Claim ticket No. 0001Free sample3 images, no charge

Privacy policy

Last updated: 25 October 2026

The short version

  • We collect only what you type into the free-sample form, the photos you add, and a record of whether you agreed to marketing emails.
  • We use it to make your sample and reply to you. Nothing else, unless you say yes to marketing emails.
  • We set no cookies of our own and use no tracking pixels or analytics.
  • We never sell your details. A few trusted services handle them for us, and some of those may be outside Australia.
  • You can ask to see, fix or delete your details any time: [email protected].

Who we are

Maddrell Design is a registered business name of Alister Cameron Coghill Maddrell, a sole trader (ABN 74 238 735 702), based in Sydney, New South Wales. In this policy, “we” and “us” mean Maddrell Design.

Contact: [email protected]

What we collect when you ask for a free sample

This is everything the free-sample form (the “drop-off envelope” on the homepage) sends us and stores.

Business name
As you typed it.
Email address
So we can send your sample and reply to you.
Links to your shop online
Up to 3 web addresses or @handles (your Google listing, Instagram, Facebook, TikTok or website), and which of those boxes you ticked.
Photos
Up to 3 photos (JPEG, PNG, WebP or HEIC, up to 10 MB each). We also keep each photo’s original file name.
Envelope number
The 4-digit number printed on your envelope on the page. It is our reference for your request.
Marketing choice
A separate, optional tick box, unticked by default. If you tick it we keep the exact wording you saw, its version, the time, and the page you were on. If you leave it unticked we record that you did not agree.
Request details
The time of your request, and a note of whether our emails about it were sent.
A scrambled version of your IP address
Used only to limit how many requests one visitor can send in an hour (a spam control). It is a one-way hash made with a secret salt, so we cannot turn it back into your IP address, and we never store your raw IP address. It is deleted after about an hour.

Sending the form also runs a bot check (see Cloudflare below). That check sees your IP address while it decides whether you are a person, but we do not keep it.

If you email us at [email protected], we keep your message and our replies.

What we use it for

  • To make your free sample of 3 images and send it to you.
  • To reply to you, and to keep a record of your request.
  • To block spam and abuse of the form.
  • If you become a client: to do the work you hired us for, invoice you, and meet our record-keeping duties.
  • To send marketing emails, only if you ticked the marketing box (see below).

When you send the form, we are alerted by email with your details so we can start your sample. A short confirmation note also goes to the address you typed, saying we have your request and that your sample will arrive within 3 working days. That note carries no marketing.

Your photos and AI tools

We use your photos to create your sample. We only use them, or the staged versions, as examples of our work with your permission, and you can say no.

Your sample is staged with Higgsfield’s AI image tools, so your photos are uploaded to and processed by Higgsfield to create the staged versions.

Higgsfield’s own terms allow content put into its tools to be used to train its AI models unless that is switched off. We have switched it off for our account (the “Exclude data from training” setting), so your photos and the images we make from them are not used to train Higgsfield’s models.

Marketing emails

Sending a sample request is not agreeing to marketing. We only send you marketing emails if you tick the separate box on the form, or otherwise clearly agree. We keep a record of when and how you agreed.

Every marketing email has an unsubscribe link, and we act on it within 5 working days (the Spam Act 2003 requires this). You can also reply to any email and ask us to stop.

Who handles your information for us

We do not sell your information. These services handle it on our behalf.

CloudflareHosts this website, runs the database that holds your request, stores your photos in private file storage, and runs the Turnstile bot check on the form. Cloudflare’s privacy policy says it primarily stores information in the United States and the European Economic Area, and may access it from around the world. The website code that handles your request runs on Cloudflare’s global network, so a request can be handled in a Cloudflare data centre in any country. We asked for the database and photo storage to be kept in Oceania (the nearest Cloudflare region to Australia), but Cloudflare says this is a preference and a best effort, not a guarantee, so we cannot promise your information stays in Australia.
ResendSends the emails about your request. Our Resend account sends from Japan (Tokyo), and Resend’s privacy policy says it transfers data to the United States and processes it there.
Google (Gmail)Email you send to [email protected] is forwarded by Cloudflare to a Google Gmail account that we read, so those messages are held by Google. If we move our business mailbox to Google Workspace, it will be held there. Google says it runs servers around the world and does not name the countries.
HiggsfieldThe AI image tools used to create the staged versions of your photos. Higgsfield says it is a U.S.-based company that processes data in the United States, has a location in Kazakhstan, and uses vendors and partners around the world.

So your information may be disclosed to, or held by, recipients in these countries: the United States (Cloudflare, Resend, Google and Higgsfield), Japan (Resend, which sends our emails from Tokyo), and Kazakhstan (Higgsfield). Cloudflare and Google may also handle it in other countries where they run data centres. We follow the Australian Privacy Principles voluntarily, including APP 8 (sending information overseas): before we send your information to a provider outside Australia, we take reasonable steps to make sure it does not breach those principles, by using established providers with published privacy terms and, for Higgsfield, switching off AI training.

We may also share information if the law requires it.

If you are a client with a customer list (Email + SMS)

If we send email or SMS campaigns for you, we handle your customer list only on your instructions, to send your campaigns. We keep records of how each person agreed to hear from you, and we remove people who unsubscribe. We never use your customers’ details for our own marketing.

Cookies and analytics

There are no analytics, advertising cookies or tracking pixels on this site, and we set no cookies of our own. When you reach the free-sample form, the Cloudflare Turnstile bot check loads from Cloudflare’s own domain. Cloudflare says Turnstile processes your IP address, TLS fingerprint (a technical signature of how your browser connects), browser type (User-Agent) and our site’s identifier, only to tell people from bots, and also uses these signals to improve its bot detection. It does not say how long it keeps them. When we tested the live form on 25 October 2026, Turnstile set no cookie, but it saved one small item in your browser’s storage under Cloudflare’s domain. Cloudflare’s own Turnstile privacy policy covers it.

If we add cookie-free analytics later, we will update this page first.

How long we keep it

  • Free-sample requests and photos: 12 months from your request, unless you become a client.
  • If you become a client: for the life of the work, plus as long as the law requires us to keep business records.
  • The scrambled IP address: about an hour.
  • Marketing consent records: for as long as you are on our list, plus 2 years.

Your photos are kept in private storage. Only we can open them, behind a sign-in.

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Email [email protected] and quote your envelope number if you have it. We will reply within 30 days. We may need to confirm it is you first, and we may keep what the law requires us to keep.

Complaints

Tell us first at [email protected] and we will try to fix it. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Where we sit under the Privacy Act

Small businesses with an annual turnover of AUD 3 million or less are generally exempt from the Privacy Act 1988, with some exceptions. Maddrell Design is under that threshold, but we follow the Australian Privacy Principles voluntarily.

Changes to this policy

When we change how we handle information, we will update this page and its date.