Privacypolicy.
1. Who this covers
Gracia Studio is an AI consulting, workflow automation and custom software studio based in Queensland, Australia. “We”, “us” and “our” mean Gracia Studio. This policy explains how we handle personal information through graciastudio.dev, our phone line, our website chat, the assessments we sell, and the projects we build for clients.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
2. What we collect
Website analytics
We use PostHog to understand aggregate traffic, page views and interactions so we can improve the site. PostHog runs in cookieless mode: it stores no PostHog cookies or identifiers in your browser and uses a short-lived, privacy-preserving hash to estimate unique visitors. Session replay is disabled. We do not intentionally send form answers, chat messages, assessment responses or contact details to PostHog. Analytics do not load when your browser sends a supported Global Privacy Control or Do Not Track signal. See PostHog’s privacy policy.
Free assessment
The free assessment is a 15-minute video call you book through Cal.com. Cal.com collects your name, email address, the service you select and anything you add in the notes field so the booking can be made. You choose whether the call happens on Zoom or over the phone; if you choose the phone we also collect the number to call you on, and if you choose Zoom a Zoom meeting is created for it. Cal.com and Zoom process that information on our behalf and may store it overseas. The booking is written to our calendar, and we use these details to hold the call and to follow up about it. Notes we take during the call are kept with our other client records.
Business Assessment questionnaire
If you buy the Business Assessment, the questionnaire collects information about your goals, customers, revenue, operations, team, systems and data so we can prepare your roadmap. Give us only what is needed. Do not paste customer records, credentials or sensitive personal information into the form.
Website chat
Our chat assistant processes what you type so it can answer questions about our services. If you ask us to pass on a brief, it collects the name, email address and phone number you give it and emails that to us. Do not send passwords, payment details or confidential information through chat.
Phone calls
Our phone line is answered by a person, not an automated system. We do not record those calls or transcribe them automatically. We may write our own notes afterwards so we can follow up, and those notes are kept with our other enquiry records.
Website voice assistant
The chat panel can start a voice call with Bec, our AI assistant, using your microphone. It starts only when you press the button, and closing the panel ends it. What you say is streamed to Retell, our voice provider, so Bec can respond, and the conversation is transcribed and summarised so we can follow up. If you would rather not be transcribed, type in the chat or email us instead.
Payments
Payments are processed by Stripe. Stripe collects your card or payment details directly and we never receive your full card number. We receive confirmation of payment, the amount, and the email address used at checkout. See Stripe’s privacy policy.
Email and direct contact
When you email us or fill in a form, we keep that correspondence and any details in it so we can respond and keep a record of the work.
Client project information
During a project we may be given access to your business systems, files and data so we can build and test what you have asked for. We treat that information as confidential, use it only to do the work, and hand back or remove our access when the work ends. Section 6 covers this in more detail.
3. Why we use it
- Answer enquiries and prepare quotes and roadmaps.
- Deliver the assessment, automation and software work you have engaged us for.
- Take payment and issue receipts and invoices.
- Understand aggregate website use and improve the site.
- Keep records required for tax, accounting and legal obligations.
- Maintain security, diagnose faults and prevent misuse.
We do not sell personal information, and we do not use your information for unrelated marketing without asking first.
4. Artificial intelligence
Parts of this site use AI services. Website chat runs on OpenAI, and the website voice assistant runs on Retell. Our phone line is not one of them — a person answers it. What you type or say is sent to those providers so they can generate a response, and it is handled under their terms and privacy policies. See OpenAI’s privacy policy and Retell privacy policy.
AI answers can be wrong. Nothing said by our chat or phone agent is a quote, a contract or professional advice, and anything important is confirmed by a person before we act on it.
5. Service providers and overseas disclosure
We use a small number of providers to run the studio. Several are based overseas, mainly in the United States, so your information may be processed outside Australia under their own policies and safeguards.
- Vercel — website and API hosting.
- PostHog — cookieless website analytics.
- Stripe — payment processing.
- OpenAI — website chat responses.
- Retell — the website voice assistant, including its transcription and call summaries.
- Cal.com — booking the free 15-minute assessment and holding the appointment details.
- Zoom — the video meeting created for that booking.
- Resend — delivery of the emails our forms and call summaries generate.
- ClickSend — SMS alerts about missed or completed calls.
Where a project needs additional tools, those are agreed with you in writing before we connect anything.
6. Client information and confidentiality
Information you give us during a project belongs to you. We use it only to deliver the work, we do not disclose it to anyone outside the project without your instruction unless the law requires it, and we do not use your business data to train AI models.
Where we are given logins or API keys, we ask that they are issued to us as separate credentials you control so you can revoke them at any time. Please do not send passwords by email or chat. At the end of an engagement we remove our access and, on request, return or delete the working copies we hold.
7. How long we keep it
Assessment answers, enquiries, call summaries and project correspondence are kept while we are working together and afterwards for as long as we need them for support, tax and legal record keeping, generally seven years for anything with a financial record attached. Analytics are retained according to our PostHog account settings. Payment records are also retained by Stripe under its own policies. You can ask us to delete anything we are not required to keep.
8. Security
We use reasonable technical and organisational measures suited to a small studio: access limited to the people doing the work, credentials kept in a password manager, separate accounts for client systems, and providers chosen for their security posture. No system is completely secure, and we cannot guarantee the security of information sent to us over the internet. If a data breach occurs that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as required by law.
9. Your rights
You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete anything we are not legally required to keep. Email hello@graciastudio.dev and we will respond within a reasonable time, normally within 30 days. We may need to confirm who you are first, but we will never ask you for a password or full payment details.
If you are not satisfied with how we have handled a privacy matter, tell us and we will try to resolve it. You can also complain to the Office of the Australian Information Commissioner.
10. Cookies and local storage
We do not use advertising or tracking cookies, and our analytics are cookieless. The site may store small amounts of data in your browser to remember your progress through an assessment or to keep the chat window open between pages. Clearing your browser data removes it.
11. Children
Our services are sold to businesses and are not directed at children. We do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.
12. Changes
We update this policy when the site, our providers or the law change. The effective date at the top shows the current version. Material changes affecting existing clients will be raised with you directly.
13. Contact
Gracia Studio
Queensland, Australia
hello@graciastudio.dev
(07) 3521 8091