and runs in Canada. Basin additionally lists a European spam processor and a United States AI service used for spam scoring depending on how a form is configured; Basin does not publish which of those applies to a form like ours, and we have asked. Basin cannot email a submission to us without also storing it — there is no email-only mode. By sending the form you are sending that information overseas. If that is not acceptable to you, email us instead — it then stays in your own mail provider’s hands rather than passing through ours.
How long we keep it
Form submissions are deleted from Basin after 30 days, and we delete the notification email that reaches our own inbox on the same schedule. There is a third copy we do not control: Postmark, which sends that notification, keeps the content of the mail it sends — 45 days by default, in the United States. That is Basin’s account with Postmark rather than ours, so neither the setting nor the copy is ours to change. Basin can also keep a submission for years as a spam-training example, but only if someone corrects one of the filter’s decisions — up to 24 months for a message restored, up to 60 months for one marked as spam. Basin allows that to be switched off for a form and will delete such a record on request. Visit counts are kept as anonymous aggregates.
What we do with it
We read it. No person other than us reads it — but automated spam filtering does read it, because that is what a spam filter is, and the section above says where that happens. Beyond the services listed there, which are how the form reaches us at all, we pass it to no one. We will not add you to a mailing list, we will not send you a sequence of follow-up emails, and we will not sell or share anything you write.
If you gave an email address, we may reply once. If you would rather we didn't, say so and we won't.
Getting it back, or getting rid of it
Email us and ask, and we will not ask you why. Deletion reaches the copy in Basin and the copy in our inbox straight away and permanently. It does not reach the copy Postmark holds, which goes when its own window is up. If you sent the form without an email address, there is nothing on it that identifies you — tell us enough to find the right message, because we will not send anyone’s message to an address that did not send it. Email hello@custodara.com.
Who we are
Custodara is a project of Valuation Ready, a business name registered with ASIC and operated by a sole trader in New South Wales. That sole trader — not the business name — holds anything you send through this site; a business name is not a legal person and cannot hold anything. The ABN below identifies them on the public register at abr.business.gov.au.
Valuation Ready, ABN 65 397 914 685, Australia. Contact: hello@custodara.com.