Privacy & Cookie Policy

Paid with Clarity is a sole practice run by Gil Levit, based in Perth, Western Australia. I operate this website and am the data controller for personal data collected through it — there is no wider team, so any privacy question comes to me directly at levit.gil@gmail.com.

When you submit the contact form. Your name, email address, company, the budget range you pick, and your message.

When you book a Clarity Call. Your name, email address, and the time and length of the meeting you chose. The scheduler itself is a HubSpot booking widget embedded on the page, so HubSpot receives what you type into it.

Campaign attribution, with either of the above. The campaign tags in the link you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content), advertising click identifiers (Google's gclid, gbraid and wbraid, Meta's fbclid, LinkedIn's li_fat_id, Microsoft's msclkid), the site that referred you, and the first page you landed on. Two sets are recorded: the first page of your visit, and the page you submitted from. This is how I tell which advertising actually produces enquiries rather than clicks.

Your consent choice, with a submission. Whether you had accepted or declined analytics and advertising cookies at that moment, when you chose, and which version of this policy was in force. It's stored because of the next paragraph.

Where advertising click identifiers can end up. If an enquiry becomes a client, I may send the click identifier recorded above back to Google Ads as an offline conversion, so the platform learns which clicks produced real business rather than just forms. What goes back is the click identifier, a conversion name and a time — never your name, email address or message. This only happens for enquiries collected while advertising consent was granted, which is why the consent state is stored alongside the identifier rather than being assumed later. If you'd rather this didn't happen to your enquiry, email me and I'll exclude it.

Technical data, with a submission. Your IP address and browser user-agent, stored alongside the enquiry and used to rate-limit submissions and filter spam.

Analytics and advertising measurement. Only once you accept — see below.

I don't ask for, and have no reason to hold, government identifiers, payment card numbers, or any of the sensitive categories of information defined by the Privacy Act 1988 or Article 9 of the GDPR.

Nothing in the table below is set for advertising or analytics until you choose “Accept” in the consent banner. You can change your mind at any time using Cookie settings in the footer.

How the consent signal works. This site uses Google Consent Mode v2. Before you choose, all four Google consent signals — analytics storage, ad storage, ad user data and ad personalisation — are set to denied, advertising click identifiers are redacted, and campaign IDs are passed in the URL rather than written to a cookie.

One thing worth being straight about. Consent Mode operates in its “advanced” form here, which means Google's tag loads with everything denied rather than not loading at all. Before you choose, it still reports basic events to Google — a page view, and whether you scrolled. Those are sent cookieless: no cookies are written, no advertising identifiers are attached, your IP is redacted, and they are flagged as non-personalised. It is not nothing, so I'd rather state it than let “nothing loads until you accept” do work it can't quite support.

Where those requests go. Analytics requests are served through this site's own domain (a Google tag gateway running on Cloudflare) rather than being sent directly to a Google address by your browser. The data still reaches Google Analytics and the consent rules above still govern it — but it means these requests come from paidwithclarity.com, so they aren't stopped by tracker-blocking lists that work by blocking Google's domains.

If — and only if — you accept advertising cookies, then when you submit a form your email address is converted into a one-way SHA-256 hash inside your browser and only that hash is sent to Google, so an enquiry can be matched to the ad that produced it. The hash cannot be reversed back into your address, and your actual email address is never sent to Google for this purpose. Decline advertising cookies and none of it happens; the form behaves identically either way.

Note that the Meta and LinkedIn click identifiers described above are stored in my own records for attribution, but no Meta, LinkedIn or TikTok tracking pixel runs on this site — nothing is sent to those companies.

• To answer your enquiry and take steps you've asked for before any engagement — performance of a contract or steps prior to it, and my legitimate interests in running the practice.
• For analytics and advertising measurement — your consent, freely given and withdrawable at any time.
• For security, rate limiting and spam prevention — legitimate interests in keeping the site usable.
• To keep business and tax records — compliance with a legal obligation.

No decision affecting you is made by automated processing or profiling, and I don't sell personal information or share it with data brokers.

These are the only third parties that receive personal data from this site, each under a data processing agreement:

• Supabase — the database where enquiries and bookings are stored. Hosted in the EU (Frankfurt, eu-central-1).
• HubSpot — the booking scheduler embedded on the contact page, and the CRM where enquiries are synced so I can follow them up.
• Resend — sends the notification to me and the confirmation email to you.
• Cloudflare — hosts and serves the site, and filters malicious traffic. Your IP address is visible to Cloudflare as part of delivering any page.
• Google — Analytics and Ads measurement, via Google Tag Manager. Cookies and anything identifying you are set only after you consent; the limited cookieless reporting described above happens before that.

I'm in Australia, the database is in the EU, and some providers process data in the United States. Where personal data moves between those regions I rely on the safeguards in each provider's data processing agreement, including the European Commission's Standard Contractual Clauses where they apply. Under Australian Privacy Principle 8 I remain accountable for what these providers do with data I pass to them.

• Enquiries that don't become clients — deleted within 24 months of our last contact.
• Client records — kept for at least five years after the engagement ends, which is the retention the Australian Taxation Office requires for business records.
• Analytics data — retained by Google Analytics for 14 months from your last visit, and holds no name or email address.

Ask me to delete your data sooner and I will, unless a law requires me to keep it.

Being straight about the mechanism: these periods are enforced by a scheduled job that runs weekly, not by me remembering. It also strips the technical data above — IP address and user-agent — from every enquiry after 90 days, well inside the 24-month window, because that data has a short useful life and is the most identifying material held on people who never became customers. Each run records what it deleted, so the policy can be shown to have been applied rather than merely stated.

The site is served only over HTTPS with HSTS, a content security policy, and the usual hardening headers. Enquiry data sits in an access-controlled database with row-level security, credentials are held as secrets rather than in the codebase, and access is limited to me. No system is perfect, and I won't claim otherwise — but if a breach ever affected your data, I'd notify you and the OAIC as the Notifiable Data Breaches scheme requires.

That last claim was not true of one file until August 2026: an administrator password had been committed to this site's private source repository in May. No enquiry data was involved and the repository was never public, but the credential has been rotated, the file purged from the repository's history, and the practice that allowed it stopped. I'd rather you read that here than not at all — a security page that only lists the things that went right isn't worth much.

I handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you're in the EU, EEA or UK, the GDPR applies too. Subject to the applicable law you can ask me to give you a copy of what I hold, correct it, delete it, restrict or object to how it's used, provide it in a portable format, or withdraw a consent you previously gave.

Email levit.gil@gmail.com and I'll respond within 30 days — usually far sooner, since it's just me reading it. I won't charge you for making a request and won't treat you differently for having made one.

If you're unhappy with how I've handled it, you can complain to the Office of the Australian Information Commissioner or, in the EU/EEA/UK, to your local data protection authority.

This site sells business services and isn't directed at children. I don't knowingly collect data from anyone under 16. If you believe a child has sent me personal data, email levit.gil@gmail.com and I'll delete it.

I'll update this page when what the site does changes. The “last updated” date above always reflects the current version, and I'll describe anything material rather than quietly revising the text.

Questions about any of this, or about the tracking setup more generally: levit.gil@gmail.com.