Privacy Policy

Last updated: 2 November 2026

Who we are

GroLo is operated by Robine Stephenson trading as GroLo, ABN 71 293 897 801. We provide small-business websites, basic branding and website hosting and routine maintenance services.

For privacy questions, access requests or complaints, contact us by email at [email protected], by phone on 0439 049 056, or through grolo.au.

Information we collect

Depending on how you interact with us, we may collect:

• Your name, email address, phone number and business contact details.
• Business name, business type, website address and the information you provide about your website needs.
• Enquiries, correspondence, feedback, approvals and records of your communication preferences.
• Content and assets you supply for a project, which may include personal information.
• Quotes, billing details, invoices, payment status and transaction references.
• Technical information generated when you use our website or submit our form, such as IP address, browser or device information, time zone, the page and traffic source, access times and security logs.

Please do not send sensitive personal information, identity documents or payment-card details through our enquiry form. If a project requires sensitive information or customer databases, we will agree on an appropriate process before receiving it.

How we collect information

We collect information directly when you submit a form, email or call us, request a preview, accept a quote or work with us. Information may also come from a person you authorise to act for your business. We may review publicly available business information, such as your existing website, to understand your enquiry.

Our website and its service providers may collect technical information through hosting, security and form functionality. Cookies and similar technologies are explained below.

You may make a general enquiry without identifying yourself where practical. We need enough contact and business information to respond to a preview request or provide a paid service. Without it, we may be unable to proceed.

Why we use information

We use information to:

• Respond to enquiries, assess preview requests and prepare suitable proposals.
• Deliver, administer and support agreed services.
• Process payments, keep business records and manage disputes.
• Maintain website functionality and security and investigate misuse.
• Meet legal obligations.
• Send promotional communications where you have agreed or where otherwise permitted by law.

A preview request is not an agreement to receive general marketing. You can opt out of marketing through the unsubscribe option or by contacting us. We may still send messages needed to administer an enquiry, account or purchased service.

We do not sell personal information.

Service providers and disclosure

We use GoHighLevel for website hosting and business functions such as forms, customer records and workflows. Our form uses Cloudflare Turnstile to help block automated spam. Emails sent from those systems may be delivered through Mailgun, and our mailbox is hosted by Microsoft. Depending on the services you use, information may also be handled by providers supporting communications, payment processing, secure file storage and technical support, and by professional advisers.

We disclose information where reasonably needed for these purposes, with your authorisation, or where required or permitted by law. We seek to give providers access only to information needed for their role.

Payment information is handled through the payment provider identified at checkout. Please use the secure payment process rather than emailing card details. We retain billing and transaction records needed to administer your purchase.

Overseas handling

Some service providers process or store information outside Australia. GoHighLevel's published subprocessor list includes processing in the United States and support operations in India. Locations relevant to your information depend on the features and providers used and may change over time.

We do not promise that information remains in Australia. Contact us if you need more information about the providers relevant to your enquiry or service. Where applicable law requires safeguards for overseas disclosure, we will meet those requirements.

Cookies and similar technologies

Our website and embedded forms may use cookies or similar technologies for core functions, security, saving your progress in a form and remembering preferences. You can manage cookies through your browser, although disabling them may affect some functions.

If we introduce optional advertising or analytics technologies, we will explain their use and provide any consent or preference controls required by applicable law. This policy does not authorise us to activate undisclosed tracking.

AI-assisted work

We may use AI tools to help prepare website designs, code, copy and illustrative images. We do not need sensitive personal information or private customer databases to create a standard website preview.

Where personal information would be supplied to an AI provider, we will first assess the need, privacy implications and provider settings and give any notice or obtain any consent required. We will not treat an enquiry as blanket permission to upload confidential information to AI services.

Information on websites we build

A customer is responsible for deciding what information their own website collects and for giving their visitors appropriate notices. Where we host or support a customer website and handle its visitor information, we do so for the agreed service and according to the customer's lawful instructions. We do not use those visitor details for our own marketing.

Customer websites may need their own privacy policy. This policy does not automatically cover a customer's business practices.

Security and retention

We take reasonable measures to protect information from unauthorised access, misuse and loss, including appropriate access controls and secure service-provider arrangements. No online system is completely secure.

We keep information for as long as reasonably needed for the purpose collected, service administration, legal requirements and resolving disputes. We then take reasonable steps to delete it or de-identify it, including through provider retention processes. Some records may remain in backups until those backups expire.

If we become aware of a data incident, we will assess it, take appropriate action and make notifications required by applicable law.

Access, correction and complaints

Contact us to request access to or correction of personal information we hold about you, or to raise a privacy concern. We may need to verify your identity. We will respond within a reasonable time and explain if we cannot fulfil a request, subject to applicable law.

If you are unhappy with our response, you may contact the Office of the Australian Information Commissioner. Its ability to consider a complaint depends on whether the relevant privacy law applies.

Changes

We may update this policy to reflect changes in our services, practices or legal obligations. The current version will appear on our website with its update date. We will provide additional notice where required.