leadpages

Privacy Policy

Last updated: 1 July 2026 · Operated by Bean Culture Pty Ltd (ABN 33 600 754 676), trading as Web Culture (“we”, “us”, “LeadPages”).

This policy explains how we collect, use, store and share personal information through the LeadPages platform at leadpages.com.au and the customer websites we build and host on it. We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where it applies, the EU/UK GDPR.

Who does what

Our business customers (tradespeople, brokers and other businesses) use LeadPages to run a website. For information their website visitors submit, the customer is the controller of that information and we act on their behalf as processor.
Website visitors are people who browse a LeadPages-built site and may submit an enquiry.

1. Information we collect

From business customers

Account and contact details (name, business name, email, phone).
Business content you provide (services, descriptions, logo, images, hours, location).
Billing information — payments are processed by Stripe; we do not store full card numbers.
If you connect Instagram, the data described in our Instagram Data Use & Deletion page.

From website visitors

Enquiry details you submit through a quote or contact form: name, email, phone and the job details you choose to include.
Usage analytics: page views, clicks (such as tapping a call button) and form submissions, used to measure a site’s performance.
Technical data automatically received by our hosting providers, such as IP address, browser type and approximate location.

2. How we use information

To operate, secure and improve the platform and the customer websites hosted on it.
To deliver enquiries to the relevant business (by storing the lead and emailing the business).
To let businesses contact their own customers by email where those customers have provided an address, subject to an unsubscribe option (see section 6).
To process payments and manage accounts.
To produce aggregate performance statistics for each site.
To comply with law and enforce our terms.

Where the GDPR applies, our legal bases are performance of a contract, your consent (which you may withdraw), and our legitimate interests in running and improving the service.

3. Cookies and analytics

Our sites use only the cookies and similar technologies needed to operate the site and measure basic performance. We do not use third-party advertising cookies or sell tracking data. Where required, sites will ask for your consent to non-essential cookies.

4. Service providers we share information with

We use trusted providers to run the platform. Each processes information only as needed to provide their service to us:

Provider	Purpose
Supabase	Database and authentication
Vercel	Website hosting and serverless functions
Stripe	Payment processing
Resend	Transactional and campaign email delivery
Cloudinary	Image storage and delivery
Meta Platforms (Instagram)	Instagram content, only if a customer connects their account
Google	Maps / location features, where used on a site

We do not sell personal information. We disclose it only to these providers, to a business about its own enquiries, or where required by law.

5. Where information is stored

Our providers may store and process data on servers located in Australia. Where information is transferred overseas, we take reasonable steps to ensure it is handled consistently with the APPs and, where applicable, use appropriate GDPR transfer safeguards.

6. Marketing email and opt-out

A business may email its own past enquirers about offers or updates. Every such email includes a one-click unsubscribe link, and a business can also mark any contact as opted-out. Once unsubscribed, that address is excluded from future bulk email from that business. This is separate from operational emails (such as a reply to an enquiry).

7. Data retention

We keep personal information for as long as needed to provide the service and to meet legal, accounting or reporting obligations, after which it is deleted or de-identified. A business may delete individual enquiries at any time.

8. Your rights and choices

Request access to, or correction of, the personal information we hold about you.
Request deletion of your information (see section 9), subject to legal retention limits.
Withdraw consent, or unsubscribe from marketing email at any time.
If you submitted an enquiry to a business, you can also contact that business directly, as they control that information.

9. Deleting your information

To request deletion of personal information we hold, email privacy@webculture.au with the details you’d like removed. We will action verified requests within a reasonable time. Deletion of Instagram-sourced data is covered in the Instagram Data Use & Deletion page.

10. Security

We use reasonable technical and organisational measures — including encryption in transit, access controls and reputable infrastructure providers — to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children

The platform is intended for businesses and their adult customers. It is not directed at children, and we do not knowingly collect information from children.

12. Instagram / Meta data

If a customer connects an Instagram account, we access and use Instagram data strictly as described in our Instagram Data Use & Deletion page, in line with Meta’s Platform Terms and Developer Policies.

13. Changes to this policy

We may update this policy from time to time. The “last updated” date shows the current version, and material changes will be notified where appropriate.

14. Contact and complaints

For any privacy question or complaint, contact us at privacy@webculture.au or U5, 47-49 Vicars St, Mitchell ACT 2911. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.