Privacy policy

About this policy

This Privacy Policy explains how Cascayd Pty Ltd (ABN 43 693 630 974) of Melbourne, Victoria, Australia (“Cascayd”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information. It applies to our website at cascayd.app (the “Website”), our newsletter, our communications with prospective and current clients, and our conversion rate optimisation (CRO) services. We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and other privacy laws that apply to us. Our Website and services are intended for businesses and are not directed at children. Use of the Website is also governed by our Terms of Service.

What Cascayd does

Cascayd provides CRO services to businesses. We run controlled experiments on our clients’ websites that compare the existing version of a page, flow, or element against one or more changed versions, then report the results and help implement the versions that win. We provide our services under a signed CRO Services Agreement and a Mutual Confidentiality Agreement with each client.

Information we collect

The personal information we collect depends on how you interact with us:

• Contact and business information, such as your name, job title, employer, work email address, phone number, and the content of messages you send us, for example when you email us or arrange a call.
• Newsletter information, namely the email address you submit when you subscribe.
• Audit application information, namely the store URL and work email address you submit when you apply for a store audit.
• Client relationship information, such as the names, job titles, and email addresses of client representatives, signatories, and people nominated to receive notices, together with records of test plan approvals, correspondence, reports, invoices, and payments.
• Access details that a client gives us for its platforms, such as analytics, code repository, or Shopify accounts, so we can run tests and implement approved changes.
• Website usage information, such as the pages you visit, how you arrived at the Website (including the referring site, campaign tags such as UTM parameters, and advertising click identifiers), your approximate location derived from your IP address, your device and browser type, and how you interact with the Website. See “Cookies, analytics, and advertising” below.

Our testing script on client websites

To run tests, we install our own tracking and testing script on a client’s website. The script assigns browsing sessions to the existing version or a changed version of a page and records session-level results, such as page views, conversions, and the value of orders linked to each version. Our testing script does not collect personal information and does not perform identity matching or enrichment. Clients can switch the script off or remove it at any time. If you visit a client’s website, that client’s own privacy policy explains how it handles your information.

Information clients share with us

During an engagement, clients may give us access to analytics data, revenue and order data, and other business information. We ask only for the access we need to perform our services, and we use that access and information only to perform our services for that client, such as planning tests, measuring results, and calculating fees. If client information includes personal information about the client’s customers, we handle it only as needed to provide our services, protect it as confidential information under our agreements, and comply with the privacy laws that apply to us. We do not sell it, use it to identify individuals, or use it for our own marketing.

How we collect information

We collect personal information directly from you, for example when you email us, subscribe to our newsletter, speak with us, or sign an agreement with us. We may also collect it from the organisation you work for, from publicly available sources such as business websites and professional profiles, and automatically through cookies and similar technologies on the Website. You can contact us with a general enquiry without identifying yourself or by using a pseudonym, but we need identifying details to respond to some requests or to enter into an agreement with you or your organisation. If you do not provide information we ask for, we may not be able to respond to you or provide our services.

How we use information

We use personal information to:

• respond to enquiries and audit applications, review the store you submit, and discuss our services with you;
• prepare, enter into, and perform client agreements, including sending test plans, reports, invoices, and notices;
• run, measure, and report on tests for our clients;
• send our newsletter and, where permitted, other marketing about our services;
• understand how the Website is used and improve it;
• measure the effectiveness of our advertising;
• keep the Website, our systems, and the client accounts we can access secure; and
• meet our legal, tax, accounting, and contractual obligations.

Cookies, analytics, and advertising

The Website uses cookies, pixels, and similar technologies, including:

• Google Analytics, Vercel Analytics, and PostHog, to measure page views and understand how visitors use the Website;
• the Meta Pixel and the OpenAI advertising pixel, to measure the effectiveness of our advertising and to help those platforms show and measure our ads;
• Cascayd’s own script, which we use to measure visits and run experiments on our own Website; and
• a first-party cookie that remembers campaign details from your first visit, such as UTM parameters and Google or Meta advertising click identifiers, for up to 180 days, so we can understand which campaigns bring visitors to the Website.

These providers may set their own cookies and receive information such as your IP address, browser details, and the pages you visit, and they handle that information under their own privacy policies: Google, Vercel, PostHog, Meta, and OpenAI.

You can block or delete cookies through your browser settings, use browser privacy controls or extensions, opt out of Google Analytics with Google’s opt-out browser add-on, and manage ad preferences in your Meta account settings. Blocking cookies does not stop you from using the Website.

Who we disclose information to

We do not sell personal information. We disclose it only:

• to service providers that help us run our business, including Vercel for website hosting and analytics, Supabase for newsletter sign-ups and audit applications, Slack for internal notifications about new audit applications, Google and PostHog for analytics, Meta and OpenAI for advertising measurement, our email and productivity tools, and our professional advisers such as accountants and lawyers;
• to our employees and contractors who need it to perform our work and who are bound by confidentiality obligations;
• in case studies and marketing, only as our client agreements allow, such as a client’s name and logo and results shown as percentages or other relative figures. We publish dollar figures or other client data only with the client’s written consent, and we never publish personal information about a client’s customers;
• where required or authorised by law, or where needed to protect our rights, property, or safety or those of others; and
• to a buyer or successor if our business is reorganised or sold, on the condition that they handle it consistently with this Policy.

Overseas disclosure

Some of our service providers store or process information outside Australia, including in the United States and other countries where they or their own providers operate. When we disclose personal information overseas, we take reasonable steps to ensure that it is handled consistently with the Australian Privacy Principles.

Newsletter and marketing

If you subscribe to our newsletter, we use your email address to send articles and updates about CRO, experimentation, and Cascayd. We send marketing emails only where permitted by the Spam Act 2003 (Cth). You can unsubscribe at any time by using any unsubscribe option in our emails or by emailing support@cascayd.app.

Security

We take reasonable steps to protect personal information from misuse, interference, and loss, and from unauthorised access, modification, or disclosure. These steps include limiting access to people who need it, protecting account credentials, requesting only the client access we need, and using reputable service providers. No method of storage or transmission is completely secure. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

How long we keep information

We keep personal information only for as long as we need it for the purposes described in this Policy, including to meet our legal, tax, accounting, and contractual obligations. When a client discussion or engagement ends, we return or destroy confidential information as our agreements require, except for copies held in routine backups, copies we must keep by law, and records we need to calculate, invoice, or support fees. We keep newsletter email addresses until you unsubscribe. When we no longer need personal information, we delete it or de-identify it.

Access, correction, and complaints

You can ask to access or correct the personal information we hold about you by emailing support@cascayd.app. We will respond within a reasonable time, usually within 30 days. We may need to verify your identity first. If the law allows us to refuse a request, we will tell you why. If you are located outside Australia, you may have additional rights under the laws where you live, and we will respond as those laws require.

If you have a concern or complaint about how we have handled your personal information, please contact us first with the details. We will investigate and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this Policy

We may update this Privacy Policy by publishing a new version on this page with a new “Last updated” date. The updated Policy applies from that date.

Contact us

Cascayd Pty Ltd (ABN 43 693 630 974), Melbourne, Victoria, Australia. Questions or requests about this Privacy Policy can be sent to support@cascayd.app.