Drochaid

Legal

Privacy policy

Last updated: 14 July 2026

Draft — pending review by our legal advisers. If anything here is unclear, or you want to know how your information is handled before it is finalised, email hello@drochaid.com.au.

Who we are

Drochaid Pty Ltd (“Drochaid”, “we”, “us”) operates this website at www.drochaid.com.au, covering our NodeZero partner business, our Emesent reseller business and our consulting practice. This policy explains how we collect, hold, use and disclose personal information, and how to contact us about it. We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and — for individuals in New Zealand — the New Zealand Privacy Act 2020 and its Information Privacy Principles.

What we collect

We collect personal information you give us directly through this site:

  • Demo requests. When you book a demo we ask for your name, work email address, company, industry, role, what is prompting your interest, the compliance frameworks you need to meet, your location, and any notes you choose to add.
  • Compliance kit requests. When you request a coverage kit we ask for your name, work email address, company and the framework you are interested in.
  • Correspondence. If you email us, we keep the correspondence and your contact details.

We also collect limited technical information automatically. Our hosting provider records standard server logs (including IP address, browser type, and pages requested). Our analytics provider, PostHog, records the pages you view, how far you read, the links and buttons you interact with, and the campaign or referring site that brought you here. To do this it stores a cookie and a local identifier in your browser, which lets us recognise a returning visitor across visits. We do not track you across other websites, and we do not sell or share this information with advertising networks.

PostHog also records a replay of your visit — the pages, scrolling and clicks — so we can see where the site is confusing. Everything you type is masked before it leaves your browser: form fields are never captured, so your name, email, company and any notes you write do not appear in a replay. If you submit a form, we associate your analytics history with the email address you provided, so we can understand which pages led to your enquiry and prepare for our first conversation. Browsing alone never creates a profile.

PostHog processes this data on our behalf on infrastructure in the United States. We retain session recordings for 30 days; other analytics data is kept for as long as it remains useful for the purposes described above, then deleted or de-identified. If you would rather not be included, enable “Do Not Track” or a tracking blocker in your browser, or email us at hello@drochaid.com.au and we will exclude you.

How we use it

  • to respond to your demo request or enquiry and tailor the first conversation;
  • to email you the compliance kit you asked for, via personalised download links;
  • to keep a record of your enquiry in our customer relationship management system;
  • to send you product news and updates, only if you opted in — every marketing email includes an unsubscribe link, consistent with the Spam Act 2003 (Cth) and the NZ Unsolicited Electronic Messages Act 2007;
  • to understand how the site is used and improve it.

Who we disclose it to, and overseas disclosure

We do not sell personal information. We disclose it only to the service providers that run this site’s infrastructure, each acting on our instructions:

  • Attio (customer relationship management) — stores lead records (name, email, company and your enquiry details). Hosted in the United States.
  • Resend (email delivery) — processes the emails we send you, including kit downloads and internal notifications. Hosted in the United States.
  • PostHog (analytics) — processes the analytics events described above. Hosted in the United States.
  • Vercel (website hosting) — serves the site and keeps standard server logs, using a global edge network with primary infrastructure in the United States.

Because these providers are located overseas (principally the United States), submitting a form on this site involves disclosure of your personal information to overseas recipients as described in APP 8. We take reasonable steps to ensure these providers handle personal information consistently with the APPs. If a NodeZero demo or engagement proceeds, we may also share your business contact details with Horizon3.ai, Inc. (the maker of NodeZero) or Emesent Pty Ltd where that is necessary to deliver what you asked for — we will tell you before we do.

Storage and security

Kit download links emailed to you are personalised: each link contains a signed token tied to your email address and expires after a limited period (30 days by default). This site stores small functional flags in your browser’s local storage (for example, that you have already requested a particular kit, and your light/dark theme preference) — these are functional only and are not used for tracking. We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure.

Access, correction and complaints

You can ask for access to the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@drochaid.com.au. If you have a complaint about how we have handled your personal information, contact us first and we will respond within a reasonable period. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).

Data breaches

If a data breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme, and the New Zealand Privacy Commissioner where the NZ Privacy Act 2020 applies.

Retention

We keep personal information for as long as it is needed for the purposes above — for lead records, while your enquiry or our relationship remains active — and then take reasonable steps to delete or de-identify it.

Changes to this policy

We will update this page when our practices change, and change the “last updated” date above. Significant changes to how we handle information already collected will be notified to affected people directly where practicable.