Attua / Privacy policy
Your privacy,
in plain words.
This page explains what we collect when you visit attua.ai, fill in an enquiry form, use the pricing calculator or book a call, why we collect it, who else gets to see it, and how to ask us to change or delete it. We have tried to write it the way we would explain it to you over a coffee, rather than the way a lawyer would.
Attua is a small practice. In day to day terms, that means Sam Thompson reads your enquiry. There is no sales floor, no lead list being resold, and nobody else poking through your details.
The short version
- We collect what you type into our forms, plus a little technical information your browser sends automatically.
- We use it to reply to you, work out whether we are a sensible fit, book a call and measure which ads actually bring people in.
- We use the Meta pixel and the Meta Conversions API for ad measurement. Your email and phone number are hashed before they leave our server.
- We never sell your information, and we do not share it for anyone else to market to you.
- You can ask to see, correct or delete your information at any time by emailing sam@attua.ai.
Who we are and which rules we follow
Attua is an AI consulting practice run by Sam Thompson, based in Fortitude Valley, Brisbane. Our contact details are at the bottom of this page.
We handle personal information in line with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles, including the rules on open and transparent handling, collecting only what we need, using it only for the purpose we collected it for, keeping it accurate and secure, and giving you access to it. We apply those principles to everything described below.
What the enquiry and booking forms collect
There are only a handful of fields, and everything on the form is there because it changes how we reply.
- Your name. So we can write back to a person rather than an email address.
- Your email address. This is how we reply, and how a booking confirmation reaches you.
- Your phone number. Optional on some forms. Handy when a two minute call saves four emails, and useful if a booked call needs to move at short notice.
- Company size. A rough headcount or band. A five person studio and a two hundred person firm need very different advice, so this shapes what we suggest.
- Your role. Whether you are the owner, a department head or the person who has been asked to go and look into AI. It tells us what sort of detail is useful to you and who else may need to be in the room.
- Your questionnaire answers. The selections and short notes you make about what you want to change, what you have already tried, your timing and anything you add in a free text box.
Please leave sensitive personal information and confidential business material out of the form. If something is commercially delicate, say so in general terms and we will pick it up properly on the call.
The pricing calculator and questionnaire
The calculator is a thinking tool. It asks about the service you are interested in, the scope of the work, how often a task happens and roughly what an hour of that work is worth to you, then shows you an indicative figure. Those answers, your email address and the indicative result are stored with your enquiry so that the conversation can start from something concrete instead of a blank page.
A first party session cookie lets you come back to the calculator in the same browser without starting again. It holds a random session credential, not your email address and not your answers. Choosing to change your email ends that browser session. It does not delete an enquiry you have already sent, so email us if you would like that removed.
What your browser sends automatically
Like every website, ours sees some technical information whenever a page loads or a form is submitted.
- Your IP address. The network address your request comes from. We use it to keep out automated spam, to rate limit abusive traffic, and as part of ad measurement as described below. It gives a rough idea of city or region, not a street address.
- Your user agent. The text your browser sends describing itself, such as the browser name, version and operating system. It helps us serve a page that works on your device, spot bot traffic and, again, forms part of ad measurement.
Where ad click parameters come from
If you arrive from an ad, an email or a link we have shared, the web address may carry tracking parameters. The common ones are utm_source, utm_medium, utm_campaign, utm_content and utm_term, which say which campaign and which piece of creative sent you, and fbclid, the click identifier Meta adds when you come from a Facebook or Instagram ad.
We keep those values alongside your enquiry for one reason: so we can tell which advertising is worth continuing and which is quietly wasting money. They are not used to build a profile of you, and they are not combined with anything you have not given us.
Why each piece is collected
| What we collect | Why we collect it |
|---|---|
| Name | To reply to your enquiry properly |
| Email address | To reply to your enquiry, confirm a booking and, in hashed form, measure ad results |
| Phone number | To call you back if that is faster, and in hashed form for ad measurement |
| Company size | To judge whether we are a sensible fit and pitch advice at the right scale |
| Role | To understand who we are talking to and what level of detail helps |
| Questionnaire answers | To understand the problem before the call and prepare something useful |
| Calculator selections | To produce the indicative figure you asked for and to brief the call |
| UTM parameters and fbclid | To measure which ads and links bring in genuine enquiries |
| IP address | Spam and abuse protection, and ad measurement |
| User agent | Making the site work on your device, spam protection, and ad measurement |
Sending a form does not subscribe you to a marketing list, and it does not create a calendar booking on its own.
Booking a call
When you book a time, the details you entered, the slot you chose and the technical information above are used to create the booking and send the confirmation. If you book through a Google appointment calendar, Google processes those details to run the booking service. Use the same email address you gave us in the form and we can match your booking to your enquiry without you repeating yourself.
The Meta pixel and the Conversions API
We advertise on Facebook and Instagram, so we need to know whether those ads work. Two things do that job.
The Meta pixel is a small piece of Meta code in the page, pixel ID 1555553243090655. It records page views and actions such as submitting an enquiry form, and reports them to Meta.
The Meta Conversions API does the same job from our server rather than your browser, which is more reliable when a browser blocks scripts. When you submit an enquiry, our server can send Meta:
- your email address and phone number as SHA-256 hashes, never as readable text,
- your IP address and user agent, which Meta uses to match the event,
- an event name, an event time and an event ID.
