Privacy policy

The short version

• Composite Decks Pty Ltd runs this site. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
• You can read the site, compare prices and use the design tool without telling us who you are. Your designs stay in your browser while you work.
• To unlock your free deck pack (materials list, cut list, framing plan and downloads) we ask for your name, email, mobile, suburb and postcode, and three short answers. We check your mobile with a code we text you.
• The free deck pack comes with quotes. To get it, you tick a box that lets us send your details and design to up to 3 local builders or suppliers who serve your area. They pay us for each lead. You can stop the sharing at any time; your pack locks when you do.
• We count visits and the steps people take in the design tool with our own analytics, which no one else sees. We also use Google Analytics to count visits and see how people find the site. Neither records your name or contact details.
• We use the Meta pixel to see whether our Facebook and Instagram ads bring people to the site, and to show our ads to people who have visited (section 8). It never gets your name or contact details.
• We only send you marketing emails if you ask for them. We don't sell your information.
• Some of our service providers store or access information outside Australia (section 9).
• To see or correct your information, or to make a complaint, email info@compositedecks.com.au or call 0468 689 791.

1. About this policy

This policy explains how Composite Decks Pty Ltd ("Composite Decks", "we", "us", "our") collects, uses, shares and protects personal information. We are an online business, so there is no shop or office to visit.

It covers:

• our website, www.compositedecks.com.au, including the deck design tool;
• the merchant portal;
• the emails and text messages we send; and
• our social media accounts.

Personal information is information or an opinion about you that identifies you, or that could reasonably be used to identify you. Your name, email address and phone number are examples. Your deck design can also be personal information once it is linked to you.

2. What we collect

What we collect depends on what you do on the site.

When you...	We collect	Why
Visit the site	Our own server logs record the page you asked for and the time, not your IP address. Our own analytics records the pages you view and the steps you take in the design tool, against a random ID kept in your browser (section 8). Google Analytics records the pages you view and how you reached the site, against a random ID in a cookie (section 8). The Meta pixel tells Meta which pages you view and whether you unlock a deck pack, against a random ID in a cookie (section 8). Our hosting and security providers (Fly.io and Cloudflare) see your IP address, browser and device type to deliver and protect the site.	To run and secure the site, to see where it is hard to use, and to measure and show our ads on Facebook and Instagram.
Use the design tool	Your design: its shape, sizes, levels, products, colours and framing choices, and your state and postcode if you enter them. This is saved in your browser. Site-plan images you add as a tracing layer stay on your device and are never sent to us. To show prices, the design's shape and materials (never your personal details) are sent to our server.	To work out your plan, materials list and prices for your state.
Share a design with a share link	Nothing. The whole design is written into the link itself, so anyone with the link can open it, and we don't store a copy.	So you can show your design to someone else.
Describe your deck in words, or upload a sketch or plan	The words you type, or the photo or plan file you upload, plus any notes, a known length and your state. We remove location and camera data from photos. We send the words, or a smaller copy of the image, to our AI provider (section 9) to read the deck's shape.	To turn your description, sketch or plan into a starting design you can change.
Unlock your deck pack	Your name, email, mobile (verified by a code we text you), suburb and postcode, and your answers to three questions: whether a builder or you will build it, whether you already have a builder, and whether you need council approval. A copy of your design and materials list, saved on our servers. The boxes you tick, the exact wording you agreed to, when you agreed, a scrambled (hashed) form of your IP address and your browser details.	To give you your free deck pack, check you are a real person, and send your request to up to 3 local builders or suppliers (section 5). Also to contact you about this deck, and to improve our tools and pricing.
Buy renders	Your email address, what you bought, the price, the date and a copy of the design you ordered renders of.	To make and deliver your renders, handle refunds and keep tax records.
Buy a "deck on my house" picture	The photo of your house you upload, and where on it you mark the back door and the deck. We remove the hidden camera data (including any GPS location) from the photo as soon as it arrives. Your email address, what you bought, the price and the date.	To put your deck design onto your photo. The photo and your design are sent to our AI providers to make each picture (section 9); your contact details are not.
Write a review	Your display name, email, rating, title, review, any pros and cons, the product and colour, your state and (if you give it) postcode, whether you installed it yourself, how long it's been installed, and any connection to a brand or seller or reward for writing that you tell us about. A scrambled (hashed) form of your IP address and your browser details.	To check and publish your review, contact you about it and stop spam.
Write a comment	Your display name, email, comment and (if you give it) your state.	To check and publish your comment and contact you about it.
Contact us	Your email address and message through the contact form; your email address and anything you send if you email us; your phone number and what you tell us if you call or text.	To reply to you and act on what you tell us.
Report an image	The reason, any details you add and (if you give it) your email address.	To act on your report and reply to you.
License your photos to us	Your name, email (if you give it), how you want to be credited, who took the photos, the photos, the boxes you ticked (including whether we may use your photos as reference images for AI renders), the licence version you accepted, the date and time, and a scrambled (hashed) form of your IP address and browser details.	To keep a record of your permission and show your photos with credit.
Work for a business that uses our merchant portal	Your work email, your role and your sign-in records. For the business: its legal and trading names, ABN and the ABN Lookup result, website, contact email, locations (address and phone), service areas, products stocked, any trade offer, weekly capacity, billing details, account history, and when it accepted our terms.	To run merchant accounts, send requests, bill businesses and meet our legal duties.

