The short version
We run a Brisbane business directory and write stories about the people behind those businesses. There are no accounts and no logins on this site. We don't sell your information and we don't run advertising. We use Google Analytics to see which pages get read, and nothing else.
For most visitors, the only information we hold is what you chose to type into one of our forms, or the email address you gave us for the newsletter.
Two exceptions, both explained below: if you sit down with us for a Story, we hold the recording and transcript of that conversation; and some listings are built from information a business has already made public, without us asking first. Either way, if it's your business and you want it gone, you only have to ask.
Who we are
Small Businesses of Brisbane ("Small BOB", "we", "us") is operated by Web and Glow Pty Ltd (ABN 53 641 999 626).
We are a two-person operation based in Brisbane. There is no shopfront.
You can reach us through the form on our Contact page.
When we collect information about you
When you fill in one of our forms
The site has a small number of forms. Each one collects only the fields shown on the page:
| Form | What it asks for |
|---|---|
| Suggest a business | Business name, owner's name, Brisbane suburb, why you think we should tell their story, and your contact details |
| Corrections | The page or business concerned, what needs correcting, where we can verify it, and your contact details (optional) |
| Takedown request | Business name, your name and relationship to the business, your contact details, and what you would like removed |
| Contact | Your name, email, the topic, a business name (optional), and your message |
| Add a listing | Business name, owner's name, email, phone (optional), Brisbane suburb, website (optional), social links (optional), which plan you're interested in, whether you'd like to be considered for a story, anything else you want to tell us (optional), and your confirmation that you're authorised to represent the business |
| Submit an event | Your name, the business organising it, phone and email — none of which we publish — plus the event title, category, start and end date and time, suburb, location, cost, description, a link (optional), and your confirmation that you're authorised to submit it |
Two things worth calling out in those last two forms, because they're easy to miss in a table. The plan you pick is recorded — it comes to us as part of the enquiry, and it's how we know what to quote you for. And the authorisation tick-box is a declaration you're making, so we keep it with the rest of the submission as our record that you told us you had the authority to submit.
Neither form takes photos. There is no upload anywhere on this site — if we need images we'll ask for them by email after you get in touch.
What happens to a form submission. It goes to a small function running on Cloudflare's network, which checks the fields, then sends the contents to us as a plain-text email using Cloudflare's email sending service. There is no database behind this site and no account for you to have. Your submission lives in our email inbox and nowhere else on our side.
If something breaks at our end — the spam check is unavailable, or the email won't send — we log the technical error so we can fix it. Those logs record what broke, and in one case which type of form was involved. They never record what you wrote. Ordinary rejections, like a failed spam check or a missing field, aren't logged at all.
Spam checks. Every form on this site is protected the same way. Three things happen before a submission reaches us: a hidden field catches bots, a timing check makes sure the form wasn't filled in instantly, and Cloudflare Turnstile runs a challenge. Turnstile loads from Cloudflare's servers and, as part of verifying you, Cloudflare receives your IP address and information about your connection and browser. Cloudflare handles that under its own privacy terms. We don't see or keep the result beyond pass or fail.
When you sign up to the newsletter
We collect your email address. Nothing else.
The only way onto the list is the sign-up band that appears on most pages. No other form subscribes you — not Add Listing, not Add Event, not Contact. If you send us a form or email us, that alone never puts you on the newsletter.
Your address goes to Encharge, the email service we use to send the newsletter, tagged so we know you came from the website. We do not buy lists, scrape addresses, or import contacts from anywhere else.
Every email we send identifies us and carries an unsubscribe link that works without you having to log in, give a reason, or tell us anything else. Under the Spam Act 2003 (Cth) that link has to keep working for at least 30 days and an unsubscribe has to be actioned within five working days. We aim to be immediate.
When you simply visit the site
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare keeps standard server and network logs — IP address, the page requested, timestamp, browser and device type, and referring page. Those logs sit with Cloudflare under its own retention rules, and we use them only if we need to diagnose a problem or deal with abuse. We don't build a profile from them or connect them to anything else.
We run Google Analytics 4. It tells us which pages get visited, roughly where visitors come from, and what kind of device they use. Google sets cookies to do this and processes the data under its own privacy policy. IP addresses are not stored by Google Analytics 4. We don't run advertising pixels and we don't link analytics data to anything you type into a form.
We set no cookies of our own. Apart from the Google Analytics cookies above, the only cookie you might pick up here is one Cloudflare's Turnstile sets on pages that carry a form, to remember that you've already passed the spam check.
Images and media may be served from Cloudflare's storage. Where we embed a video or audio player from a publisher, that publisher may collect information about you through the embed, under its own terms.
Maps. A listing page with an address shows a small map. The map images come from OpenStreetMap, which means opening that page sends your IP address to OpenStreetMap's servers along with a request for the tiles. We don't get anything back from that and we can't tell who looked at which map. The directions button is an ordinary link to Google Maps — nothing is sent to Google unless you click it, at which point you're on Google's site under Google's terms.
If we interview you for a Story
If you agree to be interviewed, that's a separate conversation with its own written release, which you sign before we start. We record the interview as audio, turn it into a private written transcript, and build your Story from your own words.
