Last updated 2026-05-28
Privacy policy
Devinium is a Melbourne software consultancy, operating since 2007. This policy explains what information we collect when you visit devinium.com or get in touch with us, why we collect it, who it gets shared with, and how long we keep it.
Devinium currently sits below the AUD $3 million turnover threshold that makes the Australian Privacy Act 1988 strictly binding on a private business. We have chosen to operate to the Australian Privacy Principles (APPs) anyway, because the people who hire us deserve the same handling regardless of which side of that line we sit on. If our turnover crosses the threshold, nothing in this policy changes; the legal obligation simply catches up to the practice.
We have tried to write this in plain English. Where a section names a specific tool or vendor, that is deliberate. Vague claims about "secure cloud storage" or "industry-leading practices" do not survive contact with reality. The named vendor list does.
What we collect
We collect information in three places: when you submit a form, when you book a call, and when you load a page on the site.
From our contact form
When you submit the contact form on /contact/, we collect your name, email address, company name (if you provide it), and the message you write. We also receive standard attribution metadata that the form ships with the submission: the page you submitted from, any UTM tags on the URL, and your recent click path through the site. The latter exists so we can tell whether a submission came from an ad campaign, a blog post, or a direct visit.
From the waitlist form
When you join a product waitlist, we collect your name, email address, and the tier you signed up for (a URL parameter that records which tier you were looking at). The same attribution metadata above applies.
When you book a discovery call
We use Calendly to schedule discovery calls. Calendly receives your name, email address, the slot you chose, and any free-text answers you provide on its booking form. The booking also appears on the Devinium team calendar after you confirm.
When you visit a page
We run cookieless analytics on the site. PostHog records pageviews and click events, and stores them against a per-visit identifier that resets when you close the tab; there is no cross-session tracking cookie. Cloudflare Web Analytics is not currently enabled. If it is enabled in future, this section will be updated before that change ships. The same applies to Google Analytics 4: not currently running, and this section will be updated before any future deployment ships.
Session replay
PostHog records anonymised session replays. Two protections apply by default. Every input, textarea, and select field is masked in the recording, so anything you type into a form is never captured. The recording stops the moment you focus on the first form field on a page, so even masked form interactions are not part of the replay. The replay shows the shape of a visit (which sections you scrolled to, which links you hovered) and nothing more.
Server logs
The site is served by Cloudflare Pages. Cloudflare retains short-lived edge logs that include IP addresses and request paths as part of its security and abuse-prevention service. Devinium does not maintain a separate access log of its own.
Why we collect it
Three reasons.
To reply to you. If you submit a form or book a call, we need your name and email to write back. If you ask about a specific kind of project, the message body is what tells us whether we are the right consultancy for the job.
To understand where inquiries come from. Attribution metadata (UTM tags, referrer, click path) tells us whether an inquiry came from a paid ad, an organic search, a LinkedIn post, or a referral. We use that to decide where to spend time and money on outreach. It is not used to build a profile of you.
To improve the site. Pageview and click data tells us which pages people actually read and which sections they skip. Session replays (anonymised, form-masked) tell us where the site is confusing or broken. We act on the aggregate, not on individual visits.
How long we keep it
By record type below. Where a vendor publishes a retention default we give the exact number; where it does not, we tell you what we actually do.
Form submissions. Devinium retains a copy of your submission in the Google Workspace inbox for the lifetime of the working relationship and a reasonable period after, so we can answer follow-up questions or pick up where we left off. Formspree, the transit vendor, holds the original for 30 days on its free-tier service before auto-deleting; that is the lowest-exposure path. If you ask us to delete our copy, we delete it.
Calendar bookings. Calendly retains records of completed bookings indefinitely, until manually deleted. The corresponding event on the Devinium team calendar persists for the duration of the engagement and is archived after.
PostHog analytics. On the PostHog free-tier plan we run, session replays are retained for up to 30 days (the plan's configurable maximum) and event data for up to 1 year (the free-plan default). Because the analytics are cookieless and form fields are masked, there is no link from any of those records back to your identity unless you also submitted a form.
Server logs. Cloudflare retains edge logs for a short window as part of its abuse-prevention service. Devinium does not separately archive those logs.
Your rights
Under the Australian Privacy Principles, you have the following rights over information we hold about you. We honour these regardless of whether the Privacy Act strictly binds Devinium at any given moment.
- Access. You can ask what information we hold about you. We will reply within a reasonable time with a copy.
- Correction. If anything we hold is wrong, you can ask us to correct it. We will.
- Deletion. You can ask us to delete records we hold about you. We will delete the records on our side, and where a subprocessor stores a separate copy (Formspree, Calendly, PostHog, and Google Workspace), we will ask that vendor to delete their copy too.
- Opt out. You can ask us not to send you any further email, ever. See the next section for what that means in practice.
Send any of these requests to hello@devinium.com. We do not charge a fee. We do not require a particular form. A short note is enough.
Marketing emails
We do not run a newsletter. We do not run a nurture sequence. If you submit a form, we reply to that form. That is the end of the standard interaction.
Occasionally we email past inquiries by hand, one at a time, when something we are working on is genuinely relevant to a conversation we had before. Those are not bulk sends. Every such email contains a one-line opt-out at the bottom. If you reply with "please stop", we record that against your contact in our records and you do not hear from us again.
If we ever do start a regular mailing list, you will not be on it unless you explicitly opted in. We do not transfer inquiry contacts onto a mailing list silently.
Children's data
Devinium does not knowingly collect information from anyone under the age of 16. Our site is aimed at business buyers. If you believe a child has submitted a form here, write to hello@devinium.com and we will delete the record.
Changes to this policy
We update this page when something changes about how the site works (a new subprocessor, a new analytics tool, a change to retention). The "Last updated" date at the top of the page changes every time the substance changes. We do not version-bump the date for typo fixes.
We do not email past contacts when we update this page. If a change materially affects information you already gave us, we will send you a single notice email at the address on file.
Contact us about privacy
Privacy questions, access requests, correction requests, and deletion requests all go to the same place:
Devinium Pty Ltd. ABN 94 668 433 707. 31 Queen Street, Melbourne, VIC 3000.