Privacy Policy

1. About this policy

1.1 This policy explains how WP Creative (Naphix Pty Ltd, ABN 65 610 345 198) handles personal information in PostCliq. We apply the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), including APP 1 (open and transparent management) and APP 5 (notice at collection), whether or not the law requires a business of our size to.

1.2 "Personal information" means information about an identified or reasonably identifiable individual. Most of what PostCliq handles is information about websites and businesses. This policy covers the parts that are about people.

1.3 This policy applies to PostCliq only. WP Creative's agency services have their own privacy notice, published on wpcreative.com.au.

1.4 This policy forms part of the Terms and Conditions at /terms. Section numbers in this policy refer to this policy unless they say "Terms".

2. What we collect

We do not collect payment details. We do not ask for sensitive information (health, religion, political opinion and similar) and ask you not to enter it.

3. How we collect it

3.1 Directly from you when you register, add a site, enter numbers, share, refer, request a resource or contact us.

3.2 Automatically when you use the app, through server logs (section 14).

3.3 From Google when you sign in with Google (name, email, account identifier) or connect a Google property (the data in section 2, under the permission you grant), and from Microsoft when you connect Clarity.

3.4 From the public web, when our crawler reads the pages of a site you add.

3.5 From other users, when someone shares a report with your email address or invites you.

4. Why we use it

We do not sell personal information. We do not use it for advertising to you on other platforms.

4A. Google user data

If you connect Google Analytics 4, Google Search Console or Google Ads, PostCliq reads, with your permission and read-only:

• sessions, key events and landing pages from the GA4 property you choose;
• clicks, impressions, click-through rate and positions by page and query from the Search Console property you choose;
• campaign spend, clicks and reported conversions by landing page from the Google Ads account you choose.

We use this only to show that data beside your website audit. We store it as aggregates, never sell it, never use it for advertising, and never use it to train AI models. People see it only to the extent your company can see its own reports. PostCliq never changes your analytics, Search Console settings or campaigns.

PostCliq's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).

You can disconnect at any time in PostCliq or in your Google account settings. Disconnecting stops new imports and deletes the access token; deleting the saved history is a separate choice in PostCliq.

5. Company grouping by email domain and domain-match access

This is how access is decided. It affects who can see information about you and your sites.

5.1 Grouping by domain. When you verify a company email address, we read its domain and place you in the PostCliq company for that domain. Everyone who verifies an address at that domain is placed in the same company and can see the company's sites, reports, members' names and email addresses, connection status and usage. We do not check with anyone at the company before doing this. Free-mail domains (Gmail, Outlook, Yahoo, iCloud, Proton and similar) are excluded and form a personal company of one.

5.2 What colleagues see about you. Your first name and email address in the People list, and the sites and audits you added or ran.

5.3 Company contact. The first registrant of a company is recorded as the company contact and is emailed when a new colleague joins.

5.4 Domain-match access. If your verified email domain matches a site domain that another company (for example an agency) holds, you automatically receive read-only access to that site's report. The company that holds the site can see that a domain-match viewer exists, with the viewer's name and email domain.

5.5 Access logging. Every report access is logged with the user, time and route (member, share, domain match, super admin) so disputes can be resolved.

5.6 WP Creative super admins. A small number of WP Creative staff can view any company and report for support, dispute handling, abuse control and sales follow-up you have asked for. Their access is logged and reviewed.

6. Who we disclose it to

6.1 Service providers (processors). We use third parties to run PostCliq. They act on our instructions and may only use the data to provide their service to us.

6.2 People you choose. When you share a report or send an invite, the recipient sees your name and the site domain. Members of your company see what is described in section 5.

6.3 WP Creative sales. Only when you use the explicit "share selected findings with WP Creative" control, or contact us asking for help. Not otherwise.

6.4 Legal. We may disclose information where the law requires, to protect our rights, or to investigate abuse of the service or harm to the sites we crawl.

6.5 Business transfer. If WP Creative sells or transfers PostCliq, your information may transfer with it. We will tell you first.

6.6 Published benchmarks. If you switch contribution on, we may publish industry benchmarks built from audits (section 9A). What we publish is aggregated and de-identified. It does not name you, your company or your site, and it does not show your figures. Section 9A sets out the limits of that statement.