Sensitive information. We don't ask for sensitive information, such as health information, religious beliefs or racial origin. Please don't include it in reviews, comments or messages. If you do, we may remove it.

Payment details. Card payments are handled by Stripe. We never see or store your full card number.

3. How we collect it

We collect personal information:

• from you, when you fill in a form, send us an email, call or text us, or upload photos;
• automatically, through server logs, our own analytics, Google Analytics, the Meta pixel, your browser's storage and our bot check (section 8);
• from builders and suppliers. If a business receives your request, it may tell us whether it contacted you, whether it quoted and whether you went ahead. We use this to work out fees and to invite you to review;
• from public sources. For businesses, we check the ABN Lookup register. When we look for deck photos to feature, we note the public social media handle and link of the person who posted them, so we can ask their permission;
• from our service providers, such as payment confirmations and message delivery reports; and
• from other people, for example if someone mentions you in a review or report.

4. How we use it

We use personal information to:

• run the design tool and show indicative prices for your state;
• give you your deck pack, and send your request to up to 3 local builders or suppliers (section 5);
• contact you about your deck pack request, by SMS or email;
• make and deliver renders, process refunds and keep tax records;
• work out what businesses owe us, and handle disputes;
• ask you to review the products you used, once your project is done (section 7);
• check, publish and moderate reviews and comments;
• send marketing emails, only if you asked for them;
• reply to your enquiries;
• prevent spam, fraud and misuse, and keep our systems secure;
• improve our tools and pricing, using designs and answers with your contact details removed;
• see how people use the site and the design tool, so we can make them easier to use (our own analytics and Google Analytics, section 8);
• see whether our Facebook and Instagram ads work, and show our ads to people who have visited the site (the Meta pixel, section 8); and
• meet our legal duties and deal with disputes.

We don't sell your information, and we don't let other businesses advertise to you with it. The Meta pixel (section 8) is how we advertise our own site on Facebook and Instagram. Builders and suppliers pay us for each request we send them as part of the free deck pack, and you can stop that sharing at any time (section 5). We aren't paid for your personal information in any other way.

5. Sharing your request with builders and suppliers

The free deck pack comes with quotes. To get it, you tick the box "Share my design and contact details with up to 3 local builders or suppliers so they can quote. This is part of the free deck pack." We then send your name, mobile, email, suburb, design, materials list and your answers to up to 3 builders or suppliers who serve your area and who pay us for each lead. They may call, SMS or email you about quoting this deck.

