Privacy policy

This directory is operated by WhoToHire. Questions about this policy, and any request to access, correct or delete personal information, go to support@whotohire.com.au.

We are the entity responsible for the information published here. If you are a business listed on this site and you want your listing corrected or removed, you do not need to explain why, and there is no cost.

You can search and read this directory without an account. We do not require your name, phone number or email to use the site.

Our hosting provider records standard request logs — the page requested, the time, and the IP address the request came from — which is how any website works.

We also run our own measurement of how the directory is used. It is built by us, runs on our own domain, and sends nothing to any third party: there is no Google Analytics, no advertising pixel and no tag manager on this site. What it records is the page you viewed, the site or search engine you arrived from, any campaign tag in the link you followed, roughly where you are — country, state and city, worked out by our host from your IP address — the kind of browser and device you used and how wide its window is, how long the page was open, how far down it you scrolled, and how quickly the page loaded for you.

It also records a small number of interactions, so we can tell which listings are actually useful: tapping a phone number, following a link to a business's own website, submitting a form, changing a sort or filter, and ticking a box on a form. Where a form has tick-boxes, we record that one was ticked and not which one.

We record what you type into the search box. This changed on 10 September 2026; before that date we did not, and this page said so. We changed it because a search that finds nothing is the only way a visitor can tell us which trade or which suburb this directory is missing, and we had no way of seeing a single one of them. What is kept is the words you typed, how many results they found, which box you used, and what our matcher made of the words — the trade and the place it recognised, whether it corrected a spelling, and which of your words it could not use at all. That last one is the point of the whole exercise: it is a list, written by the people we failed, of what to fix next.

The search box is the only text box on this site whose contents are measured, and this is a deliberate line rather than an oversight. The correction form, the claim form and the contact form all take words you wrote about yourself or your business, and none of them is ever sent to the measurement. The script that watches the page still refuses, as it always has, to read the value of any text field; the search box is an explicit, named exception that the search box itself asks for.

The search record is attached to the same measurement row as everything else described here, which means it carries the same daily code and nothing more. There is no name, no email address, no account and no IP address against it, and the code is a different one tomorrow — so a search cannot be joined to another search on a different day, by us or by anybody who obtained the data.

None of this identifies you. Nothing is stored on your device, so there is no identifier to follow you between visits. To avoid double-counting one person as many, your IP address and browser are combined into a short scrambled code that cannot be turned back into either, using an ingredient we change every day — so the code for the same person is different tomorrow, and cannot be joined up across days. We do not store your IP address.

So that a handful of pages read in one sitting can be counted as one visit rather than as several unrelated arrivals, we also work out a second code from the first one and the time of day. It is worked out on our server each time, not stored on your device, and because it is built from the daily code it expires with it.

Separately from all of the above, our server keeps a short record of each request that reaches it: the page, the time, roughly where the request came from, and what kind of client sent it. This one is not driven by JavaScript, so unlike everything described so far it also sees automated visitors — search engine and AI crawlers — which is the main reason it exists: we allow those crawlers to read this site and this is how we find out whether they do. These records carry no code that identifies a person, and no IP address.

If your browser sends a Do Not Track or Global Privacy Control signal, none of this runs and nothing is sent.

If you send us a message using the form on this site, we receive the email address, name and text you provide. We use them to reply to that message and for nothing else: you are not added to any mailing list, and your details are not passed to any business listed here or to anyone else.

If you use the “near me” search, your location is read by your browser and matched against a list of places held in the page itself. It is never sent to us and never leaves your device.

Claiming a listing is the one part of this site that is deliberately about identifying someone, so it is described separately from everything above.

When you claim a listing we collect your name, your email address, a phone number, whether you own the business or act for it, which listing you are claiming, anything you write in the message box, and the file you attach as proof. Every one of those is something you chose to send us.

The file is the part to be clearest about. It is whatever you sent — a photo of your signage, a screenshot of your Google Business Profile, an invoice or a rates notice — and we ask for it because it is what lets us verify a claim without ringing you. It is held in private storage that nothing on this site can read, it is never published or shown on the listing, and it is only ever opened by us while the claim is being decided. Photographs taken on a phone usually carry the place they were taken and the device that took them; your browser strips all of that before the file is sent, because we asked for proof of who you are and not for where you were standing.

We delete the proof once the claim is decided. A refused claim's file goes immediately; an approved one is kept for up to seven days, in case the approval is questioned by somebody who says the listing is theirs. Nothing keeps it beyond that.

None of the rest is published either. Your name, email address and phone number never appear on the listing, are never shown to anyone using the site, and are never passed to another business, an advertiser or a data broker. You are not added to any mailing list. The pages of this site are built in advance by a separate process, so nothing you send here reaches a page except the five details you choose to publish yourself, described in the next section.

