Privacy

Who we are

MirrorFirm ("we", "us") is based in Melbourne, Victoria, Australia. Contact us about privacy at contact@mirrorfirm.com.

This policy covers mirrorfirm.com and enquiries made through it. Separate agreements and any applicable privacy notices explain how information is handled in customer engagements. They do not limit rights under applicable privacy law.

What we collect

Enquiries. The enquiry form collects:

• your name, work email and organisation;
• your primary use and preferred starting point;
• an optional objective of up to 2,000 characters;
• a required acknowledgement that we may contact you about the enquiry.

All fields except the objective are required, and the form accepts no files.

Your enquiry is emailed through Amazon SES in Sydney to our team inbox. The website itself stores no copy of what you wrote, but the email stays in our inbox as described under "Security and retention". Please do not include sensitive personal information, customer data or confidential material.

You may email a general question without giving your name or using your real name. We may need further details to respond or to scope work.

Technical records.

• For rate limiting, we store a record keyed by a one-way (SHA-256) hash of your IP address together with the current minute. It is set to expire after about two minutes.
• To prevent duplicate enquiries, we store a record for each request ID your browser generates, containing its state and timestamps but no form content. Records for sent enquiries expire after seven days. A record whose sending outcome is unclear is kept until we have checked it.
• Our server logs contain only the request ID, the outcome and an error classification.

Expiry does not mean immediate deletion: expired records are removed in the background.

Analytics. We use Google Analytics to understand how the site is used. Our analytics events are limited to clicks on the main call-to-action buttons, sample downloads, successful enquiries and clicks on the booking link, each with a broad category. We do not send page-view events. We do not include names, email addresses or anything you type. Page addresses are trimmed to the site and path, without query strings or fragments.

Google Analytics also uses cookie identifiers and processes technical information about your browser, device and connection. Google signals and ad personalisation are off, and advertising storage is denied.

Analytics is on by default. To turn it off, choose Privacy preferences in the footer, then Turn off analytics. This stops further analytics, sets the Google Analytics disable flag, clears this site's _ga cookies and saves your choice in your browser. The choice applies to that browser only and is lost if you clear your browser storage. Turning analytics off does not delete information already sent to Google.

Booking a conversation. The Book a conversation link opens Microsoft Bookings in a new tab. Microsoft handles that page and anything you enter there under the Microsoft Privacy Statement. We receive the booking details you provide so that we can arrange the meeting.

Samples. The downloadable Aster Financial JSON and Southern Harbour Mutual ZIP are synthetic and contain no real personal information. The ZIP includes a synthetic answer key and deliberately planted dummy secrets. These are test material, not live credentials.

How we use information

We use information to:

• respond to enquiries and discuss samples, pilots or other work;
• arrange meetings;
• operate and secure the website and prevent misuse;
• understand how the website is used.

We do not sell personal information. We do not send marketing emails unless you separately agree to receive them.

Service providers and overseas handling

We use:

• Amazon Web Services for hosting (AWS Amplify), enquiry-email delivery (Amazon SES) and the technical records above (Amazon DynamoDB), all configured in Sydney, Australia;
• Microsoft 365 for our team inbox and calendar, and Microsoft Bookings for meeting bookings;
• Google for analytics while it is enabled.

These providers may store or access information outside Australia, including in the United States. We otherwise disclose personal information only with your agreement or where the law requires it.

Security and retention

Access to our inbox, calendar and cloud accounts is limited to the people who need it. The site uses encrypted connections (HTTPS), and our providers encrypt the information they store for us.

We keep enquiry emails and booking details while we need them, normally deleting them within 24 months of our last contact with you. We keep them longer only where an ongoing engagement or a legal requirement needs it. Other retention periods:

• Server logs: 90 days.
• Google Analytics event data: the period set in our Google Analytics account, currently Google's default of 2 months.
• The _ga cookie: up to 2 years unless you clear it or turn analytics off.
• Request records whose sending outcome is unclear: reviewed monthly and deleted once resolved.

Your analytics choice stays in your browser until you change or clear it.

Access, correction and complaints

Email contact@mirrorfirm.com to ask for access to, correction of or deletion of your personal information, or to make a privacy complaint. Tell us what your request concerns. We may ask for information reasonably needed to confirm your identity. We do not charge for access or correction requests.

We aim to respond within 30 days. If we cannot meet a request, we will explain why and how you can challenge our decision. We may need to keep some information to meet legal requirements.

We will investigate any privacy complaint and tell you our response. If the Privacy Act applies to our handling of your information and you are not satisfied, or we have not responded within 30 days, you may complain to the Office of the Australian Information Commissioner: https://www.oaic.gov.au/privacy/privacy-complaints.

Changes

We may update this policy to reflect changes in our practices or obligations. The date above shows when it last changed.