Sharing is part of the pack. The box never starts ticked: you tick it yourself, and we keep a record of that. Without it there is no pack, and we collect nothing: you keep the free drawing, 3D view, colours, area and price band without telling us who you are. Marketing emails are never part of the deal; they have their own optional box (section 7).

Nothing is sent until your mobile is verified. We text a code to the number you give, and only send your request after you enter it.

If nobody serves your area yet. We only send your request to businesses that serve your area. If none has joined us yet, nothing is sent until one does, and we'll text or email you when it does.

Who receives it. A person on our team picks up to 3 businesses that serve your area (section 10). Every business that receives requests must have an active ABN, which we check, and must accept our merchant terms first. Those terms say it must:

• use your details only to quote for this deck;
• not sell or pass on your details;
• not add you to a marketing list without asking you first;
• stop contacting you if you ask; and
• delete your details if you stop the sharing or ask it to.

Builders and suppliers are separate businesses. Once one has your details, it is also responsible for how it handles them.

Changing your mind. You can stop the sharing at any time: open your deck pack and choose "Change my mind", or email or call us. We then stop sending your request, tell any business that already has your details to stop contacting you and delete them, and remove your contact details from the request within 5 days (section 12). Because sharing is part of the pack, your pack locks when you stop it.

Consent records. For each consent, we keep a record of the exact wording you saw, when you gave it, when you confirmed your mobile, and when you withdrew it. We keep it so we can prove what you agreed to.

6. Who else we share information with

We also share personal information with:

• service providers who help us run the site: hosting, storage and backups, content delivery and security, email and SMS delivery, payments, site analytics and AI image generation. They may only use it to provide their service to us (section 9);
• Meta, through the Meta pixel (section 8): which pages you view and whether you unlock a deck pack, never your name or contact details. Meta also uses this under its own privacy policy, for example to choose the ads you see;
• professional advisers, such as our lawyers, accountants and insurers, when we need their advice;
• government agencies, courts or police, when the law requires or allows it;
• a buyer of our business, if we sell it. The buyer must protect your information in the same way; and
• anyone you ask us to share with.

Public information. If you post a review or comment, we publish your display name, your state, your review or comment, your rating and any photos. We never publish your email, phone or postcode. If you license photos to us, we publish the credit line you choose.

We never give reviewers' contact details to brands, builders or suppliers.

7. Marketing, and messages that aren't marketing

Marketing emails. We only send you marketing emails if you tick the box "Email me news, guides and price updates from Composite Decks. I can unsubscribe at any time." The box is never ticked for you, and you don't need to tick it to get your deck pack. Every marketing email says it's from Composite Decks and has an unsubscribe link. When you unsubscribe, we stop straight away, and always within 5 working days. You can also ask us at any time to stop using your information for marketing, or where we got your information.

Messages that aren't marketing. If you unlock a deck pack or buy renders, we text or email you about that request or order: your verification code, links to your pack or order, and updates about your request. These continue while your request or order is open.

Review invitations. About 30 days after your project is finished, we may email you once to ask you to review the products you used, whatever you chose and however it went. The link works for 60 days, and you can use it to tell us not to ask again.

