Privacy policy.

Black Shard is a privately held Australian software engineering and cybersecurity firm with its head office in Brisbane. This privacy policy applies to blackshard.com.au and its subdomains.

We collect what you give us, and a short record of how you reached the site. The two routes are:

• Contact form submissions: name, email, phone number and organisation if you give them, the track you selected, and the brief you write. We log the request timestamp and your browser user-agent string for spam resistance. With the brief goes the source of your visit: the campaign tags and any ad click id on the link you arrived on, the page you landed on, the domain of the site that sent you, and whether you allowed ads measurement.
• Direct email: anything you send to info@blackshard.com.au arrives at our mailbox and is handled like ordinary correspondence.

Separately from that, the site measures its own traffic. Google Analytics runs on every page. Google Ads measurement runs only if you choose Allow on the notice that appears on a first visit.

Google Analytics runs on every page, and Google Ads measurement runs on consent. This is what each choice does.

Set on every visit, whatever you choose

• _ga and _ga_0T7T59W6WH: Google Analytics. They let Analytics tell one browser from another, so a returning visit is not counted as a new person. Set on blackshard.com.au itself. They last about 13 months, and some browsers cut that down further on their own.

Through those, Analytics records the pages you look at, the site or search you arrived from, coarse location and device detail worked out from your IP address, clicks on our phone and email links and on the scoping call link, and the fact that a form on the page was submitted. It does not receive your name, your email address or anything you type into the contact form, and we do not attempt to identify anyone from it.

If you choose Allow

• _gcl_au: ties the visit to a Google Ads campaign so a conversion can be attributed to it. Set on blackshard.com.au, 90 days.
• _gcl_aw: holds the click id from the ad you arrived on, so an enquiry can be credited to that ad. Set only when you arrive from a Google ad. Set on blackshard.com.au, 90 days. Google keeps the same click id in this browser under _gcl_ls in local storage.
• Google sets its own cookies on its own domains at the same moment: GCL_AW_P on google.com, googleadservices.com and doubleclick.net, plus a short-lived test_cookie on doubleclick.net. Those are Google’s cookies under Google’s terms.
• IDE on doubleclick.net: Google’s advertising identifier, up to about 13 months. Allow turns on ad personalisation, so the visit joins our Google Ads audience and our ads can reach you again on other sites Google serves. This is the one part of Allow that is not only measurement.

If you choose No thanks

Nothing beyond the two analytics cookies is set. The Google ads tag still runs and Google still receives a pageview signal from it, with no cookie read, none written, and no advertising identifier attached. That is Google Consent Mode in its denied state, and it is also what happens before you choose anything.

Where the choice is kept

Your answer is stored in this browser under bs_ads_consent in local storage. That is why the notice does not come back, and why the choice does not follow you to another browser or another device. A copy sits in a first-party cookie of the same name on blackshard.com.au for up to 400 days, renewed on each visit. Your browser sends that cookie only with the contact form, never when you open a page, so a brief records your choice even if it is sent before the page’s scripts have loaded. When you send a brief, your choice at that moment goes with it.

The ad click id and the contact form

If you arrive from a Google ad, the click id in that link is kept in this browser for up to 90 days, in local storage under bs_gclid. This happens whatever you choose, because it is our own storage rather than a Google cookie, and nothing leaves the browser unless you send us something. If you send the contact form within that window, the click id comes to us with the brief and is kept with it. We do not pass it to Google. Google Ads learns that a click became an enquiry only through its own cookie, and only if you chose Allow. No part of a submission reaches Google. Your name, your email address, your phone number, your organisation and your brief go to us and stay with us. Clearing your browser’s site data, or waiting longer than 90 days to get in touch, means the click id does not come with the brief. The form itself is unaffected either way.

