Privacy Policy

1. About this policy

This Privacy Policy explains how we collect, use, store, and disclose personal information. We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). If an exemption applies to a business of our size, we choose to follow the APPs anyway.

2. About Tharlizwa Media

• “Tharlizwa Media”, “we”, “us”, and “our” refer to Naing Win, trading as Tharlizwa Media, ABN 96 996 282 647, a sole trader based in Queensland.
• “You” and “your” refer to anyone whose personal information we handle under this policy.
• “Website” means tharlizwa.com.au and its subdomains, including mobile.tharlizwa.com.au.
• “Services” means our web design, website development, redesign, maintenance, SEO, digital marketing, advertising, and related professional services.
• “Software Products” means the WordPress plugins, Android and other mobile apps, companion apps, software tools, APIs, updates, and documentation we release.
• “Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined in the Privacy Act.

3. Who this policy covers

• Website visitors and people who send enquiries
• Clients and prospective clients
• Businesses that use our WordPress plugins (Site Owners)
• Authorised staff who use our apps for a Site Owner (Authorised Users)
• People who contact us for support
• Users of future Software Products that link to this policy

Note: Site Owners run their own WordPress websites. Personal information that a Site Owner publishes or stores on its own website, including content submitted through our Software Products, is controlled by that Site Owner. It is covered by the Site Owner’s own privacy policy, not this one.

4. Information collected through our website

• Enquiry and quote forms: Name, business name, email address, phone number, and the details you include in your message.
• Communications: Emails, phone notes, and support correspondence.
• Technical information: IP address, browser and device type, pages visited, the referring page, and timestamps. Our hosting and security systems record these automatically.
• Cookie and analytics information: See section 6.

You can browse our Website without identifying yourself. If you want us to reply or quote, we will need your contact details.

5. Client and service information

When you engage us for Services, we may collect information needed to:

• prepare quotes and proposals and manage projects
• register or manage domains and hosting on your behalf
• carry out SEO, advertising, and marketing work, which may include access to your analytics, advertising, or search console accounts
• invoice you, process payments, and keep business and tax records
• provide support and maintenance, and administer our agreement
• meet our legal obligations

Where you give us access to your systems (for example, a WordPress login or Google account access), we use it only for the agreed work. Please remove our access when the work is finished.

6. Cookies, analytics, and embedded services

• Essential: Make the site work (e.g., page loading, forms, and shopping cart) — Used on our Website: Yes
• Security: Spam and abuse prevention, firewall — Used on our Website: Yes (Security plugin / firewall)
• Analytics: Understand how visitors use the site — Used on our Website: Yes (Statcounter)
• Preference: Remember your settings — Used on our Website: Yes

You can block or delete cookies in your browser settings. Some features may not work properly if you do. These cookies are used on our own Website only. Our Software Products do not place Tharlizwa Media cookies on Site Owners’ websites.

7. WordPress plugin privacy

Recent Car Removals by Tharlizwa Media runs inside the Site Owner’s own WordPress installation:

• Vehicle entries, details, images, and settings are stored in the Site Owner’s WordPress database and media library, not on our systems.
• The plugin does not send usage data, telemetry, site URLs, or diagnostics to Tharlizwa Media.
• Plugin updates are delivered through the WordPress.org plugin directory.
• The plugin contacts our server only during the app connection process described in section 10, and that contact comes from the user’s browser, not from the plugin.
• The Site Owner controls what is entered and published, who has WordPress accounts, how long content is kept, deletions, backups, and the privacy notice on its own website.

8. Android app privacy

The Recent Car Removals Android app is a business-to-business (B2B) tool for Authorised Users: staff and operators whom a Site Owner has authorised. It is not intended for the general public, and it does not create a Tharlizwa Media account.

• Connected website address: Stored on the device; not received by Tharlizwa Media.
• WordPress username: Stored on the device; not received by Tharlizwa Media.
• Application Password: Stored securely in encrypted device storage; not received by Tharlizwa Media (see section 10).
• Vehicle details & photographs: Sent directly to the Site Owner’s website; not received by Tharlizwa Media.

Since version 1.3.2, the app does not collect purchase prices or other financial details. Site Owners manage that information in their own WordPress dashboard.

