Privacypolicy.

1. About this policy

Gracia Studio is an AI consulting, workflow automation and custom software studio based in Brisbane, Queensland, Australia. “We”, “us” and “our” mean Gracia Studio. This policy explains how we collect, hold, use and disclose personal information through graciastudio.dev, enquiries, phone calls, website chat and voice, assessments, and client projects.

We use the Australian Privacy Principles as our guide and comply with the privacy obligations that apply to our business, including the Privacy Act 1988 (Cth) where applicable. You can contact us about this policy or request a copy using the details in section 15.

2. What we collect and how

We usually collect information directly from you when you contact us, book, pay or use an assistant. We may also receive information from your authorised colleagues, a referral, or systems you ask us to work with. This can include names, business and contact details, correspondence, booking and payment records, and information needed for an agreed project.

Website use and technical information

Our hosting and security systems process technical information such as IP addresses, browser details, requested pages, times and error logs to deliver the site, prevent misuse and diagnose faults. Operational logs may contain details submitted to a service when an error occurs.

We use PostHog for page views and interactions to improve the site. It runs in cookieless mode, with no PostHog cookies or persistent identifiers stored in your browser. It processes technical details, including an IP address and browser information, to produce a daily changing visitor hash. Session replay is disabled. We do not intentionally send form answers, chat messages or contact details to analytics. Analytics do not load when your browser sends a supported Global Privacy Control or Do Not Track signal.

Assessments and bookings

Cal.com collects appointment details such as your name, email, selected service and booking notes. A phone appointment also needs your phone number. Free assessments can take place by phone or Zoom; paid assessments use the meeting option shown when you book, including Cal Video where offered. Booking information is added to our calendar and used for reminders, the appointment and follow-up.

During an assessment we take notes about your goals, operations, team and systems to prepare recommendations or a roadmap. Only share information needed for the discussion. Please leave customer records, credentials and sensitive personal information out of booking notes and general enquiries.

Chat, voice, phone and email

Website chat processes your messages and recent conversation history. If you confirm that you want a brief sent to us, the assistant collects the contact details you provide and emails the brief to the studio. Website voice processes your speech, transcript and call summary; section 4 explains this in more detail.

Our public phone line is answered by a person. We do not automatically record or transcribe those calls. We may take notes so we can follow up. Email, forms and support requests are kept as correspondence, together with the details and attachments you send.

Payments and client projects

Stripe collects payment details directly. We receive payment status, amounts and associated contact and transaction details, but do not receive your full card number.

For client work, we may receive access to business systems, files and personal information needed to build, test or support the agreed solution. This may include information about your staff or customers. Section 6 explains how we handle it.

3. Why we use and share it

• Answer enquiries, arrange appointments and follow up on requests.
• Prepare quotes, assessments, roadmaps and training.
• Build, test, deliver and support the work you engage us for.
• Process payments, issue receipts and manage business records.
• Improve the website, maintain security and investigate faults or misuse.
• Meet applicable accounting, tax and legal obligations, and resolve disputes.

Information may be shared with the people working on your engagement and the providers in section 5 where needed for these purposes. We may also disclose information to professional advisers or authorities where necessary for legal obligations or to protect lawful rights. We do not sell personal information or use it for unrelated marketing without asking first.

4. AI chat and the voice assistant

Website chat uses OpenAI. Your messages and recent conversation context are sent to OpenAI to generate replies. Our chat integration does not request storage of generated responses by OpenAI. OpenAI states that API data is not used to train its models by default, but provider security and abuse-monitoring records can still be retained, ordinarily for up to 30 days, with exceptions described in its API data guidance.

The website voice assistant, Bec, uses Retell. It starts when you select the voice option and allow microphone access. Speech and page context are sent to Retell and its supporting speech and AI services to generate a response. Conversations are transcribed and summarised, and Retell may retain audio recordings alongside transcripts and call records according to its configured storage settings and privacy policy.

Voice transcripts, summaries and any contact details you provide can be emailed to the studio for follow-up. A short summary may also be sent as an SMS alert to the studio. Closing the chat panel ends the voice session; it does not delete records already created. Use typed chat, email or our human-answered phone line if you prefer not to use AI voice.

Please do not put passwords, full payment details, sensitive personal information or confidential client records into public chat or voice. AI replies can be inaccurate, so ask a person to confirm anything important. Our public phone line is separate from the website voice assistant.

5. Service providers and overseas processing

We use specialist service providers to operate the website and deliver our services. Personal information may be shared with these types of providers where needed:

• Website hosting and security providers — technical connection details and logs needed to deliver the site, diagnose faults and prevent misuse.
• Website analytics providers — page views, interactions and technical details for cookieless usage statistics, as explained in section 2.
• AI, speech and voice providers — messages, conversation context and voice information needed to generate replies, transcripts and summaries.
• Booking, calendar and meeting providers — contact details, appointment notes and information needed to arrange and hold a call.
• Payment processors — payment and transaction details; full card details go directly to the processor.
• Email and messaging providers — correspondence, enquiry briefs, voice reports and short summary alerts needed for studio follow-up.