The event ID is there so that a browser event and a server event describing the same action count once instead of twice. SHA-256 hashing is a one way process: the hash cannot be turned back into your email address. It does let Meta check whether the same hash matches an account it already holds, which is how ad results are attributed. Meta handles that information as a data controller under its own privacy policy.
If you would rather not take part, blocking the cookies described next, or using a browser with tracking protection turned on, prevents the browser side of this. You can also use Meta’s own controls, linked below.
Cookies, and how to switch them off
We do not use cookie walls or advertising cookies from a long list of third parties. The ones that matter here are:
_fbp. Set by the Meta pixel as a first party cookie on attua.ai. It holds a randomly generated identifier for your browser so that a later enquiry can be linked back to an earlier visit. It usually lasts about three months._fbc. Set only if you arrive with anfbclidin the web address. It stores that click identifier so the enquiry can be matched to the ad click that led to it. It also lasts about three months.- A session cookie for the calculator, described above, which is necessary for that tool to work.
To clear or block them you can delete cookies and site data for attua.ai in your browser settings, set your browser to block cookies for this site, browse in a private or incognito window, or turn on the tracking protection built into browsers such as Safari, Firefox and Brave. A tracker blocking extension will also stop the pixel loading. The site, the forms and the calculator all keep working if you do. The only thing that breaks is our ability to tell which ad worked.
You can review and change what Meta uses for advertising in your Meta ad preferences, and manage the activity Meta has received from businesses in your Accounts Centre.
Where your information is stored
Two places hold your enquiry, plus Sam’s mailbox.
- Our enquiry backend, which runs on Render, a managed hosting provider. It receives the form submission, applies the spam limits and passes the enquiry on. Access is restricted to Sam.
- A Google Sheet inside our Google Workspace account, which is the working record of enquiries. It is not shared with a public link, and access is restricted to Sam.
- Email. A copy of your enquiry arrives as an email, and that copy stays in the mailbox until it is deleted.
The website itself is hosted on Vercel, which serves the pages and keeps standard server logs.
Who we share it with
We share information with the service providers that make the site and the enquiry process work, and only so they can do that job for us.
| Provider | What they do for us | What they receive |
|---|---|---|
| Vercel | Hosts and serves the website | Request data including IP address and user agent |
| Render | Hosts our enquiry backend | Form submissions and request data |
| Google Workspace, the enquiry sheet, email and appointment bookings | Enquiry records and booking details | |
| Meta | Advertising and ad measurement | Hashed email and phone, IP address, user agent, event names, times and IDs |
We may also disclose information if the law requires it, or if we ever need professional advice about a dispute. Beyond that:
- We do not sell your personal information, and we never have.
- We do not trade or hand it to data brokers or list builders.
- We do not share it so that another business can market to you.
Information held outside Australia
Some of those providers store and process information on servers outside Australia, including in Singapore, the United States and the European Union. Australian Privacy Principle 8 covers this. Before we disclose personal information to an overseas recipient we take reasonable steps to satisfy ourselves that it will be handled consistently with the Australian Privacy Principles, which in practice means using established providers with published privacy commitments and contractual data protection terms. If you would prefer your details were not handled this way, tell us and we will talk about what is possible, although in most cases we cannot run the enquiry process without it.
How long we keep it
We keep enquiries for as long as there is a sensible reason to, and not longer.
- Enquiries that do not lead to work are reviewed and cleared out periodically, generally within two years.
- Enquiries that turn into client work are kept with the client records for as long as we need them for the engagement and for the record keeping the law requires of a business.
- Technical records on our backend, such as delivery status and spam counters, are short lived and are cleared within about thirty days.
- Events sent to Meta are retained by Meta under its own retention rules, which we do not control.
When information is no longer needed we delete it or de-identify it.
How we keep it safe
Traffic to and from the site runs over HTTPS. Access to the enquiry backend, the Google Sheet and the mailbox is limited to Sam and protected with strong passwords and two factor authentication. Keys and credentials for the services above are held as server side secrets, never in the pages you download. Nothing on the internet is perfectly secure, so we also try to hold as little as possible in the first place, which is why the forms are short.
Asking to see, correct or delete your information
You can ask us at any time to:
- tell you what personal information we hold about you,
- send you a copy of it,
- correct anything that is wrong or out of date, or
- delete it.
Email sam@attua.ai with what you would like done. There is no charge. We may need to ask a question or two to confirm it is really you, and we aim to respond within thirty days. If we cannot do what you have asked, for example because we are required to keep a business record, we will tell you why in writing.
Deleting information from our records does not delete it from Meta or Google. Use the Meta links above for advertising activity, and your Google account settings for anything held there.
If you are unhappy with how we handled it
Start with us. Email sam@attua.ai with the heading Privacy complaint and tell us what went wrong. We will acknowledge it quickly, look into it and write back within thirty days with what we found and what we are doing about it.
If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner. The OAIC is the national privacy regulator. You can lodge a complaint at oaic.gov.au or call 1300 363 992.
Changes to this policy
If we change how we handle information, we will update this page and change the date below. If the change is a significant one, we will say so plainly at the top rather than hoping you do not notice.
How to reach us
Attua
Level 4, 126 Barry Parade
Fortitude Valley, Brisbane QLD 4006
Email sam@attua.ai
Phone 0423 766 790
Last updated 3 November 2026