8. Cookies, browser storage and embedded content

• Your state. If you set your state or postcode, a cookie remembers your state for up to a year, so prices show for your state.
• Your designs and requests. We use your browser's storage to save your designs on your device. It also keeps what you've typed into the deck pack form while the tab is open, the key that opens your deck pack (for up to a year), links to your orders, and a house photo you've picked but not yet paid for. You can delete all of this by clearing this site's data in your browser.
• Sign-in. Merchant and staff accounts use a cookie to keep you signed in (up to 7 days, or 12 hours for staff).
• Our own analytics. We count visits and the steps people take in the design tool (for example "picked a board" or "opened the deck pack page"), so we can see where the site is hard to use. It runs on our own servers. We don't share it with anyone or use it for advertising. It uses a random ID kept in your browser's storage (not a cookie) to tell one visit from the next. With each step it records the page, the time, the website that sent you (for example a search engine), your device type, browser, operating system and country, and your state if you set it. It never records your name, email, mobile, postcode, IP address, anything you type into a form, or your design's share link. If your browser sends a Global Privacy Control or Do Not Track signal, it records nothing.
• Google Analytics. We also use Google Analytics, run by Google, to count visits, see which pages people read and how they found the site. Google sets cookies whose names start with "_ga", holding a random ID for up to 2 years, so it can tell one visit from the next. With each page it records the page, the time, how far you scroll, links you click to other sites, the website that sent you, your device type, browser, operating system, screen size, language and approximate location. Google works out the location from your IP address; Google Analytics doesn't store the IP address. We send each page's address with the private parts removed, so Google never gets the link to your deck pack or an order, anything you type into a form or search, or your design's share link. We have turned off Google's advertising features (Google signals and ad personalisation), so it isn't used to show you ads. It doesn't run on merchant or staff pages, and if your browser sends a Global Privacy Control or Do Not Track signal, it doesn't load at all. You can also block it with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout).
• Guide view counts. When you open one of our guides, your browser tells our server which guide it was, and we keep only a running total of views per guide per day. We don't record your IP address, browser details or any ID with it, and we set no cookie for it. Your browser's storage notes which guides you've opened in that tab, so a reload isn't counted twice; this stays in your browser. A scrambled (hashed) form of your IP address is held in our server's memory for about a minute, and never saved, so we can stop automated traffic from inflating the totals.
• Meta pixel. We use the Meta pixel, run by Meta (the company behind Facebook and Instagram), to see whether our ads on Facebook and Instagram bring people to the site and lead to deck packs, and to show our ads to people who have visited. It sets a cookie named "_fbp" holding a random ID for up to 90 days, and a cookie named "_fbc" for up to 90 days if you arrive from one of our ads. With each page it sends Meta the page's address, the time, the website that sent you, and your IP address, browser and device details. When you unlock a deck pack it also tells Meta that a deck pack was unlocked, but never your name, email, mobile, postcode, anything you type into a form, or your design. Meta may connect this to your Facebook or Instagram account, and uses it under its own privacy policy, including to choose the ads you see. The pixel sends nothing from a page whose address has a private part, such as the link to your deck pack or an order, a search, or your design's share link. It doesn't run on merchant or staff pages, and if your browser sends a Global Privacy Control or Do Not Track signal, it doesn't load at all. You can also stop Meta using this to choose your ads in your Facebook or Instagram settings, under "Ad preferences" → "Activity information from ad partners".
• Bot checks. The deck pack form and the review and comment forms use Cloudflare Turnstile. It looks at your IP address and technical signals from your browser to tell people from bots.
• SMS codes. When you unlock a deck pack we text a code to your mobile through ClickSend. ClickSend sees your mobile number and the message. We store the code only in scrambled (hashed) form. It expires after 10 minutes or 5 wrong tries.
• Instagram posts. Some brand and product pages show Instagram posts using Instagram's own embed. Up to 3 posts load as you scroll near them; the rest load only if you tap "Load post". When a post loads, your browser connects to Instagram, which is run by Meta. Meta may collect information such as your IP address and browser details, and may set cookies, under its own privacy policy. We don't control this.

9. Service providers, and information held outside Australia

Our site and database are hosted in Sydney, Australia. Some of our service providers store or access personal information outside Australia.