We store the claim in a database we control, alongside a copy in our support mailbox. We keep it for as long as the listing exists, so that if a change made on your word is ever questioned we can show who asked for it and when. Ask us to delete it and we will.

If you reached the claim form from a link we sent you, we also record which of our invitations you followed, and any campaign tag that was in the link — the same tags described in the measurement section above, and nothing else from the address bar. It tells us whether the businesses we contacted are the ones getting value from this, and it is the only reason it is kept. It is not shared with anyone, and a claim made without one of our links simply has nothing recorded against it.

Claiming a listing does not change where it ranks, and it cannot: nothing in the ranking reads any of this. There is no fee.

An approved claim gives you a way in to your own listing, and that adds two things to what we hold.

There are two ways in and neither is stored in a form anybody can use. Your password — the one we email you when a claim is approved, or the one you set yourself afterwards — is kept only as a salted scrypt hash, so a copy of our database is not a set of working logins, and nobody here can read it back to you. The alternative is a link emailed to the address you claimed with; it works once, it expires, and it too is stored only as a one-way hash. Being signed in is a small random value in a cookie — marked so it is only ever sent to this site, never readable by a script, and never used for anything but recognising you. It is not an advertising identifier and it is not shared with anyone.

We record failed sign-in attempts so that a tenth wrong password in a quarter of an hour can be refused. What is kept is the date, whether it worked, and a one-way hash of the address it came from and of the email that was tried — never the address itself, never the email itself, and never the password that was typed. Those records age out with everything else on this page.

What you change is a record of its own. We keep every version of your phone number, website, opening hours, description and trading status, with the date and which of us changed it, so a wrong edit can be undone and nobody has to guess what a page used to say. That history is about the business rather than about you, and it stays for as long as the listing does.

We keep the date you last signed in, so we can tell an approval that was used from one that never was. We do not keep a log of the pages you looked at while signed in, and the sign-in cookie is invisible to the measurement described further up.

What you publish is public — that is the point of it. What you cannot change there is the business name, the address or the reviews: those come from sources we cannot overwrite by hand, and a listing that could rewrite its own name would make the directory worthless. Ask us and a person will fix those properly.

We do not sell personal information. We do not pass your details to businesses listed on this site, and we do not operate a lead-generation service — when you contact a business you do so directly, using their own contact details.

Listings are compiled from public sources: business registers, businesses' own websites, open mapping datasets and public review platforms. Where information relates to a sole trader it may constitute personal information under the Privacy Act 1988 (Cth).

Any business can request correction or removal of its listing at any time, for any reason, at no cost.

Browsing this site sets no cookies. Every page is a file; there is nothing to log into to read one and no session to keep.

There is exactly one cookie on this site, and you only ever get it by asking for it: if you claim your business listing and we approve it, signing in sets a cookie so the site knows you on the next click. It holds a random value and nothing else — no name, no email address, nothing derived from either. It is marked so it is only sent to this site, cannot be read by any script, and it lasts thirty days or until you sign out, whichever comes first. Sign out and it is gone from your device and cancelled at our end in the same moment.

Nothing else is stored on your device by anything here — no local storage, no session storage, no device fingerprint. Our measurement uses none of it. There is nothing that could recognise you on another site, and nothing another site could use to recognise you here.

If that ever changes, this section will say so before it ships. It did on 25 August 2026, when the sign-in cookie above was added.

Our hosting provider keeps its own full request logs, including the IP address, briefly — currently around a day — and they expire on their schedule, not ours. We keep no copy of those.

We do keep our own record of both kinds of measurement described above — the usage measurement, and our own short record of each request — in a database we control, so we can see how the directory is used over months rather than for a day. It contains no name, no email address and no IP address: only what is described in the section above, including the scrambled daily code, which is a different code for the same person tomorrow.

We keep those measurement records for up to 24 months, then delete them.

Messages you send us through the contact form are kept in our support mailbox so we can action the request and show what was agreed. Ask us to delete one and we will.

Business claims are kept in a separate database from the measurement records above — the measurement database holds no name, email address or phone number, and claims are not filed in it. We keep a claim for as long as the listing exists, for the reason given in the section on claiming, and delete it on request. The file attached as proof is not kept that long: it goes as soon as a claim is refused, and within seven days of one being approved.

You may request access to personal information we hold about you, ask for it to be corrected, or ask for it to be deleted. Contact support@whotohire.com.au.

If you are not satisfied with how a request has been handled you may complain to the Office of the Australian Information Commissioner.