Privacy policy

Openfront · last updated 20 October 2026 · Website plan terms

The short version. We only collect what we need to build and run small-business websites. We never sell your information. Ask us any time to see, fix or delete what we hold about you.

1. Who we are

Openfront is run by Tony Qin, ABN 92 286 252 316, based in Melbourne, Victoria ("we", "us"). Contact: opnfrnt@gmail.com · +61 412 380 203.

2. Businesses we contact

We look for small businesses that don't have a website and offer to build them one. To do that we collect business details that are already public, from places like business directories, Google Maps and the business's own Facebook or Instagram page:

the business name, category, suburb and, for shops and offices, the street address
the business's published phone number and email address, and the owner's first name if it's shown publicly
public information about what the business does (services, opening hours, menu items)

We use these details to build a preview website for the business and to contact them once, with one follow-up, about it. Every email says where we found your details, links to this policy and tells you how to say no, and we won't contact you again after you do. If we call, we only send a text message if you agree to it on the call.

We only collect what we need for this. We don't collect star ratings or reviews, and for businesses run from home we don't keep the street address (only the suburb).

Preview websites carry a notice that they are not the business's official website, are hidden from search engines, and are taken down after 30 days if you're not interested (straight away if you say no).
If you ask us not to contact you, we keep only your business name, email and phone on a do-not-contact list, so we never contact you by mistake.
Other details of businesses that don't become clients are deleted after 12 months.

3. Clients

If you take up our website plan, we also collect what we need to run it: your name, business details and ABN, the details needed to register your domain, and the text, photos and changes you send us. We keep these while you're a client. After you leave, we keep payment and invoice records for as long as tax law requires (usually 5 years) and delete the rest within 12 months.

4. Payments

Payments are handled by Stripe. We never see or store your full card number; Stripe shows us only things like your name, email, the card type and its last 4 digits. Stripe's own privacy policy applies to the payment itself.

5. Visitors to the websites we build

Our websites have no forms, no advertising trackers and no analytics, and they set no cookies.
When a page opens it loads nothing from other companies: fonts and images are stored on the site itself.
The map is only loaded from Google Maps if you click "Show map" (the button says so). Google then receives your internet (IP) address and may set its own cookies, under Google's privacy policy. "Open in Google Maps" and "Get directions" links take you to Google's own site.
The sites are hosted by Cloudflare, which processes visitors' IP addresses to deliver the pages securely.
If a client asks us to add something that collects visitors' information (such as a contact or booking form), it will show a clear notice of what is collected and why, and ask for consent where needed. That information belongs to the client's business and is covered by their privacy policy.

6. Cookies

Cookies are small files a website stores in your browser.

Our websites and this page: no cookies, and no tracking or analytics of any kind. Because nothing optional is loaded until you choose it, there's no cookie banner to click through.
Google Maps: only if you click "Show map" on a website we built. Google may set cookies; see Google's cookie information.
Paying for a plan: Stripe's checkout page uses cookies that are needed to take payments safely and prevent fraud; see Stripe's cookie settings.

7. Who we share information with

We don't sell or rent personal information. We share it only with the services that make our work possible:

Cloudflare (website hosting and domains), Stripe (payments), Google (our email account) and the domain registrar for your domain;
DigitalOcean, which runs our server in Sydney, Australia, where our records are stored;
AI services (through OpenRouter, including models from providers such as Anthropic and Google) that help us research public business information and write website text. We only send them business information, not payment details.

Some of these services store or process information outside Australia, mainly in the United States. We choose well-known providers with strong security. We may also disclose information if the law requires it.

8. Keeping it safe

Our records are kept on a private server that can only be reached with a security key, behind a firewall, with automatic security updates. Account passwords and payment keys are stored securely and never shared.

9. Your choices and rights

Stop contact: reply "no thanks" to any of our emails, or email us, and we'll stop.
See, correct or delete: email us and we'll respond within 30 days. We'll delete what we can, keeping only what the law requires and, if you've asked us not to contact you, your do-not-contact entry.
Complaints: tell us first and we'll try to fix it. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

10. Changes

We'll update this page if how we handle information changes, and change the date at the top. Clients will be emailed about significant changes.

Openfront · Tony Qin · ABN 92 286 252 316 · opnfrnt@gmail.com · +61 412 380 203 · Terms