Privacy Policy
Effective 6 October 2026. What changed from the 5 October 2026 version: backup copies of your sites are listed as service data (section 1), how long they're kept (section 6), and deleting your account deletes them (section 7).
Who we are. Hamish Palmer, sole trader, trading as phas (phas.au / phas.nz). Privacy contact: [email protected].
This policy is written to the Australian Privacy Principles (Privacy Act 1988 (Cth)) and the NZ Privacy Act 2020, and it applies to everything we do with personal information.
1. What we collect
- Account data: name, email address, phone number, password (stored hashed), and two-factor secrets.
- Domain registrant data: for each domain contact role — name, organisation, postal address, email, phone; for .au domains, eligibility identifiers (ABN/ACN/trademark details) as auDA requires.
- Billing data: your card is collected and stored by Stripe, our payment processor — we never see or store full card numbers. We keep transaction records (what was bought, amounts, Stripe references).
- Support data: tickets, emails you send us, and a support verification code shown in your account.
- Service data: hosting account metadata, DNS records you configure, email-sending domains and delivery events for the transactional email add-on, backup and monitoring records for those add-ons, and backup copies of your hosted sites (section 6).
- Technical data: IP addresses, browser user-agent, session and login records (shown to you on your sessions page), and server logs.
We collect it directly from you, from your use of the services, and from our suppliers processing on our behalf. We don't buy data about you.
2. Why we collect it
To deliver and bill the services you've ordered; to verify eligibility where a registry requires it; to secure accounts (login history, 2FA, fraud signals from Stripe Radar); to provide support; to meet legal and registry obligations; and to send service email. Marketing: we don't send marketing email. If that ever changes, marketing messages will be sent only with your consent and with a working unsubscribe in every message, as the Spam Act 2003 (Cth) and the Unsolicited Electronic Messages Act 2007 (NZ) require.
3. Who we disclose it to
We disclose personal information only as needed to run the services:
| Recipient | What | Where |
|---|---|---|
| Vultr (servers) | your hosted sites, files and databases; our own application and database | Australia (Melbourne and Sydney) |
| Stripe (payments, fraud screening) | billing identity, card (held by Stripe), transactions | United States |
| Synergy Wholesale (registrar of record) | registrant contact + eligibility data | Australia |
| Domain registries and their operators (auDA/Identity Digital for .au, InternetNZ for .nz, gTLD registries), and ICANN-approved escrow agents for gTLDs | registrant data as their policies require | varies by registry; escrow typically United States |
| Cloudflare (DNS, network security, email forwarding) | DNS records you configure; web traffic to phas, and to sites on phas DNS where its proxy is on; email passing through forwarding, including mail to our own addresses; bot checks on our sign-up and contact forms | United States (global network) |
| Cloudflare R2 (backup storage) | encrypted backups of hosted sites and of our own database; Cloudflare holds only encrypted data and can't read it | Oceania (hosted-site backups); Asia-Pacific (our database backups) |
| Postmark / ActiveCampaign (email delivery, in and out) | email content and delivery metadata for mail we send you, support mail, and the transactional email add-on | United States |
| Sentry (error monitoring) | technical error context, which can incidentally include account identifiers | European Union (Germany) |
We also disclose where the law requires it — subpoenas, court orders, or regulator demands — and we tell you when we lawfully can.
WHOIS / public registers. Domain registration data is published according to the registry's rules (WHOIS/RDAP for gTLDs and .au; the .nz Query Service for .nz). .nz individuals not in significant trade can ask us to apply the Individual Registrant Privacy Option, which withholds phone and address from the public register.
4. Cross-border handling
Some recipients above are outside Australia and New Zealand (chiefly the United States). Before disclosing overseas we take the steps the Privacy Act 1988 (APP 8) and the NZ Privacy Act 2020 (IPP 12) require — contractual safeguards with the supplier or your informed consent — and we remain accountable for their handling where the Act makes us so.
5. Security
Passwords are hashed; panel access uses single-sign-on links rather than stored passwords; support and admin access is role-limited; sessions are listed in your account and individually revocable; two-factor authentication is available (and recommended); backups of our own database are encrypted with a key held offline. Backups of hosted sites are encrypted on our servers before they're stored, and the storage provider can't read them. No internet service can promise perfect security, but we build so that a single failure doesn't cascade.
6. Retention
We keep personal information while your account is active and as long afterwards as the law and registry rules require — tax records (5 years, AU), .nz registration data (6 years after a domain is cancelled or transferred, per InternetNZ rules), and accounting/audit trails. When you delete your account, we anonymise personal data and keep only the event and accounting history the law requires; the deletion record itself is retained as evidence of the deletion.
Backups of hosted sites. They contain whatever is on your site, so we keep them only this long:
- Premium Backups: daily copies, each kept 30 days. When the add-on ends, existing copies are deleted as they reach that age.
- Our disaster-recovery copies: a weekly copy of every hosting account, kept up to 6 weeks, so we can recover from a server failure or a mistake on our side. They aren't a backup service for you.
- Suspended plans: we don't delete a suspended plan's files, databases or Premium Backups copies, unless the law requires otherwise.
- Terminated plans: we take a final backup, keep it 90 days, then delete it.
- Erasure: if you delete your account or ask us to erase your data, we delete these backups too, including the final backup and our disaster-recovery copies.
7. Access, correction, export, deletion
Your account pages let you see and correct most data directly, export a machine-readable copy of everything we hold about you, and delete your account (once no live paid services remain). Anything you can't reach self-service, ask via [email protected] and we'll respond within 30 days. Deleting your account also deletes the backups we hold of your sites.
8. Data breaches
If a breach involving your personal information is likely to cause you serious harm, we will notify you and the relevant regulator — the OAIC under the Notifiable Data Breaches scheme (AU) and/or the Office of the Privacy Commissioner (NZ, where we aim to notify within 72 hours of becoming aware) — with what happened, what data was involved, and what we're doing about it.
9. Cookies
phas uses cookies for sign-in sessions and security (CSRF) only. We set no analytics or advertising cookies.
10. Complaints
Complain to us first at [email protected] — we'll acknowledge promptly and answer within 30 days. If you're not satisfied: in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).
11. Changes
Material changes are emailed to your account address 30 days before they take effect, matching the Terms of Service change process.