Clear information, collected for a clear reason.

Who this notice is about

This notice explains how Tommy the Blue Staffy — Tommy & Family handles personal information received through this website. It covers visitors, prospective and past brand partners, agencies, people submitting partnership feedback and people making privacy or rights enquiries.

What we collect

If you use the enquiry form, we collect the information you choose to submit. This can include your name, contact email, brand name, whether you are contacting us directly or through an agency, project type, brief, timing, indicative budget and paid-usage needs.

If you use the partner feedback form, we collect your name, role, company or agency, the brand and campaign involved, approximate collaboration date, review, optional private feedback about expectations and improvements, preferred public attribution and publication permission. Only your review is considered for publication; your expectations and improvement answers stay private with Holly and Dean.

The site and its security providers may also process limited technical information needed to deliver and protect the service, such as an IP address, browser details, request time, referring page and security signals. We do not ask for sensitive personal information through the enquiry form.

If Tommy Mail is opened and you choose to join, we collect your email address, signup source, consent record and confirmation or unsubscribe status. Subscription remains optional and requires confirmation through the email we send.

Why we use it

We use enquiry information to assess and respond to opportunities, prepare proposals and manage commercial relationships. We use submitted feedback to verify, review and, where permission is recorded, publish an attributed testimonial. We also process information to protect the site from abuse, comply with legal obligations and maintain necessary business records. We do not sell personal information or add submitted details to unrelated marketing lists.

Form delivery, security and hosting

The form uses Cloudflare Turnstile to distinguish genuine visitors from automated abuse and Resend to deliver submissions to the private recipient inboxes. The website also relies on hosting, domain and security providers to make the service available. These providers may process limited information for us under their own security and privacy controls.

Information may be processed or stored outside Australia, including in locations where our service providers operate. We select providers for a specific operational purpose and limit the information shared to what that purpose requires.

Website analytics

We use a privacy-restricted PostHog project to understand aggregate site usage and important actions such as viewing the portfolio, following a social profile, or starting or completing an enquiry. The website sends only named, content-free events through its own server. Browser autocapture, session replay, person profiles, persistent analytics identifiers and location enrichment are disabled. Analytics is used to improve the website and understand which content helps prospective partners; it is not used to build individual advertising profiles.

On our favourites page, we count page visits, actual link-card impressions, outbound link selections and discount-code copies. These measurements help us understand what followers find useful. A click or copied code is not treated as proof of a purchase. Sales and revenue are reported only when a merchant or affiliate programme supplies matching evidence.

Public social statistics are refreshed from the official Instagram, Facebook, TikTok and YouTube interfaces and stored as dated, platform-level snapshots. Social access credentials are kept in the protected server environment and are never sent to website visitors.

Retention and security

Enquiry records are normally kept for no longer than 24 months after the last meaningful contact, unless a working relationship, dispute, legal obligation or legitimate business-record need requires longer. Security and aggregate analytics records follow the relevant provider’s retention settings. We use access controls, spam protection and reputable service providers, but no internet transmission or storage system can be guaranteed completely secure.

Family and children’s privacy

The website contains approved editorial images and stories about Tommy and his family. It is a commercial portfolio for adult brand and agency audiences, not a service directed to children, and we do not knowingly invite children to submit personal information. Public content avoids exact family locations, routines and unnecessary identifying details. Requests concerning image rights or family content are handled as privacy or rights enquiries.

Access, correction and complaints

You can ask what personal information we hold about you, request a correction or deletion, withdraw consent where relevant, or raise a privacy complaint through our contact form. Choose “Other” as the project type, begin your message with “Privacy request” and include enough detail for us to verify and respond to the request. We will respond within a reasonable period and explain if a request cannot be completed.

Changes to this notice

We will update this page when our practices, providers or legal obligations materially change. The effective date above shows the current version.