Privacy

Who this covers

This policy covers NEXA Studio — a design studio based in Adelaide, South Australia — and this website. It is written to meet the Australian Privacy Principles under the Privacy Act 1988 (Cth).

Work done for a client is governed by the written agreement for that project. Where that agreement says something different about a client's own data, it wins over this page.

What the site collects

Two things: the enquiry form, and what you type to the website assistant, which has its own section below. When you send an enquiry the form stores exactly the fields it shows you.

Your name

So a reply is addressed to a person.

Your email address

The only way a reply reaches you. Nothing else is ever sent to it.

Your company

Optional. Leave it empty and nothing is stored.

The kind of work

Design, AI, systems or general — so the reply starts in the right place.

Your message

Whatever you write in the box.

Your phone number

Optional, and only used to ring you about the enquiry you sent. Leave it empty and nothing is stored.

Where the business is, and a rough budget

Optional, both from a list of choices. They decide who is called first and roughly what to prepare, nothing else.

The best time to call

Optional. Only meaningful if you left a number, and it is ignored otherwise.

The service you asked about

Only from the request form on the Services page, which records the service you picked, or that you were not sure yet.

Four of those are optional and the form says so beside each one. Leaving them empty changes nothing about the reply you get — an enquiry with a name, an email and a message is a complete enquiry. The request form on the Services page works the same way: a name, an email, the service and a message are required, and the phone number, company and budget are optional.

The form also carries a hidden field that people never see and automated scripts usually fill in. If it arrives filled, the submission is discarded and nothing is written down.

What the site does not do is worth saying plainly:

• No analytics. No Google Analytics, no Vercel Analytics, no heatmap, no session recorder, nothing that counts you.
• No tracking or advertising cookies. Nothing is dropped on your browser when you read a page.
• No advertising pixels, no remarketing, no data brokers, and no mailing list you are added to for writing in.
• No fonts, scripts or images pulled from another company's servers while you read. Both typefaces are downloaded at build time and served from this domain, so reading this page tells Google nothing.
• No profile of you is built, and the studio does not use what you send to train an AI model.

The website assistant

The assistant answers questions about the studio from what the studio has written down. What you type to it and what it answers are kept as a conversation, so the studio can read where an answer fell short and fix what the site says.

• A conversation is deleted automatically 90 days after its last message.
• If you ask it to pass you to a person, or give it your name and email so the studio can reply, that becomes an enquiry and is kept the way an enquiry is.
• A thumbs up or down, and anything you add to it, is kept with the answer it rates.
• To stop the assistant being flooded, the site keeps a scrambled form of your IP address (a hash) for about an hour and then deletes it. It is a counter, not linked to your conversation or to anything else.
• Questions it could not answer are kept as a list of what the site should have said, with email addresses and phone numbers removed, after the conversation itself is gone.
• It sets no cookie and stores nothing in your browser.

The same assistant also answers on Telegram, in private chats only. There the site keeps your Telegram chat number and first name, so the conversation can carry on, and nothing else Telegram sends about you. The conversation itself is deleted after 90 days like any other. If you send the bot /subscribe, the same two things are kept on its news list until you send /unsubscribe or /stop.

What it is used for

To read your enquiry and reply to it, and to keep a record of what was asked and quoted if the conversation becomes a project. That is the whole list.

To get through that faster, the studio can ask an AI model to summarise a conversation, to rate how well an enquiry fits what the studio sells, or to answer a question about its own list of enquiries. Those notes are about the enquiry, not about who you are, and nothing is decided by them: a person reads every enquiry. To decide what its blog should explain, the studio can also ask a model which questions come up most often — from enquiries and the assistant, with names, email addresses, phone numbers and links taken out first.

If the studio sends you a link to a proposal, the site records when it was first and last opened, how many times, and the answer you give, so the studio knows whether to follow up.

If the studio sends you a contract to sign, the site records when you first opened it and, when you sign, the name you type, the time, and a fingerprint of the exact text you agreed to — nothing else about you. You are emailed a copy.

Your details are never sold, rented or handed to anyone for their own marketing.

Where it is stored

These suppliers handle data on the studio's behalf, each only to do the job named beside it.

Supabase

Hosts the database enquiries and assistant conversations are written to. The key the public pages use can add a row and cannot read one back — the database enforces that, not the page.

Vercel

Hosts and serves the site and runs its server code. Like any web host it processes standard request data, including your IP address, to deliver pages and keep the service up and secure.

OpenRouter

Carries what you type to the assistant, with the parts of the studio's own writing it needs, to the AI model that writes the answer — currently one of Google's Gemini models. The studio's private tools send it enquiry text too, when somebody in the studio asks for a summary or a fit rating. The email and phone fields from the form are never part of what is sent; the words of a message or a chat, and your name, can be.

OpenAI

Turns a question you ask the assistant into a list of numbers, so the site can find the part of the studio's writing that answers it. It receives the question and nothing else.

Resend

Sends the studio's email, including the notice to the studio that your enquiry arrived, which carries what you wrote.

Telegram

Carries your messages to and from the studio's bot, if you choose to write to it there. Telegram runs its own service, outside Australia, under its own privacy policy.

The database runs in Supabase's Sydney region and Vercel runs the site's server code in Sydney, both in Australia. OpenRouter, Google, OpenAI and Resend are companies based in the United States, so what passes through them may be handled outside Australia.

Replies, and any files exchanged once a project starts, also live in ordinary business email and file storage.

Cookies

The public pages set no cookies, so there is no consent banner to dismiss. The only cookies this site can set are the sign-in and language cookies on the studio's own private areas, which no visitor reaches.

How long it is kept

• An assistant conversation is deleted automatically 90 days after its last message.
• An enquiry that does not become a project is deleted once the conversation has clearly ended, and within two years at the outside.
• Records tied to work actually done are kept for seven years, because Australian tax and business-record rules require it.
• Ask for an enquiry to be deleted sooner and it will be, unless one of those rules applies to it.

Your rights

Write to the address at the bottom of this page and you can:

• Ask what is held about you, and get a copy of it.
• Have anything wrong corrected.
• Have it deleted, subject to the record-keeping above.
• Complain about how it was handled.

Requests are answered within 30 days and there is no charge. If a reply does not resolve a complaint, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au.

Security

The site is served over HTTPS. The database enforces at the row level what the public pages may do, the form validates and length-limits every field before anything is stored, and the key those pages use cannot read an enquiry back. Reading one takes the studio's own sign-in, and no key that could do more ever reaches a browser.

No system is beyond reach. If a breach ever affected you, you would be told — that is an obligation under the Notifiable Data Breaches scheme, and it is also how this studio would want to be treated.

Links to other sites

Some pages link out — to a live site or an app store listing. Once you follow one of those you are on someone else's site under their privacy policy, not this one.

Changes to this policy

If what the site collects changes, this page changes with it and the date at the top moves. There is no archive of old versions; the date is the honest signal.