Privacy Policy

Effective date: May 4, 2026 Last reviewed: May 4, 2026 Previous version: October 16, 2018

CreateWP (“us”, “we”, or “our”) operates the https://createwp.com.au website (the “Service”).

This policy explains what information we collect, how we use it, who we share it with, and what rights you have. We have updated this policy to reflect our current data practices, including the use of marketing attribution tracking, hashed identifiers, and third-party analytics platforms.

1. Information We Collect

1.1 Personal Information You Provide

When you use our contact forms, booking forms, or enquiry forms, you may provide:

• First name and last name
• Email address
• Phone number
• Details about your project or service enquiry
• Booking date and time preferences

1.2 Technical and Usage Data

When you visit our website, we automatically collect:

• IP address
• Browser type and version
• Operating system
• Pages visited, time on page, and navigation path
• Date and time of your visit
• Referring website or link that brought you to our site
• UTM campaign parameters (e.g. utm_source, utm_medium, utm_campaign)
• Click IDs from advertising platforms (gclid, fbclid, msclkid)

1.3 Marketing Attribution Data

We operate a multi-touch marketing attribution system to understand how visitors discover our website. This system captures:

• The source of each visit (e.g. Google, Facebook, LinkedIn, direct)
• The medium of each visit (e.g. organic search, paid advertising, social, referral, AI-referred)
• Campaign and creative identifiers for paid traffic
• A sequential record of marketing touchpoints over time

This data is stored in your browser’s local storage (not cookies) and is associated with an anonymous identifier generated on your first visit. The touch history is read and transmitted to our CRM when you submit a form.

1.4 Hashed Identifiers

When you submit a form on our website, we apply one-way SHA-256 cryptographic hashing to the following personal data fields before storing or transmitting them to analytics and advertising platforms:

• Email address
• Phone number
• First name
• Last name

What hashing means: The original value (e.g. your email address) is transformed into a fixed-length string of characters using a mathematical function that cannot be reversed. No one — including CreateWP — can recover your original email address, phone number, or name from a hash.

We store these hashed values in your browser’s local storage and transmit them to our analytics and advertising partners. The hashes are used to match your website activity to your contact record across platforms (see section 4 for full list of recipients).

After your first form submission, the hashed email is stored as a persistent identifier in your browser. This allows us to associate your future visits with your contact history, improving the accuracy of our analytics.

2. Why We Collect This Information

We use the information we collect for the following purposes:

3. Cookies and Browser Storage

3.1 Cookies

We use cookies for the following purposes:

• Session cookies — required for basic site functionality
• Preference cookies — to remember your settings
• Analytics cookies — to track anonymous usage data (Google Analytics, PostHog)
• Advertising cookies — placed by Google Ads and Meta (Facebook) when you arrive via paid advertising

You can instruct your browser to refuse all cookies or notify you when a cookie is being sent. Note that some features of the website may not function correctly if cookies are disabled.

3.2 Local Storage and Session Storage

In addition to cookies, we use your browser’s local storage and session storage to store:

• An anonymous user identifier (generated on first visit)
• A persistent identifier derived from your hashed email address (stored after first form submission)
• Your marketing touchpoint history (sources and campaigns across visits)
• Hashed versions of your email, phone, first name, and last name (stored after form submission)

Unlike cookies, local storage is not transmitted to our servers on every request. This data is read by our attribution tracking script and transmitted to our CRM and analytics platforms when you submit a form.

To clear this data from your browser: Open browser developer tools → Application → Local Storage → select our domain → delete all items beginning with cwp_.

4. How We Share Your Information

We share data with the following third parties. We do not sell your personal data.

4.1 Analytics and Tracking

4.2 Advertising Platforms

We share hashed identifiers with advertising platforms to measure campaign effectiveness and attribute conversions. We share hashed values only — never raw personal data.

These platforms may use this data to improve their attribution models and, where you have consented to personalised advertising on their platforms, to serve you relevant advertising.

4.3 CRM and Business Operations

4.4 Automation and Integration

We use Make.com (formerly Integromat) to automate data flows between the above platforms. Data transmitted through Make.com is processed only as required to perform these integrations and is not stored permanently on Make.com’s servers beyond what is required for workflow execution.

4.5 Legal Requirements

We may disclose your data where required by law, court order, or to protect the rights and safety of CreateWP, our clients, or the public.

5. Data Transfers

Your data may be transferred to and processed on servers located outside Australia, including in the United States, where Google, Meta, HubSpot, and PostHog are headquartered. These companies operate under frameworks that provide appropriate protections for international data transfers.

CreateWP takes reasonable steps to ensure that any third party receiving your data maintains appropriate security standards and processes data only for stated purposes.

6. Data Retention

7. Security

We implement commercially reasonable technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all data in transit
• SHA-256 one-way hashing of personal identifiers before storage in analytics systems
• Access controls limiting who can access CRM and analytics platforms
• Regular review of third-party service provider security practices

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.

8. Your Rights

Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate, incomplete, or out-of-date personal information
• Request deletion of your personal information (subject to our legal record-keeping obligations)
• Opt out of direct marketing communications

If you wish to exercise any of these rights, or if you have a complaint about how we have handled your personal data, please contact us using the details in section 10 below.

We will respond to your request within 30 days.

9. Children’s Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted personal information to us, please contact us and we will delete it promptly.

10. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact:

CreateWP Website: https://createwp.com.au Email: [email protected] Location: Adelaide, South Australia, Australia

Manage Privicy Here

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy on this page and update the “Effective date” at the top.

For significant changes we will notify you via a prominent notice on our website prior to the change taking effect.

CreateWP — ABN 456 555 058 92 — Adelaide, South Australia