Privacy policy.

Black Shard is a privately held Australian software engineering and cybersecurity firm with its head office in Brisbane. This privacy policy applies to blackshard.com.au and its subdomains.

We collect only what you give us. The two routes are:

• Contact form submissions: name, email, organisation if you give one, the track you selected, and the brief you write. We log the request timestamp and your browser user-agent string for spam resistance, and the ad click id if you arrived from a Google ad.
• Direct email: anything you send to info@blackshard.com.au arrives at our mailbox and is handled like ordinary correspondence.

Separately from that, the site measures its own traffic. Google Analytics runs on every page. Google Ads measurement runs only if you choose Allow on the notice that appears on a first visit. The next section names every cookie either one sets, and carries the control that changes your choice.

Two Google tags run here: Google Analytics on every page, and Google Ads measurement on consent. This is what each choice does.

Set on every visit, whatever you choose

• _ga and _ga_0T7T59W6WH: Google Analytics. They let Analytics tell one browser from another, so a returning visit is not counted as a new person. Set on blackshard.com.au itself. They last about 13 months, and some browsers cut that down further on their own.

Through those, Analytics records the pages you look at, the site or search you arrived from, coarse location and device detail worked out from your IP address, clicks on our phone and email links, and the fact that a form on the page was submitted. It does not receive your name, your email address or anything you type into the contact form, and we do not attempt to identify anyone from it.

If you choose Allow

• _gcl_au: ties the visit to a Google Ads campaign so a conversion can be attributed to it. Set on blackshard.com.au, 90 days.
• _gcl_aw: holds the click id from the ad you arrived on, so an enquiry can be credited to that ad. Set only when you arrive from a Google ad. Set on blackshard.com.au, 90 days. Google keeps the same click id in this browser under _gcl_ls in local storage.
• Google sets its own cookies on its own domains at the same moment: GCL_AW_P on google.com, googleadservices.com and doubleclick.net, plus a short-lived test_cookie on doubleclick.net. Those are Google’s cookies under Google’s terms.
• IDE on doubleclick.net: Google’s advertising identifier, up to about 13 months. Allow turns on ad personalisation, so the visit joins our Google Ads audience and our ads can reach you again on other sites Google serves. This is the one part of Allow that is not only measurement.

If you choose No thanks

Nothing beyond the two analytics cookies is set. The ads tag still runs and Google still receives a pageview signal from it, with no cookie read, none written, and no advertising identifier attached. That is Google Consent Mode in its denied state, and it is also what happens before you choose anything.

Where the choice is kept

Your answer is stored in this browser under bs_ads_consent in local storage, not in a cookie. That is why the notice does not come back, and why the choice does not follow you to another browser or another device.

The ad click id and the contact form

If you arrive from a Google ad, the click id in that link is kept in this browser for up to 90 days, in local storage under bs_gclid. This happens whatever you choose, because it is our own storage rather than a Google cookie, and nothing leaves the browser unless you send us something. If you send the contact form within that window, the click id goes with it so we can tell Google Ads that the click became an enquiry. That id is the only part of a submission that ever reaches Google. Your name, your email address, your organisation and your brief go to us and stay with us. Clearing your browser’s site data, or waiting longer than 90 days to get in touch, simply means the enquiry isn’t attributed. The form itself is unaffected either way.

When a brief is sent

The confirmation page you land on after sending a brief tells Google Ads that a brief was received. That signal carries the fact it happened and the title of the page it happened on. It carries nothing you wrote: not your name, not your email address, not a word of the brief. It is sent whatever you choose here. Under No thanks it goes with the refusal attached, so nothing is read out of your browser for it and nothing is stored in your browser by it. Under Allow it is one of the points where the ads cookies above are written.

Changing your mind

Use the control below. It applies on the spot, with no reload and no form to fill in.

Clearing site data for blackshard.com.au in your browser settings removes the cookies, the stored choice and the click id together, and the notice appears again on your next visit. Google runs its own controls across every site it serves ads on, at My Ad Center.

Submissions are routed to the Black Shard mailbox so someone can contact you as soon as possible. We do not sell, rent, or share contact submissions with any third party. The two exceptions are named in the cookies section, and both are about crediting an ad rather than about you: Google Ads is told that a brief was received, and where the enquiry came from a Google ad the click id goes back so the click can be matched to it. Nothing else from a submission travels with either. We retain correspondence for as long as is needed to respond and meet our record-keeping obligations.

The site is served through Cloudflare, in front of a server we run ourselves in Microsoft Azure’s Australia East region. Email is handled by Microsoft 365 on the blackshard.com.au tenant. Form submissions are delivered by Microsoft Graph straight into that same Microsoft 365 mailbox, so no third-party email processor sits in the path. Google receives the measurement set out in the cookies section and nothing else: a brief you send goes to our Microsoft 365 mailbox, never to Google.

You can request a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Email info@blackshard.com.au with the request. We respond within 30 days, in line with the Australian Privacy Principles under the Privacy Act 1988.

If you are unhappy with how we have handled your data, you can complain to us first. If we cannot resolve it, you can complain to the Office of the Australian Information Commissioner (OAIC).

When we update this policy, the "last updated" date at the top of the page changes. Material changes get an explicit note alongside that date.