The Reddit ad click id

A Reddit ad link carries its own click id, and it is kept the same way: in this browser, in local storage, under bs_rdt_cid, for up to 28 days. Twenty-eight days is the longest period Reddit will credit a click, so there is no reason to hold it longer. If you send the contact form inside that window, the click id goes with it and nothing else about you does. Clearing your browser’s site data, or getting in touch later than that, means the enquiry isn’t attributed, and the form works exactly the same either way.

Where your visit came from

On the first page you open, the site keeps a short record of how you arrived, under bs_touch in local storage and in a first-party cookie on blackshard.com.au. It holds the campaign tags on the link (utm_source, utm_medium, utm_campaign, utm_content and utm_term), any Google ad click id on it (gclid, gbraid or wbraid), the path of the page you landed on with nothing after it, and the domain of the site that sent you, without the page. A tag that holds an email address or a phone number is thrown away before anything is kept. The record is written once. A later visit replaces it only when the first one carried no campaign tag and no click id, or is more than 90 days old. The site ignores a record older than that, and the cookie expires at 90 days. This happens whatever you choose about ads, because it is our own storage rather than a Google cookie. Your browser sends the cookie only with the contact form, never when you open a page, so a brief carries the record even if it is sent before the page’s scripts have loaded. If you send the form, the record goes to us with the brief, and we use it to see which campaigns, searches, posts and referrals bring enquiries. Clearing your browser’s site data removes it.

When a brief is sent

The confirmation page you land on after sending a brief tells Google Ads that a brief was received. That signal carries the fact it happened, the title of the page it happened on, and a random reference number made in your browser for that brief, so a reload of the page is not counted as a second brief. The number is held in this tab’s session storage under bs_brief_tid and bs_brief_conv_sent, and goes when the tab closes. The signal carries nothing you wrote: not your name, not your email address, not your phone number, not a word of the brief. It is sent whatever you choose here. Under No thanks it goes with the refusal attached, so no ads cookie is read or written for it. Under Allow it is one of the points where the ads cookies above are written.

Our own website analytics, which runs on our infrastructure and sets no cookies, also records that a brief was received and the type of work you chose. It works out coarse location and device detail from your IP address and browser user-agent string. It carries nothing you wrote, and it records this whatever you choose here.

Changing your mind

The control applies on the spot, with no reload and no form to fill in.

Clearing site data for blackshard.com.au in your browser settings removes the cookies, the stored choice and the click id together, and the notice appears again on your next visit. Google runs its own controls across every site it serves ads on, at My Ad Center.

Submissions are routed to the Black Shard mailbox and handled as correspondence. The source of the visit that comes with a brief tells us which campaigns, searches, posts and referrals bring enquiries and which of them become paid work, so we can decide where to spend on advertising. We do not use it to build a profile of you. We do not sell, rent, or share contact submissions with any third party. The exceptions are about crediting an ad rather than about you: Google Ads is told that a brief was received, and if you chose Allow and came from a Google ad, Google’s own cookie matches the brief to that click. Nothing from a submission travels with either. A copy of each brief is held encrypted on our web server until it reaches our mailbox, and for 30 days after that. We retain correspondence for as long as is needed to respond and meet our record-keeping obligations. On our side, the source of the visit and any Google ad click id are kept only in that encrypted copy. The mail that reaches our mailbox carries neither, and both are deleted with the copy.

The site is served through Cloudflare, in front of a server we run ourselves in Microsoft Azure’s Australia East region. Email is handled by Microsoft 365 on the blackshard.com.au tenant. Form submissions are delivered by Microsoft Graph straight into that same Microsoft 365 mailbox, so no third-party email processor sits in the path. Google receives the measurement set out in the cookies section and nothing else: a brief you send goes to our Microsoft 365 mailbox, never to Google.

You can request a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Email info@blackshard.com.au with the request. We respond within 30 days, in line with the Australian Privacy Principles under the Privacy Act 1988.

If you are unhappy with how we have handled your data, you can complain to us first. If we cannot resolve it, you can complain to the Office of the Australian Information Commissioner (OAIC).

When we update this policy, the "last updated" date at the top of the page changes. Material changes get an explicit note alongside that date.