Privacy

Who you are dealing with

This site is run by me, Kalman Banu, a sole operator in Brisbane, Australia. There is no marketing department and no data team. When you email about your information, I am the person who reads it and acts on it.

Contact: [email protected]

What I collect, and when

Almost everything here is something you deliberately typed in. The one exception is where you came from — described below — which is recorded only if you join the list or book a call.

When you join the waiting list, I store: your email address; the time you consented; the time you confirmed; which of the three sign-up buttons you used; and your current status on the list. Your confirmation and unsubscribe links are stored only as one-way hashes, so a copy of the database cannot be used to confirm or unsubscribe anyone.

When you book a call, I store: your name; your email address; the time you chose; your timezone; and your answers to the short questions on the booking form. The booking also creates an event in my calendar, described below.

Alongside either of those, I store where the visit came from: the platform tag on the link you followed (for example, the link in my X profile is tagged so I know it was X), the website that referred you — the domain only, never the full address — and whether you arrived inside a social app’s built-in browser. It is kept only on the sign-up or booking itself, so I can tell which of my profiles is worth the effort. It is never attached to a plain visit, and it can never tell me who you are: nothing links it to your account on any platform, and no such link is possible.

With a sign-up I also note, in broad strokes, what kind of device it came from: phone, tablet or computer; the operating system family; a rough screen-size bucket; the browser’s language; and the country Cloudflare reports. Buckets, not measurements — these describe my audience as a whole and cannot single anyone out. And I keep a simple tally of how many times each short link on my profiles (kalmanbanu.com/ig and friends) is opened: a count per day, with nothing at all about who opened it.

To do that, this site stores a small note in your browser’s session storage recording where the visit started. It is cleared when you close the tab, it is readable only by this site, and it holds nothing but those few labels. I do not fingerprint your device: no canvas, no fonts, no screen measurements, no device identifiers.

When you simply visit, my server and the network in front of it record ordinary request logs — IP address, time, page requested, browser user-agent. These exist to keep the site up and to block abuse, and they are not linked to you as a person.

I do not collect, and have no way to collect: your location beyond the country your network reports, your browsing on other sites, your identity on any social platform, or a fingerprint of your device. Nothing here follows you between sessions or between sites.

What I use it for

• To send you one email when Syrvos opens, if you asked for that.
• To confirm that an email address really belongs to you before adding it to the list.
• To arrange, confirm and remind you about a call you booked.
• To keep the site running and to defend it against attacks.

That is the complete list. I do not profile you, score you, or use your data to train anything.

Where it is stored

On server hardware I own and operate in Brisbane, Australia. Not a hosting provider, not a third-party SaaS database. The waiting list, the booking records and the email system all run on that machine.

The database is encrypted at rest through full-disk encryption, backed up on a schedule, and those backups are themselves encrypted before they leave the machine.

Who else sees it

Being honest about this matters more than sounding private, so here is the complete list of third parties that touch your data, and exactly what each one gets.

• Cloudflare — sits in front of the site to provide TLS, block attacks and route traffic. It sees the IP address and request details of everyone who visits, and may set its own security cookie. It does not receive the contents of the waiting list or your booking answers.
• Google — only if you book a call. Your name, email address and the meeting time are written to a Google Calendar event so that a Google Meet link can be created and sent to you. Google’s handling of that data is governed by their privacy policy, not mine. If you would rather Google never received your details, email me instead of booking and we will arrange something else.
• Aussie Broadband — my outbound email passes through their mail relay to reach your inbox, as it does for any internet connection. They handle the message in transit.

There is no analytics provider, no advertising network, no tag manager, no session recorder, no chat widget, and no social media pixel. The landing page loads no third-party scripts at all. The booking page loads one script, from my own booking server, and nothing else.

I have never sold personal information and will not. If that ever changes, it would require your explicit opt-in first, and this page would say so before it happened.

Cookies

This site sets no cookies of its own. There is no consent banner because there is nothing to consent to.

Cloudflare may set a cookie to distinguish real visitors from bots. The booking calendar is served from my own booking server; loading it sets no cookies, and submitting a booking may set one that exists only to keep the form secure.

How long I keep it

Waiting-list records are kept while you are on the list. If you unsubscribe, the row is not deleted — your email address is retained with your status changed. That is deliberate: it is the record of your having asked not to be contacted, and it is what stops you being re-added later. Keeping it is how the promise is kept.

Booking records are kept as part of my calendar and business records.

Server and network logs are short-lived and rotate automatically.

If you want your data genuinely erased rather than retired, ask, and I will do it.

Your choices

Every marketing email carries a working one-click unsubscribe link. Those links do not expire, so one sitting in an inbox from two years ago still works.

You can also ask me directly, at [email protected], to:

• tell you exactly what I hold about you,
• correct anything that is wrong,
• delete it entirely,
• send you a copy in a portable format,
• or stop using it for a particular purpose.

I will respond within a reasonable time and will not ask you why. There is no charge, and no form to fill in — an email is enough.

If you are in the UK or EU, the rights above are the ones the GDPR gives you, and I honour them regardless of where you are. My lawful basis is your consent for the waiting list, and taking steps at your request for a booking.

Security

The site holds no database credentials and no CRM keys — it can only hand a signup to an internal service that is not reachable from the internet. That is deliberate, so that compromising the public web server does not expose the list.

Traffic is encrypted in transit, credentials are scoped to the single thing they need to do, and administrative interfaces are behind separate authentication.

No system is perfect. If something does go wrong in a way that puts your information at risk, I will tell the people affected directly, and promptly, rather than burying it.

Children

This site is aimed at people running businesses and is not intended for children. I do not knowingly collect information from anyone under 16.

Changes

If this policy changes, the date at the top changes with it. If a change actually affects how your information is used — rather than just tidying the wording — I will email the people on the list rather than quietly updating the page and hoping nobody notices.

Complaints

Email me first at [email protected] and I will try to put it right. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.