7. Overseas disclosure

7.1 Some of the providers in section 6.1 store or process data outside Australia, in particular in the United States (AI analysis, email delivery, hosting, and provider support access to the database). Our staff in Nepal may also access data to support you.

7.2 Before we disclose personal information overseas we take reasonable steps to make sure the recipient handles it in a way consistent with the APPs, usually through the provider's data processing terms. Where we cannot do that, we will tell you and ask for your consent, or not disclose.

7.3 Selecting an Australian database region does not mean every copy of your data stays in Australia. We do not claim Australia-only storage.

8. Public website content and other people's information

8.1 When we crawl a public website you add, the pages may contain personal information that the site owner published: staff names and photos, contact details, testimonials, author bylines. We did not ask for it and the individuals do not know we have a copy.

8.2 We minimise this. We only fetch what an ordinary visitor could see. We store bounded excerpts and screenshots, not whole sites. Where feasible we redact contact details and other personal data from text before it is stored or sent for AI analysis. We delete raw crawl data within 7 days and screenshots within 30 days (section 10). We do not build profiles of individuals from crawled pages and we do not use crawled personal information for marketing.

8.3 If you are named on a website that has been audited and want the excerpt removed, contact us (section 20). We will act on reasonable requests.

8.4 By adding a site, you confirm that you are permitted to request an audit of it (Terms, section 5.2). We rely on that confirmation.

9. AI processing

9.1 We send redacted excerpts of public page content and evidence to an AI provider (currently OpenAI or Anthropic) to classify pages, find and explain problems and draft suggested actions. For AI-visibility checks, Anthropic's model is also given public page titles and headings and the site's domain, and searches the public web the way a buyer's AI assistant would. We do not send your name, email, access tokens, connected analytics data or business inputs to an AI provider.

9.2 The AI provider processes the data in the United States. Its API terms state that it does not use API data to train its models by default, and we rely on that setting. Retention at the provider depends on the endpoint and the account settings; we choose the minimum retention available to us.

9.3 AI outputs are validated against evidence before they appear in a report. They are assistance, not decisions about you. No automated decision with legal or similarly significant effect on an individual is made by PostCliq.

9A. Industry benchmarks built from audits

9A.1 What we do

9A.1.1 If you switch contribution on, we use measurements from the audits we run to build industry benchmarks, such as a typical enquiry rate for a sector in a country. We show those benchmarks in PostCliq and we publish them. No licensed dataset exists for the Australian market, so a first-party benchmark is the only one we can offer honestly.

9A.2 What we use for it

9A.2.1 Aggregate funnel measurements, page and category-level performance, check results, the sector we classify the site into, the country and the period. Terms section 7A.3 lists these in full and section 7A.4 lists what is never included.

9A.2.2 Most of this is information about a website and a business, not about a person. It is not personal information under the Privacy Act. We are describing it here anyway, because you should be able to see what happens to your data without having to work out which law applies to which field.

9A.2.3 Where the source records do contain personal information, for example the account that requested an audit, that personal information is stripped before the measurement joins the benchmark pool. It is not part of what we build with and it is not part of what we publish.

9A.3 Why we use it

9A.3.1 To produce an industry comparison that our customers can rely on, and to publish research about how Australian websites actually perform. Without contributions there is no benchmark, and without a benchmark no customer sees a comparison.

9A.4 Our basis under the Australian Privacy Principles

9A.4.1 We collect the underlying measurements to run the audit you asked for. That is the primary purpose under APP 3 and APP 6.

9A.4.2 Building benchmarks is a secondary purpose. We rely on your express choice: the measurements are used only after you switch contribution on, and we tell you what that means here and in Terms section 7A before you do.

9A.4.3 The OAIC's guidelines treat de-identification as a question of context and risk rather than a one-off technical step. That is the standard we apply in section 9A.5, and it is why a numeric threshold alone is never enough to publish a cell.

9A.5 Aggregated and de-identified before use

9A.5.1 Measurements are stripped of identifiers and pooled before they are used. A published cell summarises a group, never a business. At least 30 independent businesses sit behind a published cell, no single business may account for more than a limited share of it, only completed periods are published, and a named reviewer checks each cell for re-identification risk and records the result before it goes out.

9A.5.2 The limit. De-identified is not anonymous. Aggregates drawn from small groups can sometimes be worked backwards, and Australia is a small market with narrow sectors. The threshold and the review reduce that risk. They do not remove it, and we do not claim they do. A cell the reviewer is uneasy about is not published even if the numbers permit it.

