Privacy
Two different sets of people appear in this page, and it matters which is which.
You — our client, the business using Get Carter. We hold your name, work email, company, website and billing details so the service works and we can invoice you.
Your visitors and contacts — the people who visit your website and enquire with you. We hold their information on your behalf and on your instruction. They are your contacts, not ours. We don't market to them, sell them, or use them for anything except running Get Carter for you.
What the tracker collects on your website
- Pages viewed (address and page title), when, and the referring site — so you can see where your traffic
comes from. Page and referrer addresses are kept without anything after the question mark, with one exception: on a visitor's first page we
read the standard campaign labels (
utm_source,utm_medium,utm_campaign,utm_content,utm_term) and note whether a Google Ads click id was present — not its value. Search terms, tokens and anything else in the link are not collected. - An identifier kept in the visitor's browser for your website, to join up visits from the same browser. It is random, set by us, and read only on your site. A random identifier does not make the activity anonymous: as soon as it can reasonably be linked to a person — because they submit a form, or you connect a system that identifies them — the identifier and the visits attached to it are personal information, and we handle them as such throughout. No third-party cookies and no advertising trackers.
- Approximate country and device type, worked out at the moment of the visit.
- Form entries, only when a form is submitted — nothing is read while someone is still typing. Which forms and which fields is your choice under Forms in your dashboard: the basics (name, email, phone, message), every field, notes only, or nothing at all. A tick box on the form is recorded as consent only when it was ticked. So that you can make that choice, the tracker notes which forms exist on your site and how their fields are labelled — names, labels, types and the choices in any dropdown, not what anyone typed — when a page loads or a form is sent; a form you have not switched on is listed and nothing from it is kept. Login forms, search boxes and payment fields are never read.
- Steps on the way to an enquiry or a sale: whether a visit reached pages you name (a pricing page, a booking page), the shop, or the cart. These are counts of visits, read from the page addresses already recorded.
Sensitive information. Whatever is switched on, the tracker does not read fields whose name or label identifies them as passwords, card or bank details, government identifiers (tax file, Medicare, passport and licence numbers), dates of birth, or health and medical information, and our server discards such fields if a browser sends them anyway. That protection works on how a field is named, so it has limits: it cannot know what a person chooses to type into an ordinary message box, and it cannot see inside a file. You may not configure Get Carter, name a form field, or import a file so as to collect information of those kinds. If sensitive information arrives regardless, you must delete it as soon as you notice; if we notice first, we will delete it and tell you. We never use it for anything.
IP addresses are used in the moment to work out country and to stop abuse, and are kept in the sign-in and activity records described below. If you switch on "Don't count visits from our own team", the addresses your team signed in from over the last 45 days are also used to drop your own visits from your reports. We do not join a visitor's activity on one client's website to their activity on another's: each client's data is in its own database and is only ever read for that client. That is our policy and how the system is built, not an accident of what we can see.
What else we hold for you
Get Carter is more than the tracker, and the rest handles personal information too.
- Your contact book — people you add by hand or import from a file, with whatever business details you choose to keep on them, the permission you have recorded for emailing them, notes, tags and stage. Held for as long as you keep them, to run your relationships and your sending.
- Orders and connected services — if you connect a ticketing, ordering or chat service, or your online shop, we receive what it sends about each completed order or conversation: typically a name, contact details, what was ordered and the amount. We never receive card, bank or other payment details — a shop's checkout does not hand those to page code, and our server keeps only the fields named here. A buyer is joined to a contact as a customer with the order on their timeline; buying is not permission to email them — only a marketing tick box at the checkout is recorded as consent, and only when it was ticked. So that an order can be joined to the visit it came from, the tracker places the visitor identifier on the shop's cart. Raw records from those services are kept for the same period as visits, below.