What they do for us	Provider	Where the information may be stored or accessed
Hosting and database	Fly.io	Australia (Sydney). Fly.io is a United States company, and its staff may access it from there.
Content delivery, firewall and bot checks	Cloudflare	Cloudflare's worldwide network, including Australia and the United States
Our email inbox	Google Workspace	United States and other countries where Google operates
Site analytics (receives the pages you view, with the private parts of each address removed, and your browser and device details; never your contact details)	Google (Google Analytics)	United States and other countries where Google operates
Advertising on Facebook and Instagram (receives the pages you view, whether you unlock a deck pack, your IP address and your browser and device details; never your contact details)	Meta (Meta pixel)	United States and other countries where Meta operates. Meta also uses it for its own purposes (section 8).
Email delivery (the emails we send you)	Resend	United States
SMS codes (receives your mobile number and the message)	ClickSend	Australia, with support access from the European Union, the United States and the Philippines
Payments	Stripe	United States and other countries where Stripe operates
Render generation, and reading words, sketches and plans you give the designer (receives images of your design, your sketch or plan, the words you type and, for a "deck on my house" picture, the photo of your house; never your contact details)	Google (Gemini API)	United States and other countries where Google operates. Google keeps what we send for up to 55 days to check for misuse, and doesn't use it to train its models.
Photo reading for a "deck on my house" picture (looks at the photo of your house, the views of your design and photos of the boards first, and writes notes for the picture; receives the same images, never your contact details)	Anthropic (Claude API)	United States

We take reasonable steps, including contract terms, to make sure these providers handle personal information in line with the Australian Privacy Principles.

We only send deck pack requests to businesses in Australia.

10. Automated decisions

We use computer programs to make some decisions. From 10 December 2026, the law requires us to explain decisions that use personal information and could significantly affect you. We explain all the decisions below, whether or not each one meets that test.

Decision	How it's made	Personal information used
Checking that a deck pack request is genuine	A computer program checks the bot check result, that your mobile is an Australian number and that the SMS code matches. It also limits how many codes a mobile can get and how many wrong tries can come from one place. It can refuse a code or a request automatically.	Your mobile number, the code attempts, a scrambled (hashed) IP address and browser details.
Scoring deck pack requests	A computer program gives each request a score, so our staff can see which ones are complete. Only a person can reject a request.	Whether you gave a phone number, whether your email and mobile are confirmed, and how long your notes are.
Spam and abuse checks on reviews and comments	A computer program can block an obvious bot, or hold a review for a person to check. Nothing is published, and no genuine review is rejected, without a person deciding.	The content, the number of links, repeated text, how fast the form was filled in, a scrambled (hashed) IP address and email address, and whether the text appears to contain someone's personal details.
Bot checks	Made by Cloudflare Turnstile.	Technical signals from your browser.

Who receives your deck pack request is decided by a person. Today, someone on our team picks up to 3 businesses that serve your area, using your postcode, state and design. What a business pays us doesn't change who is picked. If we start using a computer program for this, we'll update this section before it applies to you.

Some things these programs do not do:

• They don't set the prices you see. Prices are the same for everyone in your state.
• They don't use sensitive information.

You can ask a person to review a decision about you, and ask us to explain the main reasons for it. Email info@compositedecks.com.au or call 0468 689 791.

11. How we protect your information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These steps include:

• staff sign in with a password and a second check from an authenticator app, and each staff role sees only what it needs;
• we keep audit logs of staff actions;
• we store IP addresses only in scrambled (hashed) form;
• we remove location and camera data from every photo uploaded to the site;
• information is encrypted when it travels between your browser and our servers; and
• we delete or de-identify information when we no longer need it (section 12).

Data breaches. If a data breach is likely to cause serious harm to anyone, we will tell the people affected and the Office of the Australian Information Commissioner (OAIC), as the law requires.

