Legal
Privacy Policy
What this website collects, what it does not, and what happens to anything you send us.
1. Who we are
4T Advisory is a sole trader business operated by Ali Hussain, ABN 78 898 342 469, based in Melbourne, Australia. In this policy, "we", "us" and "our" mean 4T Advisory.
For any question about this policy or about information we hold, contact [email protected]. Email sent to [email protected] reaches the same mailbox.
2. Our position under the Privacy Act 1988
The Office of the Australian Information Commissioner states that the Privacy Act "covers organisations with an annual turnover of more than $3 million and some other organisations". Some organisations below that threshold are caught regardless, and some are not.
We have chosen to apply the Australian Privacy Principles voluntarily anyway. We advise organisations on information security and resilience, and it would be untenable to hold clients to a standard we did not meet ourselves. Where this policy describes a commitment, we intend it to be enforceable against us as a matter of fact, not as a matter of turnover.
Where a visitor is in the United Kingdom or the European Union, we handle their information consistently with the principles of the UK GDPR and EU GDPR.
3. What this website does not do
These statements were verified against the site's source code on 21 September 2026:
- This site sets no cookies. There is no cookie banner because there is nothing to consent to.
- It uses no browser storage. No localStorage, no sessionStorage, no IndexedDB.
- It runs no analytics, no tracking pixels, no advertising tags and no social media trackers.
- It loads no third-party resources. Fonts are served from this site, not from a font network, so no third party receives your IP address when you load a page.
- It does not attempt to identify anonymous visitors, and we do not use any service that tries to resolve visitor IP addresses to named individuals or their contact details.
4. What is collected, and why
4.1 Hosting logs
The site is hosted on Cloudflare Pages. Like any web server, Cloudflare records standard request information, which includes your IP address, the time of the request, the page requested, your browser's user agent and referring page. This is generated by the hosting infrastructure for delivery, security and abuse prevention. We do not use it to build profiles of visitors and we do not attempt to identify individuals from it. Cloudflare's own terms and privacy documentation govern how it handles that data.
4.2 Country, for the live monitors
The Live Monitors page shows the regulators relevant to where you are. To do that, the page asks Cloudflare which country your request came from, at country level only, and uses it to choose which set of published feeds to display. For example, a request from Australia sees APRA, the RBA and the OAIC; a request from the United Kingdom sees the FCA.
Your country is used within the request to choose which list of regulators to show you. It is not written to any record we keep, it is not combined with anything else, it is not returned to your browser, and it is not included in anything we cache. You can override the detected region yourself using the region control on that page.
This was re-checked against the code on 21 September 2026 after an independent audit. An earlier draft of this policy said the country was discarded while the code still returned it to the browser and cached it. The code was corrected, not the sentence.
4.3 The Ask 4T assistant
If you use the Ask 4T assistant, the text you type is sent to a language model running on Cloudflare's network under our account, so that a reply can be generated. 4T Advisory does not store your conversation, and conversations are not used to train any model by us. Cloudflare's terms govern its own handling of that request.
Please do not enter confidential information, personal information about other people, or anything you would not put in an ordinary email, into the assistant. It is a general information tool on a public website, not a secure channel.
The assistant is currently switched off on this site, so nothing described in this section is happening at present. This paragraph stays because it governs the feature whenever it is switched on.
4.4 Email you send us
If you email us, we hold your message and your address in our business mailbox, which runs on Microsoft 365. We use it to respond to you and to keep a record of the enquiry. We do not add you to a mailing list because you emailed us, and we do not sell, rent or share contact details with anyone.
5. The self-assessment tools
The CPS 230 readiness check and the EU AI Act risk-tier classifier run entirely inside your own browser. Your answers are never transmitted to us or to anyone else, are not stored, and disappear when you close the page.
One qualification, because the flat claim would be wrong: each tool ends with a button that opens an email to us. If you choose to press it, the subject line we pre-fill contains your result band and percentage, or your indicative AI Act tier. Nothing else is included, and your individual answers are never sent. If you do not press it, we see nothing at all.
6. How long anything is kept
| Information | Where | Retention |
|---|---|---|
| Hosting request logs | Cloudflare | Per Cloudflare's retention periods. We do not extract or retain copies. |
| Country for region selection | Not stored | Used within the request only; never returned to the browser and never cached |
| Ask 4T messages | Not stored by us | Not retained by 4T Advisory. The assistant is currently switched off, so none are being sent. |
| Tool answers | Your browser only | Until you close the page |
| Emails to us | Microsoft 365 | Kept while there is a business or record-keeping reason, then deleted |
7. Disclosure
We do not sell personal information. We do not disclose it for marketing. We disclose information only where it is necessary to deliver a service you asked for, where we engage a service provider that processes it on our behalf under our instructions, or where we are required to by law.
Our service providers include Cloudflare (website hosting and the Ask 4T model) and Microsoft (business email). Both operate infrastructure outside Australia, so information handled by them may be processed overseas.
8. Your rights
You may ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Write to [email protected] or [email protected], both of which reach the same mailbox, and we will respond within a reasonable period, normally 30 days.
If you are unhappy with how we have handled your information, tell us first and we will try to resolve it. You may also complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the UK or EU, you may complain to your local supervisory authority.
9. Security
The site is served over HTTPS with HSTS and a content security policy. Our business email runs on Microsoft 365 with multifactor authentication enabled. No system is perfectly secure, and we will not claim otherwise. If we become aware of a breach affecting personal information we hold, we will act on it promptly and notify affected people where it is appropriate or required to do so.
10. Changes
If this policy changes we will publish the new version here with a new version number and date. The version in force is the one on this page.