- Email you send — the message, who it went to, and what happened to it: delivered, bounced, opened, clicked, complained, unsubscribed. Opens are measured by a tiny image in the email and clicks by the links being routed through Resend; both are standard, and neither works if a mail app blocks them. With an open or a click we also keep which mail app was used and, for a bounce, the reason. Kept with the contact, so you can see what they have received.
- The assistant — when you have added it, what you ask and what it answers, and the contact data it needs to answer, which is sent to Anthropic for that request and no other purpose. Under its terms with us Anthropic does not train on it and deletes it within 30 days. Conversations are kept for the same period as visits, below.
- Sign-in and activity records — who signed in, when, from which address and device, and what was changed in the dashboard: so you can see who did what, and so we can investigate a problem. Our hosting also keeps ordinary server logs for a short period for the same reasons.
- Search terms — if you connect Google Search Console, we fetch from Google, for each of your sites, the searches that showed it, the page shown, clicks, impressions and position, by day. These are Google's totals, with no visitor in them, and are kept for 16 months, as Google keeps them.
- How your team uses Get Carter — the dashboard reports its own page views (which screen, when, device and country, under a random browser identifier) to our own account, so we can see which parts of the product get used. It records screens within Get Carter, never anything on your website or about your contacts. If something breaks on our site, the browser sends us the error, the page it happened on and the browser's name, so we can fix it.
- Support — what you email us, kept in our mailbox for as long as we need it to help you.
Who else touches it
We use a small number of companies to run the service. They process data only on our instruction.
| Who | What for | Where |
|---|---|---|
| Sevalla (Kinsta) | Hosting and databases, encrypted at rest, on a cloud data centre in Sydney (Google's today; moving to Oracle's, also in Sydney). Sevalla itself puts Cloudflare in front of every application it hosts | Sydney, Australia |
| Cloudflare | DNS and protection in front of the site, for us and for Sevalla. Requests pass through the Cloudflare location nearest the visitor, which for Australian traffic is normally in Australia; the current list is at cloudflare.com/network | Nearest of its locations |
| Resend | Sending every email that leaves Get Carter: the email you ask us to send, and our own login codes. Mail is sent from Resend's Tokyo region; Resend stores its records in the United States for 30 days | United States (sent via Japan) |
| Search Console, only if you connect it: we read your site's search data from Google. Nothing about your visitors or contacts goes to Google | United States | |
| Anthropic | The assistant, when you have added it, and the email-writing help | United States |
| Stripe | Payments and invoices. We never see card numbers | Australia / United States |
| Dropbox | Nightly backups. Encrypted before they are stored, with a key only we hold | United States |
Each of these handles data under its own contract with us, which limits it to providing the service; none is free to use your data for its own purposes. Your data is hosted in Sydney; the overseas providers above see only what their job needs — an email and its recipient, a request to the assistant, a payment.
Adding an add-on that uses one of these is your choice. Turning it off stops anything new going to that provider. It does not recall what has already gone: Resend keeps its record of email already sent and may still report on it for a time, and Resend also carries our login codes whether or not you send email. If you connect your own AI to Get Carter, your data goes to whichever provider you connect — that one is entirely your decision, and we say so on the screen where you connect it. A connected AI can read and draft; it cannot send anything.
What we don't do
- We don't sell data. Not to anyone, not ever, and not as "aggregated insights".
- We don't use your data, or your contacts' data, to train AI models.
- We don't email your contacts on our own behalf.
- We don't run ad-tech or share with data brokers.
How long we keep it
While your account is open:
- Visits and page views, raw records from connected services, and assistant conversations: on free Tracking, 12 months, then deleted by a nightly job. That applies to everyone's visits, including people who are now contacts — what stays with a contact is where they first came from and their leads, not every page they ever viewed. On Tracking Plus, the paid tier, nothing ages out automatically: it is kept while you are a member, unless you ask us for a shorter period, which we will set. The period in force is shown in your Settings.
