Privacy Policy

Last updated 11 October 2026

AboveSpot respects your privacy and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

AboveSpot is a business of Talaro Pty Ltd (ABN 56 701 866 275). In this policy, "we", "us" and "our" mean Talaro Pty Ltd, which is the entity responsible for the personal information described here.

This policy explains what personal information we collect, why we collect it, how it is used and disclosed, and how you can access or correct the information we hold about you.

1. What personal information we collect

We collect only what is reasonably necessary to run the service and to talk to people who have asked to hear from us. That is a short list:

• Your email address, if you choose to join our newsletter. You do not need to give us an email address to use AboveSpot. It is the only personal detail we ask you for.
• Your answers in the guided finder, if you use it. We store the answers themselves (metal, size, budget and so on) with the date and whether the visit looks automated. To decide that, we read the browser name your device sends and then discard it. The answers are not linked to you, your email address or your device.
• How the site is used, through Google Analytics: which pages are viewed, how a visitor arrived, what is typed into the search box on the browse page, and general details such as device type and approximate location (country or city). We use this to see which pages are useful. It is not linked to your email address, and we do not use it to identify you.
• Which product was clicked, and when, if you click through to a dealer, along with which of our own pages you came from and whether the click looks automated. To decide that, we read the browser name your device sends and then discard it. These records are not linked to your email address, your device or your IP address.

We do not intentionally collect sensitive information about you.

2. Your IP address

We do not record your IP address, and we do not keep web server access logs.

Your IP address is still handled briefly while a page is being served, in two ways, and it is not written down in either:

• Rate limiting. We limit how many times a minute one visitor can submit a form or follow an outbound link, which stops the site being overloaded or abused. That check uses the IP address for a moment and then discards it.
• Google Analytics. Your browser sends your IP address to Google when a page loads. Google uses it to estimate an approximate location, and Google Analytics does not log or store it.
• Our network provider. AboveSpot is served through Cloudflare, which handles IP addresses to route traffic and filter attacks before requests reach us. That processing is Cloudflare's, under its own terms.

3. How we collect personal information

We generally collect personal information directly from you. When you give us your email address to join the newsletter, we collect that address so we can send you the communications you asked for.

We do not buy personal information from data brokers, and we do not obtain it from unrelated third parties for marketing.

4. Why we collect and use personal information

We collect and use personal information to:

• send newsletters, updates or other communications you have asked for;
• operate, maintain and secure AboveSpot;
• respond to enquiries;
• understand how the service is used, so we can improve it;
• prevent misuse, fraud and security problems; and
• meet our legal obligations.

We will not use your personal information for an unrelated purpose unless the law permits or requires it.

5. How we use and disclose personal information

AboveSpot does not sell your personal information, and we do not give your email address or any other personal information to other organisations for their own marketing.

We use a small number of service providers to run AboveSpot. They receive only what they need to provide their service to us, and they act on our instructions:

• DigitalOcean, which hosts the site and its database, in Sydney, Australia.
• Zoho, which we use for business email and related business services, including correspondence you send to us. We use Zoho's Australian service.
• Resend, which delivers our newsletter and other email. Resend is in the United States.
• Cloudflare, which provides our DNS and sits in front of the site to route and protect traffic, across a global network.
• Sentry, which alerts us when the application throws an error so we can fix it. Sentry's service is in the United States.
• Google, which provides Google Analytics, so we can see how the site is used. Google's service is in the United States.
• TradingView, which provides the price chart on our gold and silver price pages. Your browser loads the chart directly from TradingView, which receives your IP address and may set its own cookies under its own privacy policy. TradingView's service is outside Australia.

Sentry is configured not to attach your identity or your IP address to an error report. An error report is a technical diagnostic, so it can still contain personal information where that information is part of what went wrong. An email address is the most likely example, if something fails while we are processing one. We do not use these reports for any purpose except fixing faults.

This list may change as the service changes, and we will keep this page current when it does.

We may also disclose personal information where the law requires or authorises it.

6. Newsletter and direct marketing

If you subscribe, your email address is passed to Resend so we can send you the newsletters and updates you asked for. It may also be handled through Zoho where that is needed to manage our business correspondence.

Nothing is sent to an address that has not been confirmed. Every email includes a simple way to unsubscribe, and you can unsubscribe at any time using that link or by contacting us.

7. Overseas disclosure

AboveSpot is built and run in Australia, and we have kept the personal information we hold here where we can. The site and its database are hosted in Sydney, and our business email uses Zoho's Australian service. So your email address, if you give us one, is stored in Australia.

Five of our providers are outside Australia:

• Resend (United States) receives your email address so it can deliver the newsletter you asked for.
• Sentry (United States) receives application error reports, which can contain personal information as described above.
• Cloudflare operates a global network, so a request may be handled at a location outside Australia.
• Google (United States) receives the usage information described in section 1 through Google Analytics.
• TradingView receives your IP address and the page's request for its chart when you open our gold or silver price page.

Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including APP 8 where it applies.

Which countries are involved can depend on the infrastructure those providers use from time to time, and we will keep this page current as that changes.

8. Cookies and similar technologies

We use a small number of essential cookies, and only where the site needs them to work safely: keeping your session and protecting forms against cross-site request forgery.

We also use Google Analytics, which sets its own cookies (named _ga) to tell one visit from the next. We have turned off Google's advertising features: we do not use advertising cookies, we run no ads, and we do not track you across other sites.

You can block these cookies in your browser settings, or install Google's Analytics opt-out add-on. The site works the same either way.

9. Security of personal information

In line with APP 11, we take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps include access controls, encrypted connections and keeping the database off the public internet.

No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security.

If we become aware of a data breach likely to result in serious harm, we will do what the Notifiable Data Breaches scheme requires.

10. Access to your information

Under APP 12 you can ask for access to the personal information we hold about you. We will generally give it to you, unless an exception under the Privacy Act applies, in which case we will explain why.

11. Correcting your information

Under APP 13 you can ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading. We will take reasonable steps to correct it where that is appropriate.

12. Deleting your information

You can ask us to delete the personal information we hold about you. We will do so unless the law requires or permits us to keep it. Deleting your email address means we can no longer send you the newsletter.

13. Complaints

If you think we have handled your personal information in a way that breaches this policy or the Australian Privacy Principles, contact us using the details below. We will investigate and respond within a reasonable period.

If our response does not satisfy you, you can take the complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Changes to this policy

We may update this policy as the service, our providers or the law change. The current version always appears on this page, with the date it was last updated.

15. Contact

For any privacy question, or to ask for access, correction or deletion, email [email protected].