Privacy policy.

Two Fires is a business of NB Performance Pty Ltd, ABN 25 675 763 050. This page explains what Two Fires collects, why, where it goes, and how to get it back or deleted. It describes what our systems actually do today, not what we'd like them to do.

Who we are

Two Fires is based in Sydney, Australia. Questions about privacy go to lightmyfuse@two-fires.com.

What you give us

• The free Snapshot form: your name, email, business name, industry, suburb or region, and website.
• Newsletter sign-up on the blog and podcast pages: your email.
• Buying a Diagnosis: your email and website. Stripe collects your card and billing details directly; we never see or store your card number.
• Running a Diagnosis or a portal tool: the brief you fill in. That can include your product or service, market, region, website, customer description, competitors, testimonials, your offer, goals and channels, plus anything you paste in, such as website copy or writing samples.
• Engine API accounts: your email and your run inputs.
• Emails you send us.

What we collect automatically

• Google Analytics. We use Google Analytics 4, a Google service, to see how people find and use this site. It sets cookies and collects the pages you view, an approximate location from your IP address, your device and browser, how you arrived, and what you did while here. IP addresses are truncated and not stored. This data goes to Google and may be processed outside Australia. Opt out with Google's browser add-on, or read Google's own privacy policy. We still run no advertising pixels and no heatmaps.
• Cookies. The portal sets a login cookie called tf_portal if you log in. It keeps you signed in for up to seven days and does nothing else. Google Analytics sets its own cookies too, described above.
• Browser storage. The portal tools save your name, email, company and brief in your own browser (local storage) so you don't have to type them twice. It stays on your device. Clearing your browser data removes it.
• Server logs. Our hosting provider (Vercel) and our servers record standard request logs, such as IP address, browser type and the page requested, to keep the service running and secure.
• Fonts are served from our own site, not Google's. A few portal tools load a PDF library from cdnjs (Cloudflare), which sees your IP address when they do.

Why we collect it

We collect only what we need to do the job you asked for: produce your Snapshot or Diagnosis, run your portal and API account, take payment, reply to you, and send the newsletter you signed up for. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). When you submit a form or buy something, you consent to us using what you give us for that purpose.

We use your email to send you what you asked for, and occasionally to tell you about Two Fires products. Tell us you'd rather not hear from us and we'll stop.

Who else touches it

We use a small number of service providers. Each one gets only what it needs.

• Anthropic (AI models, United States). Your business details, website address, website text and brief are sent to Anthropic's Claude models to produce your reports, including web searches run on your behalf. We also fetch your public website directly.
• Supabase (database). Everything you submit is stored here.
• Stripe (payments, United States). Receives your email and website with your purchase, and handles your card details.
• Resend (email delivery). Sends your Snapshot, reports, login links and confirmations, which means it handles your email address and the report contents.
• Telegram. We send ourselves internal notifications when someone signs up, requests work or buys, so we can keep an eye on the service. These can include your name, email, business name and website.
• Vercel hosts this website.
• Google (Google Analytics). Receives your truncated IP address, device and browser details, and the pages you view on this website.

We do not sell personal information. We don't rent it, trade it or share it for anyone else's marketing.

Your data leaves Australia

Plainly, most of it is stored and processed overseas:

• Storage: everything you submit is stored in Supabase's Seoul region, in South Korea.
• AI processing: your business details, website content and brief are processed by Anthropic outside Australia, in the United States, to produce your reports.
• Payments: Stripe is offshore and processes your purchase outside Australia.
• Email: Resend is offshore and delivers our emails from outside Australia.
• Alerts: our internal operational alerts, which can include your name, email address and company name, are sent through Telegram, which is also offshore.

Each of these is a cross-border disclosure of personal information under Australian Privacy Principle 8. These providers are not bound by the Australian Privacy Act, and we have no separate contract with them beyond their standard terms. If you'd rather your information didn't go offshore, don't submit it, and email us to have anything already held deleted.

How long we keep it

Plainly: we don't currently delete anything on a schedule. Enquiries, briefs, reports and account records are kept until you ask us to remove them, because your portal history depends on them. Login links expire after an hour.

To see what we hold, get a copy, correct it or have it deleted, email lightmyfuse@two-fires.com. We'll respond within 30 days. Records we're required to keep for tax or payment reasons (such as purchase records) may need to stay for the period the law requires.

Security

Data travels over encrypted connections. Portal access is by emailed login link and each customer sees only their own work. No system is perfect; if something goes wrong that's likely to cause you serious harm, we'll tell you and the regulator as the law requires.

Complaints

If you're unhappy with how we've handled your information, email lightmyfuse@two-fires.com first and we'll respond within 30 days. If that doesn't resolve it, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Changes

If this policy changes, the new version goes here with a new date. If the change is material, we'll tell active customers directly.