Privacy policy
What I collect, and why.
I collect as little as I can, I don't sell anything to anyone, and this page says plainly where your details go. Last updated 23 September 2026.
Who I am
Canino Digital is the trading name of John Canino, a sole trader in Brisbane, Australia, ABN 11 790 420 328. As a small business I may be exempt from the Privacy Act 1988, but I follow the Australian Privacy Principles anyway, and this page is written to meet them.
4AM for Apple Mail
The 4AM Mac app has its own policy, covering what the app does on your Mac and what happens when you buy a license: 4AM privacy policy.
What the forms collect
The enquiry and mockup forms ask for your name, email address, and whatever you write about your project. The mockup form also asks for your business name and current website if you have one. Nothing is required beyond that.
Where form submissions go
Forms are processed by Formspree, which passes them to my inbox and keeps a copy in its dashboard. My email is hosted by Apple iCloud Mail. I keep enquiries in email so I can answer them and refer back during a project.
Payments
Payments are handled entirely by Stripe. Stripe collects your card details, billing address and name, and I never see or store your card number. Stripe holds this as its own controller. Its policy is at stripe.com/au/privacy.
Hosting and analytics
This site is served by Cloudflare, which records standard request information such as IP address, browser and page requested, to deliver pages and block abuse. I also use Cloudflare Web Analytics to count visits: which pages are viewed, how people arrived, their browser and country. It uses no cookies, doesn't fingerprint your device, and doesn't follow you to other sites.
Cookies
This site sets no cookies of its own. Cloudflare may set a short-lived security cookie to tell people apart from bots, which isn't used for tracking. Stripe sets its own cookies on its checkout page, under its own policy.
Stored overseas
Some of the services I use store data outside Australia: Formspree in the United States, Stripe and Apple iCloud Mail in the United States and elsewhere, and Cloudflare across its global network. Site code is kept on GitHub in the United States. Each is a large provider with its own security and privacy commitments.
Messages on social media
If you contact me through Instagram or Facebook, those messages are held by Meta under its own privacy policy, as well as by me. If you'd rather they weren't, email me instead.
Client projects
While building your site I hold what you send me: brand files, copy, photos, and any credentials needed for integrations. Credentials arrive through a one-time secure link, not email, and are stored as environment variables rather than in code. On handover I hand them back and remove my copies.
If you're a client with a form
Enquiry forms on client sites deliver to whichever address you nominate. By default a copy of each enquiry is also kept in my dashboard, which is what lets me help when something goes missing. I don't read them except when you ask me to look into a problem. If you'd rather no copy was kept, say so and I'll turn it off, bearing in mind that a lost enquiry then can't be recovered or traced. Your own visitors' details remain your responsibility, and your own privacy obligations apply to them.
What I never do
I don't sell, rent or trade your details. I don't add you to a mailing list because I don't run one. I don't share anything with third parties except the services named on this page, each of which is needed to run the business.
How long I keep it
Enquiries that go nowhere are deleted within about twelve months. Project records, invoices and tax records are kept for at least five years because the ATO requires it. You can ask me to delete anything else at any time.
Access and correction
Email me and I'll tell you what I hold, correct it, or delete it. No form to fill in. I'll come back within two business days. If something I hold is wrong, say so and I'll fix it rather than argue about it.
Security
The site is served over HTTPS only. Secrets are never committed to code repositories. If a credential is ever exposed it gets rotated, not just deleted.
Complaints
If you're unhappy with how I've handled your information, email me first. I'll reply within two business days and aim to resolve it within 30 days. If you're still not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Under 18s and changes
My services are for businesses and adults, and I don't knowingly collect details from anyone under 18. If this policy changes, the date at the top changes with it, and current clients will hear about anything significant by email.
Questions about any of this? Email this address. How projects themselves run is covered in the project terms.