- Contacts, their leads, permission records and email history: for as long as you keep them. Delete a contact and their record, notes, permission trail, email history, leads, orders, the log of what was sent to them and their address in any chat record or assistant conversation go with it. Their earlier visits stay as unlinked visits, joined to nobody — though if the same browser enquires again, those visits will be joined to that new enquiry.
- Unsubscribes: for as long as your account exists, even if you delete the contact, so that nobody who has said no is ever emailed again by mistake.
- Activity records of who did what in the dashboard, including our own staff's actions on your account, and sign-in records: 400 days.
After you leave:
- Your account stays intact for 30 days, so you can change your mind or export, and is then deleted — every database, file and setting, including the activity records above.
- Encrypted backups are taken nightly and we remove each one 60 days after it was made; the storage provider can hold a recoverable copy of a removed file for a time after that — up to a year on some plans — after which it is gone. Backups are not opened except to restore the service or to test that a restore works.
- Our own record that a member of our staff opened your account — when, who, and for how long, with no contact data in it — is kept for 400 days.
- Invoices: seven years, because Australian tax law says so.
Your responsibilities as the one collecting it
You decide what to collect and who to contact, so the law puts those duties on you:
- Have your own privacy policy, and tell people what happens to what they submit — including that a tracking provider records visits to your site and joins them to an enquiry.
- Name any pages on your site whose visit would itself say something sensitive about a person — a health or counselling booking, say — and keep the Get Carter code off those pages. Field-name blocking cannot see that.
- Not use Get Carter to hold information about children. It is a tool for business relationships.
- Have a lawful basis to hold and contact everyone in your contact book, and keep your own evidence of it: when, how and for what each person agreed, or the relationship you infer consent from.
- Not collect the sensitive information described above through Get Carter, and remove it if it arrives.
- Handle requests from your contacts — access, correction, deletion. We'll help you do it in the product, and we'll act on your instruction quickly.
- If you operate outside Australia, or hold data about people who do, meet the rules that apply there.
Asking us for things
Email privacy@cartercarter.com.au and a person will answer within five business days, and resolve the matter within 30 days or tell you why not. That goes for anyone:
- Clients can see and change their own details in Settings, and export their contacts at any time from the dashboard.
- Visitors and contacts of a client can ask that client directly — it is their data, and the tools to find, correct, export and delete a person are in the product. You can also ask us; we will pass the request to the client, or, where the client cannot or does not act within a reasonable time, act on it ourselves. We will ask for enough to be sure we are dealing with the right person and nothing more.
If we ever have a data breach that is likely to cause serious harm, we will tell the OAIC and everyone affected as the Notifiable Data Breaches scheme requires — as soon as we know, and with what we actually know rather than a carefully worded nothing. Everyone affected means anyone whose information was exposed: our clients, the people on their accounts, and their visitors and contacts. Where the affected people are a client's contacts, we work with that client: we give them who was affected and what was exposed, and we make sure the notification the scheme requires happens, whichever of us sends it.
Get Carter makes no automated decisions about anyone. It records, counts and shows; people decide.
If you're unhappy with how we've handled something, tell us first and we will investigate and respond in writing within 30 days. If that goes nowhere, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Security
Each client's data sits in its own database, and only people named on the account can sign in — or, if the account's owner switches it on, anyone with an email address at the owner's own company domain. Signing in is by a code emailed to you, with no password to leak. Two-step sign-in — a code from an authenticator app on your phone — is available to everyone and we recommend it for anyone who can send email or export contacts. A session lasts 30 days and can be ended at any time by signing out. Our own access to your account is limited to named staff, needs that authenticator step, and is written into your activity log where you can see it.
We back up every night. The backup is encrypted before it is stored, we are alerted if a night is missed, and we test restoring from a backup. That said — see the terms — keep your own copies of anything you can't afford to lose.
No system is proof against everything. One application serves every client, so separate databases limit what a mistake can expose rather than making exposure impossible. We say so because you should know.