Clear handling of request details.

Heimdall is currently operated by James Warin as a sole trader. Questions, access or correction requests, verified deletion requests and privacy concerns can be sent to info@heimdall.farm.

Field & Flow intake handles the contact details you supply, such as your name, email, optional phone number, town or postcode, region, requested service, date and slot, and the context you choose to provide. Please do not send exact property addresses, financial records, boundary details or other sensitive material through an intake form.

The Heimdall pilot EOI is submitted separately to POST /v1/pilot-eois. Its saved response contains State, postcode, an optional approximate property size in hectares, selected current interest and any hypothetical whole-dollar monthly hardware or software amounts you choose to enter, plus consent and anti-automation fields. It has no name, email, phone, exact address or free-text field. A postcode can still be identifying in a small community, so we describe this response as de-identified rather than absolutely anonymous.

The optional callback uses a second form and POST /v1/pilot-callbacks. That request contains an Australian mobile number, dedicated callback consent and anti-automation fields only. Accepted numbers are normalized to the +614xxxxxxxx format. Its saved record has no pilot-response reference, State, postcode, current interest or pricing answers, and the saved pilot response has no phone number. The records have no direct identifier link. Close submission timing and the short-lived keyed network abuse control may still permit correlation, so we do not promise absolute anonymity or unlinkability.

The pilot EOI form also offers an entirely optional verified-email path. The de-identified PILOT_EOI response is unchanged by it: no name, email, phone, exact address or free text ever lands there. If you choose to enter an email, we store an encrypted, short-lived verification challenge and email a six-digit code; only once you verify that code do we create a separate PILOT_CONTACT record holding that email, any optional unverified mobile, the consents you ticked and any note you later add. That identified record is no longer de-identified, by your choice. Updates are opt-in with a working unsubscribe link, and the post-verification note is the only free-text field in the whole pilot flow — it lives only on that identified contact record. We keep an identified contact for about 24 months from the last meaningful interaction, matching the de-identified response window.

The fixed SA-farmer link is https://heimdall.farm/?ref=sa-farmer#interest. When that exact source is present, the page waits until it has been continuously visible for three seconds, then sends the fixed source, page-start time and an empty anti-automation field. This measures aggregate link activity and velocity only—not unique visitors, people, verified farmers, actual shares, referral generations, virality or EOI conversion. It uses no cookie, localStorage, persistent browser ID or per-person code. The request sets a no-referrer policy and sends no screen data, contact detail, location or EOI/callback identifier. A browser or network may still attach ordinary protocol metadata such as a user-agent header; this referral feature does not read, use, persist or include that metadata in its application or access logs.

The server transiently combines the source IP with a namespace, the fixed source and the Adelaide calendar date before applying a keyed HMAC. The resulting marker suppresses another accepted count for that network on that date; it is not copied to the daily aggregate and cannot directly link markers across days. The referral endpoint’s short-lived rate control uses a separately namespaced keyed hash and cannot consume form-submission quota. Raw IP addresses are not stored or logged by this feature. Shared NAT connections and VPNs can collapse separate activity, while bots or network changes can inflate it, so the count is directional rather than a people count.

We also keep request context and consent evidence, including the policy or terms version, acceptance and submission time. For short-lived abuse controls, we derive a keyed hash of a network identifier. We do not store the raw IP address in the application record.

We use this information to respond to enquiries, record de-identified pilot and pricing research, make a requested pilot-verification call, verify booking requests, review service fit and travel, manage conditional capacity, send lifecycle emails, prevent misuse and maintain service records. We do not sell personal information or infer marketing consent from an EOI or callback request.

Primary application processing and storage use AWS in Sydney. Pilot notifications queue and email only the relevant opaque response or callback reference and tell authorized operators to retrieve the private record through protected AWS access. State, postcode, pricing research, current interest and mobile numbers are not copied into the pilot outbox payload, SQS message or mailbox. Transactional and internal notification email is currently sent through Amazon SES in us-east-1 until Sydney production access is approved, so the opaque reference and delivery metadata may cross regions.

This site loads Google Fonts. Requests to Google may disclose ordinary web request metadata such as your IP address, browser details, requested font resource and referring page, subject to your browser and network settings.

• Field & Flow enquiry personal information: 180 days.
• De-identified Heimdall pilot EOI responses: up to 730 days.
• Separately stored optional pilot callback records: up to 90 days.
• SA-farmer network dedupe markers: up to 2 days; daily aggregate link-signal rows: up to 730 days.
• Booking request personal information: up to 365 days.
• Declined, cancelled or expired request records: up to 30 days.
• Transient outbox records: 7 days. Eligible failed deliveries may be replayed automatically; records in notification, replay and final failure queues remain for up to 14 days per queue.
• Application logs: 30 days; DynamoDB point-in-time recovery: 35 days.

Expiry uses database TTL and background deletion, so removal is approximate rather than immediate. Recovery copies and operational backups can lag the live record and age out on their own schedules. We aim to action a verified deletion request within 30 days, subject to any documented legal hold; ordinary encrypted backup copies expire within 90 days after primary deletion.

Booking status and management links contain customer access capabilities. After you open a link, this site removes those capabilities from the visible URL and may keep them in sessionStorage, scoped to that request, so the same browser tab can refresh the status page. They are not placed in localStorage. Keep the email and link private, close the tab on a shared device, and clear site data if needed.

You may ask what personal information we hold about you, request correction or deletion, withdraw optional update consent or a callback request, or raise a privacy concern. Some records may need to be retained briefly for security, integrity or legal reasons. Because a de-identified pilot response contains no contact details or callback reference, we may be unable to identify a particular response as yours. Contact info@heimdall.farm.