Privacy Policy | DJ Heeley Roof Restoration

Who we are and how to contact us

We are DJ Heeley Roof Restoration. For privacy questions, access to your enquiry, corrections or deletion requests, call our business number: 0421 982 739. We aim to respond within 30 days. We may ask for enough information to verify your identity without collecting unnecessary identity documents. If we cannot complete your request or need to retain information, we will explain why.

Enquiry information

When you request a quote, we collect your name, phone number, suburb, selected service and any optional message you provide. Our website database also records a submission reference and the time received. To manage retention, authorised administrators can record whether the enquiry is active or closed, the last contact date and whether a retention exception applies.

We use this information to respond, discuss roofing work and manage your enquiry. Please do not include passwords, payment information, identity documents or other sensitive information in form messages.

The website saves your enquiry in a PostgreSQL database accessed through our Replit-hosted application. Your browser separately sends your enquiry details to Web3Forms so it can email a notification to our business mailbox. Authorised administrators can access the dashboard. The mailbox provider also processes the emailed copy. Database saving and notification delivery are separate: saving an enquiry does not guarantee an email was delivered.

AI assistant

The optional AI assistant sends your question and recent conversation turns through Replit AI Integrations to OpenAI to generate an answer. Do not include personal or sensitive details. Use the quote form or call us for a property-specific enquiry.

Our application does not store chat transcripts in its database. Conversation messages remain in browser memory until you reload or leave the site; simply closing the chat panel does not clear them. We store a shared monthly AI attempt count, not conversation content.

OpenAI states that API content is not used for model training by default unless the customer opts in. Its standard abuse-monitoring logs may retain prompts and responses for up to 30 days, with longer retention in specified legal or safety circumstances. We have not verified special retention settings or the retention period of Replit's intermediary service for this account. We do not promise zero provider retention.

Administrator sign-in and technical data

Clerk provides administrator authentication and processes sign-in details, account identifiers, sessions and related security information under its own terms. Our server checks an administrator's verified email against an approved list. The enquiry form does not require a customer account, and our application does not send enquiry details to Clerk for authentication.

Authentication uses cookies and related browser technologies. Our server uses IP addresses in memory for abuse prevention; those entries are not saved in the enquiry database and can remain until replaced, cleared or the service restarts. It also logs technical request information, such as request identifiers, paths and response status. Application request logging is configured not to include enquiry or chat message bodies. Hosting and service providers may separately process network and device information for delivery and security; their log retention settings have not been confirmed for this account.

The website loads fonts from Google Fonts. Font requests send Google your IP address, the requested resource and browser request headers, which can include browser/device details and referring-page information. Google says its Fonts API does not set or log cookies. Its privacy information explains how these requests are handled.

How long we keep information

We review closed or abandoned enquiries monthly and delete them from the active website database 12 months after closure or last contact, whichever is later. Active enquiries are excluded. Information needed for legal, accounting, disputes or warranty purposes may need to be retained longer; we review these exceptions rather than deleting it automatically.

We separately review notification email copies under the same enquiry rule, subject to those exceptions. Removing a dashboard enquiry does not automatically remove its notification email or copies held by providers.

Web3Forms' privacy policy allows form submission retention for up to three years, with shorter periods depending on the plan or earlier deletion. We have not confirmed the applicable plan period for this account. Clerk retains information according to its service terms and legal obligations; we do not claim a fixed authentication retention period. OpenAI's published standard is described above. Provider logs and legally required records can have separate retention periods.

Deletion and recovery copies

We verify requests, check any retention obligations and obtain owner confirmation before deleting website enquiry records. Email and provider copies are handled separately through their available controls or support. We report what was deleted and any remaining restrictions rather than promising removal from every system at once.

Our approved recovery approach targets a restricted seven-day backup window where supported and verified. The actual database backup settings must be checked before relying on that target. Deleted information may remain in protected recovery copies until those copies expire; active-database deletion is not immediate backup erasure. We keep a minimal deletion manifest separately from database backups for the recovery window and use it to reapply deletions after a restore before reopening access.

Providers, overseas processing and security

Replit, Web3Forms, the notification mailbox provider, Clerk and OpenAI process information for the purposes described above. Their infrastructure and subprocessors may process information overseas. We do not claim Australia-only storage. Web3Forms identifies infrastructure providers including AWS, Cloudflare and Hetzner and possible spam-prevention processors; its policy explains these recipients.

We restrict dashboard access and use reasonable security controls, but no online service can guarantee complete security. Contact us using the business number on this website if you have a concern or complaint.

Provider information

We will update this policy when our practices change. Last updated: 4 October 2026.