9A.6 How long it is kept

9A.6.1 The measurements in the benchmark pool are kept in de-identified aggregate form while the benchmark programme runs, and the pool is reviewed at least once every 12 months. They are not tied to your account, so deleting your account does not remove a contribution already pooled, and we cannot pick it out again. Deleting your account does stop any further contribution.

9A.6.2 The audit records the measurements came from are kept and deleted on the ordinary schedule in section 10. Nothing in this section extends that schedule.

9A.6.3 Each published cell carries a recorded expiry date and is reviewed or retired at that date.

9A.7 How to switch it on or off

9A.7.1 Contribution is off by default. The control is in Settings, under Company, labelled "Contribute to industry benchmarks". Any member of your company can use it and it applies immediately. Until that switch is shown in your account, contribution is off. You can also email the privacy contact in section 20 and we will action it within five business days.

9A.7.2 Switching off is free. It does not reduce your allowances, change your report or affect your support. See Terms section 7A.7.

9A.7.3 After you switch off, your measurements stop being used within 30 days and are excluded from every cell built afterwards. Cells already published stay as published. They are pooled summaries of at least 30 businesses and do not identify you, and we will not claim we can recall a figure that has already been released.

9A.7.4 If you believe a published cell identifies you or your business, tell us (section 20). We will review it and, if we agree, withdraw it.

10. Retention and deletion

We keep information only as long as it is needed for the purpose we collected it. The current schedule:

10.1 When you delete your account or company, we stop all jobs and revoke all credentials immediately, and delete active records within 30 days. Copies in backups expire within the backup period above. We keep the minimum needed to evidence your consent history and protect against abuse, where the law allows.

10.2 Disconnecting a provider and deleting its saved history are separate actions, so you are not surprised by lost trend data.

11. Security

11.1 We take reasonable steps to protect your information. In plain terms:

• Every report requires a signed-in, verified user. There are no public links.
• Database rules enforce that a company's members can only read that company's data, and are tested for every table.
• Access tokens for connected providers are encrypted and never appear in browsers, logs or AI prompts.
• Our crawler runs in isolated containers with no access to our internal systems, and can only reach public internet addresses.
• Crawled content is treated as untrusted data. It cannot instruct our systems.
• Staff access is limited to a small number of named people and is logged.
• Providers are chosen for their security practices and bound by data processing terms.

11.2 No system is perfectly secure. We do not claim any security certification for PostCliq. Keep your email account secure, since it is your key to PostCliq.

12. Access and correction

12.1 You can see and change your name and notification settings in the app. You can see your company's members, sites and reports there too.

12.2 You can ask us for a copy of the personal information we hold about you, or ask us to correct it. Contact us (section 20). We will respond within 30 days. We may need to verify your identity. If we refuse a request we will tell you why and how to complain.

13. Deleting your account or company

13.1 Your account. Delete it in settings. Your membership ends, your name is removed from the People list, and your personal records are deleted on the schedule in section 10. Sites, reports and connections belong to the company and remain for the other members.

13.2 Your company. The company contact can delete the whole company after re-authenticating. This deletes every site, report, connection, history and membership for every member. Other members are told. This cannot be undone.

13.3 Backup boundary. Deleted data can remain in encrypted backups for up to 35 days. We record deletions so that, if we ever restore from a backup, deleted data is removed again before the system reopens.

13.4 Someone else's site. If a site about you is held by another company, contact us. We can remove excerpts about you (section 8.3) but we do not delete another company's report at your request unless the law requires it.

13.5 A form you filled in. If you asked for a resource or contacted us on postcliq.com and want that submission deleted before the 24 months in section 10, email us (section 20) and we will delete it.

14. Your choices about cookies, analytics and recordings

14.1 Essential storage keeps you signed in, protects forms, remembers an audit you started before signing in, and remembers preferences such as reduced motion and your optional-tracking choice. The tracking-choice cookie stores your choices, their version and date, not a tracking identifier. You do not have to allow optional tracking to use PostCliq.

14.2 We do not use advertising or remarketing pixels for this analytics setup. Advertising purposes remain denied in Google Tag Manager. An anonymous analytics identifier can span postcliq.com and app.postcliq.com only after you allow analytics; it is not used to follow you around other websites.