Two third-party services help with that work, both overseas: ElevenLabs produces the first transcript from the audio and Anthropic Claude checks the transcript and helps shape a first draft. A human edits every Story afterwards. Recordings reach us through Google Drive.
We keep the transcript privately as our record of what was actually said. We never publish it. You see and approve your Story before it goes live, and you can call the whole thing off up until we publish. Afterwards, if you want it taken down, you only have to ask.
If we list your business without asking first
Some listings are created by us from information the business has already made public — its own website, public directories, or media coverage. Those listings carry a note saying the business hasn't been featured yet and that the entry was built from public sources.
That information is usually about a business rather than about you personally, but a business name and an owner's name often amount to the same thing. If it's your business and you'd rather not be here, tell us through the takedown form and we'll take it down. We verify that the request really comes from the business, using an email address or phone number the business publishes, and we act within 48 hours. When the business itself asks, we remove first and discuss afterwards. You don't owe us a reason.
What we don't do
- We don't sell, rent, or trade your information.
- We don't run advertising on the site.
- We don't send you marketing you didn't ask for.
- We don't ask for, or accept, payment card details through this website.
- We don't create accounts or store passwords, because there are none.
- We don't pass information to our other business. Mark and Silvia also run a digital marketing business. It has no access to anything submitted here, and nothing you send us is passed to it or used by it. We say so plainly on our About page.
Who else handles your information
We keep the list of suppliers deliberately short:
| Who | What they do for us | What they see |
|---|---|---|
| Cloudflare | Hosting, form handling, spam checks, notification emails and media storage | Site traffic and connection data; form submissions in transit |
| Encharge | Sends the newsletter | Your email address and whether you opened or clicked |
| ElevenLabs | Transcribes interview audio | The recording, if you've agreed to be interviewed |
| Anthropic | Helps check transcripts and draft Stories | The transcript |
| Google Drive | How interview recordings reach us | The recording |
| OpenStreetMap | Supplies map images on listing pages | Your IP address and the map tiles loaded |
| Google Maps | A directions link | Nothing unless you click the link; then Google's terms apply |
We may also disclose information if we're required to by law, or where it's genuinely necessary to deal with abuse of the site or a safety issue.
Information going overseas
Most of the services above are based outside Australia and store or process information overseas — mainly in the United States and Europe. That's a practical consequence of using ordinary internet infrastructure as a two-person operation.
We choose established providers with published privacy terms, but once your information is with them it's handled under their terms and the law of their country as well as ours.
How long we keep things
- Form submissions stay in our email inbox for as long as they're useful to us. A takedown request, for example, is worth keeping as a record of what we agreed to do.
- Newsletter addresses stay until you unsubscribe. Unsubscribed addresses are kept on a suppression list so we don't accidentally add you again.
- Interview transcripts are kept privately as our record of what was said.
- Published listings and Stories stay up until they're removed on request or we take them down ourselves. Removed pages may linger in search engine caches for a while, which is out of our hands.
How we keep it safe
The surface is small on purpose. There's no database to breach, no accounts to compromise, and no card details anywhere near this site. The site is served over HTTPS. Access keys are held in a shared password manager by the two of us and nobody else.
No website can promise perfect security, and we won't pretend otherwise.
If information we hold is lost or exposed in a way that's likely to cause you serious harm, we'll tell you what happened and what you can do about it, and we'll notify the Office of the Australian Information Commissioner where we're required to.
Your choices
You can ask us to:
- tell you what we hold about you;
- correct anything that's wrong;
- delete what we hold, where we're able to;
- take down a listing or Story about your business; or
- unsubscribe from the newsletter — though the link in any email is faster.
Contact us to make a request. Takedown requests are acted on within 48 hours.
If you're unhappy with how we've handled it
Tell us first and put "Privacy" in the subject or topic so we can look into it.
If you're not satisfied with our answer, you can raise it with the Office of the Australian Information Commissioner at oaic.gov.au. Whether the OAIC can take up a complaint about us depends on whether the Privacy Act 1988 applies to a business our size.
Children
This site is written for adults and isn't aimed at children. We don't knowingly collect information from children.
If you believe we hold or have published information about a child that we shouldn't, tell us and we'll take it down.
Where the law sits, honestly
The Privacy Act 1988 (Cth) and the Australian Privacy Principles generally apply to organisations above a turnover threshold, and small businesses are often outside them. We may or may not be legally bound by that Act, and we're not going to claim compliance with obligations that may not apply to us.
What we can tell you is what we actually do, which is set out above. We've written this policy to follow the spirit of the Australian Privacy Principles — collect little, say what we collect, keep it safe, and let you see and correct it — whether or not we're required to.
The Spam Act 2003 (Cth) applies to us regardless of our size, and our newsletter is run to meet it: consent first, our identity in every email, and an unsubscribe link that works.
Other law applies to us whatever our size — defamation, copyright, the Australian Consumer Law, and the privacy tort that came into force in 2025. None of that depends on a turnover threshold, and we don't treat it as optional.
Changes to this policy
If our practices change, we'll change this page and update the date at the top. If a change is significant — a new service handling your information, or a new category of information collected — we'll say so on the page rather than quietly editing it.
Contact us
Web and Glow Pty Ltd (ABN 53 641 999 626)
Contact Small BOB