Privacy, plainly.
Last updated 20 August 2026
Company31 builds tools that respect the people who use them, and this website is no exception. This page explains what we collect, why, and how to change your mind. It is written to satisfy the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for visitors from the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR). Mostly, it is written to be read.
The short version
- No cookies track you until you say yes. Before you consent, analytics runs in a cookie‑free mode that identifies no one; the cookies that recognise returning visitors only turn on with your consent.
- We ask for very little. One contact form with three fields, no accounts, and no marketing lists. What you send us is used to reply to you and nothing else.
- You can change your mind any time. The cookie settings link in the footer reopens your choices and withdrawal takes effect immediately.
Who we are
Company31 is a registered Australian practice based in Sydney, New South Wales. We design and build AI‑powered solutions with Australian small businesses and not‑for‑profits. For anything in this policy, contact us at connect at company31 dot com.
What we collect, and why
When you use the contact form. The form asks for three things: your name, your email address, and the brief you want to tell us about. They are stored in a small database on the server that runs this website, so that we can read them and reply. Along with them we record the time and the IP address the message came from, purely so we can stop a spam run without turning the form off for everyone. Nothing is sent to a third party, no marketing platform is involved, and you are not added to any list.
When you email us. We receive your name, your email address and whatever you choose to tell us. We use it to reply and to work with you. We do not add you to mailing lists and we do not share it with anyone else.
Analytics. We use Google Analytics 4, in Google’s Consent Mode, to understand which pages get read, roughly where visitors come from (country or city level), what kind of device and browser they use, and how they found us. Until you consent, it runs in a cookie‑free mode: no cookies are set, no identifiers are stored on your device, and Google receives only anonymous, aggregate signals. If you opt in, Google Analytics sets the cookies listed below so it can tell apart returning visitors. Google Analytics 4 does not log or store IP addresses. Either way, we see aggregated patterns, not identities, and we use them for one thing: making this site more useful.
Server logs. Like almost every website, our hosting provider keeps standard access logs (the requesting IP address, the page asked for, and the time) for security and troubleshooting. These are kept briefly and are not used to profile anyone.
Cookies and similar technologies
Everything this site stores in your browser is listed below. The essential entries use local storage, never leave your device, and identify no one. The analytics cookies are set only after you opt in.
| Name | Kind | What it does | Lasts |
|---|---|---|---|
| c31-theme | Essential (local storage) | Remembers whether you prefer the light or dark theme. | Until you clear it |
| c31-consent | Essential (local storage) | Remembers the cookie choice you made, so we stop asking. | 12 months, then we ask again |
| _ga | Analytics (cookie, consent only) | Google Analytics: tells apart returning visitors using a random identifier. | 2 years |
| _ga_HFWJ4Q9NJV | Analytics (cookie, consent only) | Google Analytics: keeps track of a browsing session on this site. | 2 years |
Change your choice whenever you like:
Declining or withdrawing consent also expires any Google Analytics cookies already set. You can additionally block or delete cookies in your browser settings at any time.
Lawful bases
For GDPR purposes: analytics cookies run on your consent (Article 6(1)(a)), which you may withdraw at any time with the same one click it took to give it. The cookie‑free, aggregate measurement that runs before consent, along with replying to your email, answering what you send through the contact form, and keeping security logs, relies on our legitimate interests (Article 6(1)(f)) in running a working, safe website and answering the people who get in touch; the pre‑consent measurement stores nothing on your device and identifies no one. We do not sell personal information, we run no advertising or remarketing, and we make no automated decisions about anyone.
Who your data goes to
Analytics data goes to Google LLC, which processes it on our behalf and may do so on servers outside Australia, including in the United States. Google participates in the EU–US Data Privacy Framework. Our hosting provider stores the contact form database and processes server logs. That is the whole list: no data brokers, no advertisers, no customer relationship platform, no one else.
How long we keep things
Form messages and email correspondence are kept for as long as the conversation, or the work it leads to, needs it, and are deleted once they are neither. Google Analytics retains event data for up to 14 months. Cookie lifetimes are in the table above.
Your rights
If you are in Australia, the Australian Privacy Principles give you the right to access and correct the personal information we hold about you. If you are unhappy with how we handle it, you can complain to us first, and to the Office of the Australian Information Commissioner at oaic.gov.au.
If you are in the EEA or the UK, you also have the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your local supervisory authority. Given how little we collect, the fastest path is usually just to email us.
Security
The site is served over HTTPS only, with strict security headers, and we collect the minimum we can. The contact form database sits outside the public web root, so it cannot be reached from a browser, and it is read through a password‑protected page. The less we hold, the less can go wrong. That is a design decision, not an accident.
Children
This site is written for organisations and the adults who run them. We do not knowingly collect personal information from children.
Changes to this policy
If we change how the site handles data, we will update this page and the date at the top before the change takes effect. We will not quietly add tracking behind a policy you have already read.
Questions
Use the contact form, or write to us at connect at company31 dot com. Either way a person will answer. If you want the message you sent us deleted, ask, and we will delete it.