Information may be processed or stored in Australia and overseas, particularly the United States. Service and support recipients may also be located in Sweden and the Philippines. The countries used depend on the service, its supporting providers and the agreed project. Contact us if you need the recipient or location details for a particular interaction.

We take reasonable steps to choose and use providers with appropriate privacy and security safeguards. Using an overseas provider does not remove our applicable privacy obligations. Project-specific providers and intended data flows are agreed with you before we connect them.

6. Client information and confidentiality

We treat client information as confidential and use it to deliver the agreed work. Please make sure you are authorised to share information about other people and tell us about any restrictions before granting access. Where practical, use sample or de-identified data for development and testing.

We do not use your business data to train our own AI models. Any use of an external AI service for a project is part of the agreed solution and its data handling should be confirmed before confidential or personal information is sent to it.

Give us separate accounts or credentials that you control and can revoke. Please do not send passwords by email or public chat. At the end of an engagement we remove our access and, on request, return or delete working copies, except records we need to retain for legal, accounting or agreed support purposes.

7. How we hold information and how long

Information is held in our business correspondence, booking and payment systems, project files, and the provider services described above. We keep enquiries, assessment notes and project records while needed to deliver work, provide support or meet legal obligations. Records attached to financial transactions are generally kept for seven years as our business record-keeping practice; some obligations or disputes may require a different period.

We delete or de-identify information when it is no longer needed and we are not required to keep it. Provider logs, analytics, payment records and voice records have separate retention settings and requirements. Backup copies may take longer to expire. We do not promise that closing a chat or clearing browser data deletes provider or studio records.

You can ask us what we hold and request deletion using section 9. Browser chat storage is explained in section 11.

8. Keeping information secure

We use reasonable technical and organisational measures, including HTTPS for the website, limiting access to people who need it for the work, keeping service credentials out of public website code, and using separate, revocable access to client systems. Please avoid sending unnecessary personal information and report any suspected exposure to us promptly.

No system or internet transmission is completely secure. If a breach occurs, we will assess it, take reasonable steps to contain and address it, and notify affected people and the Office of the Australian Information Commissioner where required under the applicable data breach notification rules.

9. Access, correction and deletion

Email hello@graciastudio.dev to request access to the personal information we hold about you, a correction, or deletion of information we no longer need or are not required to keep. Tell us what the request relates to so we can locate the records.

We may need to verify your identity, but will not ask for passwords or a full card number. We respond within a reasonable time, normally within 30 days. If we need longer, we will explain why and give an expected timeframe. If we cannot grant a request, we will explain the reason, subject to legal restrictions, and how you can complain. A deletion request may not cover records required by law or needed for an unresolved dispute.

10. Privacy complaints

Contact us using the details in section 15 and mark your message “Privacy complaint”. Describe what happened, the information involved and the outcome you are seeking. We will review the matter, contact you if we need more detail, and aim to give you a written response within 30 days. If more time is needed, we will explain the delay.

If you are dissatisfied with our response or have not received one after 30 days, you can contact the Office of the Australian Information Commissioner (OAIC) about making a complaint. The OAIC explains which matters it can investigate and the steps to follow.

11. Cookies and browser storage

Our own website does not use advertising cookies, and PostHog analytics are cookieless. The chat keeps up to 24 recent messages and a brief-submission status in your browser’s local storage so you can continue a conversation between pages. It only restores a saved conversation if it was last updated within 24 hours. Older saved data can remain in the browser until overwritten or cleared; the 24-hour limit does not automatically erase it.

A separate session-storage flag remembers whether chat has already opened automatically during that tab session. You can remove browser copies by clearing site data in your browser settings. On a shared device, do this after using chat. This does not remove an emailed brief, transcript or provider record.

Booking, meeting and payment services may use their own cookies or storage when you visit or interact with them. Their policies and settings apply to those services. To prevent our analytics loading, enable a supported Global Privacy Control or Do Not Track signal in your browser.

12. Your choices

You can browse the site or make a general enquiry without identifying yourself, including using a pseudonym where practical. You can choose email or a human phone call instead of AI chat or voice. You can decline microphone access and end a voice session at any time.

If you do not provide the details needed for a booking, payment or project, we may be unable to arrange it or deliver the service. We do not ask for sensitive personal information in public enquiries. Where a project requires it, collection and handling need to be agreed beforehand and consent obtained where required.

You can withdraw consent to an optional use or ask us to stop marketing messages by contacting us. This does not prevent necessary service messages or record keeping required by law, and does not undo processing that has already occurred.

13. Children

Our services are intended for businesses and are not directed at children. We do not knowingly seek personal information from children. If you believe a child has submitted information, contact us so we can investigate and remove it where appropriate.

14. Changes to this policy

We update this policy when our services, data handling or relevant requirements change. The effective date at the top identifies the current version. Material changes affecting existing clients will be raised with them directly.

15. Contact for privacy matters

Privacy enquiries — Gracia Studio
Brisbane, Queensland, Australia
hello@graciastudio.dev
0466 449 608
Monday to Friday, 9am–5pm AEST

For help with a service or booking, visit Support.