12. How long we keep information

Information	How long we keep it
Deck pack requests where the mobile was never verified	Your contact details are removed after 7 days
Deck pack requests	Your contact details are removed 24 months after the request, once it is closed. The design and postcode may be kept without them
Deck pack requests you withdraw	Your contact details are removed from the request within 5 days. A short record of the consent and its withdrawal is kept for 7 years
SMS verification codes	Stored only in scrambled (hashed) form. Expire after 10 minutes or 5 wrong tries, and deleted within an hour of expiring
Consent records	7 years after the consent ends
Saved designs	Designs saved on our servers don't include your name or contact details. We keep them because orders and requests refer to the exact design you saved
Orders	At least 5 years, as tax law requires
House photos you upload for a "deck on my house" picture	Deleted 30 days after the last picture made from them (or 30 days after upload if no picture was made). Uploading a new photo replaces the old one. The finished pictures stay with your order
Words, sketches and plans you give the designer to read	The words aren't kept once the design is made. Uploaded images are deleted after 24 hours
Reviews and comments you never confirmed by email	Deleted after 7 days
Published reviews and comments	While they're published. Ask us and we'll delete yours
Marketing email list	Until you unsubscribe. We then keep your email address on a "do not email" list so we don't email you again
Analytics (pages viewed and design-tool steps, against a random browser ID)	12 months, then deleted
Google Analytics (pages viewed, against the random ID in its cookie)	Up to 14 months at Google, then deleted
Meta pixel (pages viewed and deck packs unlocked, against the random ID in its cookie)	The cookie lasts up to 90 days. Meta keeps what it receives under its own privacy policy
Contact form messages and emails	24 months after we last hear from you
Copies of emails and texts we send you	24 months after we send them
Photo licences and permission records	As long as we use the photos, plus 7 years
Merchant accounts	While the account is open, plus 7 years

13. Seeing and correcting your information

You can ask for a copy of the personal information we hold about you, or ask us to correct it. Email info@compositedecks.com.au or call 0468 689 791.

• We may need to check who you are before we act.
• We aim to respond within 30 days.
• It's free to ask. If giving you access involves a lot of work, we may charge a reasonable fee for that work. We'll tell you the amount first.
• If we refuse a request, we'll tell you why in writing and how to complain.
• If we correct information we've already sent to a builder or supplier, we'll tell that business if you ask us to.
• If we don't agree that the information is wrong, you can ask us to attach a note saying you think it is.

14. Staying anonymous

You can read our pages, compare prices and use the design tool without telling us who you are. You can post reviews under a display name instead of your real name. We need your contact details to give you a deck pack, sell renders, publish your photos with permission or reply to you.

15. Children

The site is for adults planning a deck. You must be 18 or over to unlock a deck pack, buy renders, post reviews or comments, or license photos to us. If we learn that we hold a child's personal information, we will delete it.

16. Serious invasions of privacy

Since 10 June 2025, Australian law has let people take court action over a serious invasion of their privacy, such as a serious misuse of their personal information.

We design the site to prevent misuse:

• we only send your details to builders or suppliers through the free deck pack, with a box you tick yourself, and you can stop that at any time;
• we hold reviews and comments that include someone's personal details;
• we remove location data from uploaded photos; and
• our merchant terms say businesses can only use your details to quote for your deck.

If you think we, or a business that got your request, have misused your information, tell us straight away. We'll act quickly, including removing content and following up with the business.

17. Complaints

If you have a privacy complaint, email info@compositedecks.com.au or call 0468 689 791. Tell us what happened and what you'd like us to do.

We'll acknowledge your complaint within 2 working days and aim to give you a full response within 30 days.

If you're not happy with our response, or we haven't responded within 30 days, you can complain to the Office of the Australian Information Commissioner:

• website: www.oaic.gov.au
• phone: 1300 363 992

18. Changes to this policy

We'll post any changes here with a new "last updated" date. If a change affects how we share your deck pack request, we'll ask for your consent again before it applies to you.

19. Contact us

• Privacy officer: Clyde Macababbad, Founder
• Business: Composite Decks Pty Ltd, an online business with no shop or office to visit
• Email: info@compositedecks.com.au
• Phone: 0468 689 791