14.3 With your optional consent, we use PostHog to understand page and feature use and returning browser sessions. Events use anonymous browser/session identifiers and approved screen names. We remove customer domains, report and audit identifiers, query strings, fragments, referrer URLs and page titles. We do not send your email, name, private report excerpts, connected figures, business inputs, form contents or access tokens to PostHog. Its project is configured to anonymise IP addresses; like any internet service, its servers receive a network address to handle the connection. No PostHog person profile is created. Account, authentication, connection and administration screens are excluded from this tracking.

14.4 PostHog masked recordings are a separate option. We sample 10% of eligible public-page sessions after you allow them. Text and source attributes are masked, forms and images are blocked, and network bodies, headers, console logs and embedded media are excluded. Private reports, account screens and the app are never recorded. Public pages with query strings or fragments are excluded from replay too. These measures reduce detail in playback to protect privacy.

14.5 Our marketing site's existing Google Tag Manager container may load Google Analytics and Microsoft Clarity. To cover both usage measurement and possible recordings in that container, it loads only when you accept both optional categories and visit an eligible public page. We exclude CMS previews, framed pages, contact and legal pages, and pages with query strings or fragments from initial loading. Choosing "Analytics only" enables PostHog's limited event analytics without loading that container. We do not add PostHog through Tag Manager as well. Changing or withdrawing the choice may reload the page so previously loaded optional tags stop.

14.6 The first-visit banner offers "Accept all", "Analytics only" and "Reject optional". You can change or withdraw consent at any time through "Privacy choices". Your selection is remembered on this browser across our website and app for six months. Agreeing to the Terms or Privacy Policy when signing up does not turn on either optional category. Browser Do Not Track and Global Privacy Control signals prevent our optional PostHog and Tag Manager collection. Refusing or withdrawing does not affect access to PostCliq.

14.7 Two services run on every visit to postcliq.com and are not part of the optional choices above. HubSpot is our customer relationship management system: it sets cookies to recognise a returning browser, records the postcliq.com pages it visits and where it came from, and links those visits to the details you give us when you fill in a form, so our team knows what you were looking at. Ahrefs Web Analytics counts page views without cookies. Neither runs in the PostCliq app, on account screens or inside private reports. To stop HubSpot recognising your browser, block or clear cookies for postcliq.com; to have your HubSpot record deleted, contact us. These services do not receive your report contents, connected figures or business inputs.

14.8 Withdrawing consent stops new optional collection; it does not erase data already received. See section 10 for retention and sections 12 and 13 for access and deletion requests. You may also block browser storage, although blocking essential sign-in storage can prevent sign-in from working.

14.9 Separately from the choices above, our servers send PostHog operational metrics about PostCliq's own calls to AI providers: the provider and model, the type of task, token counts, response time, whether the call succeeded or the general kind of failure, and estimated cost, labelled with random identifiers created for each request. These metrics contain no prompts, page text, AI answers, website addresses or domains, email addresses, or account, company, site or report identifiers, and they are not linked to you, your browser or your analytics choices. We use them to monitor the cost, speed and reliability of the service.

15. Children

PostCliq is a business tool for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

16. Direct marketing

16.1 We send our newsletter and product updates to active account holders, as explained in the Terms (section 4). Every message identifies us and has an unsubscribe link. Unsubscribe at any time from any message or in settings.

16.2 A resource or contact form on postcliq.com asks you to agree to the Terms and Conditions. It does not subscribe you to the newsletter. We use those details to send you what you asked for and to answer you.

16.3 We do not give your details to third parties for their marketing.

16.4 You can ask us to tell you where we got your information. We will tell you unless it is impracticable or unreasonable.

17. Data breaches

If we experience a data breach that is likely to result in serious harm to you, we will notify you and the OAIC as the Notifiable Data Breaches scheme requires. We will tell you what happened, what information was involved and what you can do.

18. Complaints

18.1 If you think we have breached the APPs or this policy, contact us first (section 20). Tell us what happened and what you would like us to do. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

18.2 If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Web: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

19. Changes to this policy

We may update this policy. Material changes will be notified by email or in the product at least 14 days before they take effect. The version and effective date are at the top of this page.

20. Contact

Privacy contact, WP Creative (Naphix Pty Ltd, ABN 65 610 345 198)

• Email: [email protected], with "Privacy" in the subject line
• Post: 63/89-97 Jones Street, Ultimo NSW 2007, Australia