9. Camera, photos, and media

• Camera: The app asks for camera access the first time an Authorised User chooses to take a vehicle photo using the system camera. It is used only to photograph vehicles for submission.
• Selecting photos: The app uses the Android system Photo Picker, which shares only the photos you choose and needs no broad media-library permission.
• Permissions: Permissions are optional. If you decline, you can still use parts of the app that do not require them, and you can change permissions at any time in Android settings.
• Metadata handling: The app removes location metadata (GPS/EXIF data) before upload.

10. Website connection and authentication

The app never asks for the primary WordPress login password of the Authorised User or the Site Owner. It connects using a WordPress Application Password—a separate credential generated by WordPress that the Site Owner can revoke at any time.

During connection, the credential passes through our routing address (mobile.tharlizwa.com.au) within the URL fragment (a part of the web address that browsers never send to web servers). Tharlizwa Media’s servers never receive Application Passwords, usernames, or administrator passwords. All connections use HTTPS. Raw server logs on our routing subdomain are automatically deleted after 30 days.

11. Where app data goes

Vehicle details and photos travel from the device directly to the Site Owner’s self-hosted WordPress website through the WordPress REST API over HTTPS. Tharlizwa Media does not receive, host, access, or monetise this content.

12. Support and diagnostic information

If you ask for support, you may choose to send us screenshots, error messages, or logs. Please never send your primary WordPress password or an Application Password, and remove personal information (such as customer details or number plates) from screenshots where possible.

13. How we use personal information

• providing the Services and Software Products you request
• operating and securing our Website and servers
• responding to enquiries and providing support
• diagnosing errors and improving compatibility
• quoting, invoicing, and processing payments
• sending service, security, and material product notices
• preventing misuse and fraud
• meeting our legal, tax, and accounting obligations

We send marketing messages only with your consent, and every message includes an unsubscribe option under the Spam Act 2003 (Cth).

14. Disclosure to service providers and others

We do not sell personal information. We may disclose it to:

• hosting and server providers (e.g., VentraIP Australia)
• email and communication providers
• payment providers and banks
• analytics providers (Statcounter)
• security and spam-prevention providers
• professional advisers, such as accountants and lawyers
• government agencies, courts, or law enforcement, where required by law

15. Overseas processing

Some of our service providers may store or process information outside Australia. Where required by the APPs, we take reasonable steps to ensure overseas recipients handle personal information consistently with Australian standards.

16. How long we keep information

• Enquiries that do not proceed: Up to 24 months, then deleted.
• Client and project records: For the duration of the engagement and a reasonable period afterwards for support and dispute purposes.
• Invoices, billing, and tax records: At least 5 years as required by tax law.
• Support communications: As long as reasonably needed to resolve the matter.
• Server logs (mobile.tharlizwa.com.au): 30 days.

When we no longer need personal information, we take reasonable steps to destroy or de-identify it.

17. Deletion and disconnection

• In the app: Disconnecting or clearing app data removes stored connection details from your device, but does not delete content already submitted to your website.
• In WordPress: Revoking an Application Password in your WordPress profile (Users → Profile → Application Passwords) instantly blocks that device or user from submitting further entries. Deleting vehicle entries or media is managed directly by the Site Owner.

18. Security

We take reasonable steps to protect personal information using HTTPS across all systems, restricted access controls, multi-factor authentication, and credential hand-offs designed to keep passwords off our servers. If a data breach occurs that is likely to cause serious harm, we will notify affected individuals and the OAIC.

19. Access and correction

You can ask for access to, or correction of, the personal information we hold about you by emailing info@tharlizwa.com.au. To access or remove vehicle records published on a specific business website, contact that business directly.

20. Complaints

If you have a privacy complaint, email info@tharlizwa.com.au. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

21. Children

Our Services and Software Products are designed for businesses and authorised adult staff, not children. We do not knowingly collect children’s personal information.

22. Future plugins and apps

This policy may cover future Tharlizwa Media Software Products that link to it. Where a product notice is more specific, that notice takes precedence.

23. Changes to this policy

We will publish any updated version at this address with a revised “Last updated” date. Material changes will be communicated via release notes or the plugin dashboard where practical.

24. Contact us

Naing Win, trading as Tharlizwa Media
ABN: 96 996 282 647   |   Slacks Creek, Queensland 4127
Email: info@tharlizwa.com.au   |   Phone: 0432 416 759