PRIVACY POLICY

Apart from Ellipse Reply (section 07) and the visit records in section 02, most of the personal information we hold comes from our contact form: your name, email address and message, plus, if you choose to give them, your company, the services you are interested in, and a rough budget range. Name, email and message are the only ones we need in order to reply.

When the contact form on this website is submitted, our server notes the IP address the request came from. It is used for one purpose: rate limiting, so the form cannot be abused to send spam. It is held in the server's memory only and never written to a database or a log, so it is lost when that server shuts down. Netlify, our host, decides when that happens, so we cannot give an exact time, but these servers are short-lived. Ellipse Reply handles this differently, as section 07 explains.

Separately, we keep a small business-contact list for our own outreach. It holds business names and publicly listed business contact details, and where we have written to a business it records the address we wrote to and the date. We built it from publicly available business listings, not from anything you sent us. If you would rather not be on it, email hello@ellipsestudio.com.au and we will remove you and not contact you again.

This website sets no cookies. There is no Google Analytics, no advertising or social media pixel and no session recording, and we do not build a profile of you. It does record a few things about visits, set out below, and we do not use any of them to work out who you are.

Our host, Netlify, counts visits from the requests your browser makes to load each page, so this needs no cookies and no script. We see totals only, such as page views, the number of visitors, the most viewed pages and the sites that sent people here, and Netlify shows us the last 30 days.

Netlify also adds a small script to each page to measure how quickly it loads and responds. When you leave the page, it sends Netlify which page it was, the kind of browser and operating system you use, whether you are on a phone or a computer, your screen size and those timings. It sets no cookies. We use it to keep the site fast. How long Netlify keeps these figures is set by its own terms, not by us.

We also use Cloudflare Web Analytics, a small script that counts page views and measures how quickly pages load. It sets no cookies, stores nothing in your browser and does not follow you to other sites. We see totals only, such as which pages were viewed and the sites that sent people here.

When you download our free guide, AI in Plain English, the site keeps a record of that download: when it happened, which file it was, the page or site you came from if your browser passes that on, the country your connection appears to come from, the description your browser gives of itself (its user agent), and a code made from the date, your IP address and that description. The code lets us count someone who downloads the guide twice in one day only once, and it changes every day. Your IP address itself is not stored, but we still treat these records as personal information.

We use the download records only to count downloads, see where they come from and tell people apart from automated crawlers. They are stored with Netlify. We have not set a time limit on them, so they are kept until we delete them.

When you run our free Website Security Check, the site keeps a record of that check: when it ran, the website address you checked (the domain only), the result you were shown, the advertising tags in the link you arrived on and the site that sent you, if your browser passes that on, plus the same country, browser description and daily code described above for downloads. We use these records to count how many checks are run, where people come from and which results they see. They are stored with Netlify and kept until we delete them.

Like any web host, Netlify also receives your IP address and browser details with every request, and handles them under its own terms.

What you send us through this website is used only to reply to your enquiry, and, if we go on to work together, to deliver the work and correspond about it. We will not add you to a mailing list unless you ask. We do not sell, rent, or trade your information, and we do not use the contents of your enquiry to train AI models.

An enquiry sent through this website passes through a small number of service providers (Ellipse Reply's are listed in section 07):

• •Resend delivers the enquiry from the website to our inbox.
• •ImprovMX forwards mail sent to our hello@ address.
• •Google runs the Gmail inbox that mail to our hello@ address is forwarded to, where it is kept.
• •Netlify hosts this website and serves its pages. It also provides the visit figures and stores the download and security check records described in section 02.

Some of the providers above process data on servers outside Australia. We use them because they are established providers with their own security and privacy commitments, but by contacting us you accept that your message may be handled overseas.

Enquiries sent through this website stay in our inbox so we keep a record of the conversation. If you would like yours deleted, just ask. Records relating to paid work are kept for as long as the engagement requires, plus any period we are required to keep them for tax and legal purposes. Ellipse Reply's records are deleted after 30 days, as section 07 explains.

If we build or run something for you, we may be given access to your systems, accounts, or data. That is governed separately by our Terms of Engagement and the data handling document we provide at the start of a project. In short: we take the minimum access needed to do the work, we do not keep copies we do not need, and access is handed back or revoked when the project ends.

If your business uses Ellipse Reply, its service schedule covers how your customers' enquiries are handled, and section 07 sums that up for your customers.

Ellipse Reply is a service we run for other businesses. It gives a business an Ask page where its customers can send an enquiry, and it suggests a reply for the business to check. Some businesses also have their own enquiries email address pass a copy of each enquiry to Ellipse Reply. If you used an Ask page, or emailed a business that uses Ellipse Reply this way, it handled your enquiry for that business, and only for them. What that business does with your enquiry once it reaches them is up to them. This section covers what Ellipse Reply does with it.

Some Ask pages are concept pages, marked as made by Ellipse Studio, for a business that has not signed up. On those, Ellipse Studio is responsible for your details and uses them only to show how Ellipse Reply works. The emails about your enquiry come to our own inbox, which is a Gmail inbox run by Google (section 04), and stay there as with any enquiry sent to us (section 05). We will delete them if you ask. Everything else in this section applies the same way.

When you send an enquiry, Ellipse Reply collects your name, your email address, your phone number if you give it, and your message, along with which link brought you to the page and when you sent it. It also keeps the reply it suggested and a record of each step and check it ran.

For an enquiry sent by email, the business's own email service passes a copy of your email to Ellipse Reply. It keeps your name, your email address, the subject and the words of your email, and how many attachments there were. It does not open or keep the attachments, and it has no access to the business's mailbox: it only sees the emails that are forwarded to it. Automatic messages, such as out of office replies and newsletters, are dropped without being kept.

Some businesses, such as an accountant, ask Ellipse Reply to take certain details out of enquiries. On their Ask pages and in their forwarded emails it looks in your name, the subject and your message for tax file numbers, dates of birth given as such, bank account details, and card, Medicare, passport and driver licence numbers, and replaces each one it recognises with a note saying it was removed, before the enquiry is stored or emailed to the business. An enquiry that had something removed is not sent to the AI assistant at all, and the business answers it themselves. This is a filter that works on the usual ways these details are written, so it can miss some, and it does not check the phone or email boxes. Please do not send these details through an Ask page.

It uses these details to send your enquiry to that business by email (when it came through an Ask page; an emailed enquiry is already in their inbox), followed, where it can, by a suggested reply. Nothing is sent to you automatically. Someone at the business reads the suggestion, changes it if needed, and sends any reply themselves from their own email. We do not use your details for our own marketing, we do not contact you ourselves, and we do not use your enquiry to train AI models.

Three service providers handle your enquiry on the way:

• •Anthropic makes Claude, the AI assistant that sorts your enquiry and drafts the suggested reply. It reads your name, email address, message and the link you used, but not your phone number. Under its commercial terms Anthropic may not train its models on your enquiry, and it deletes what it receives through its API within 30 days, unless the law requires it to keep something or it needs to look into a breach of its usage policy.
• •Resend delivers the emails to the business: your enquiry, the suggested reply, and a weekly summary that holds counts only. Where a business forwards its enquiries by email, Resend also receives those emails for Ellipse Reply.
• •Netlify hosts the Ask page and the service behind it, and stores Ellipse Reply's records.

All three are overseas services, so your enquiry is processed and stored outside Australia, mainly in the United States. Each keeps its own records of the emails and requests it handles, under its own terms.

A daily clean-up deletes Ellipse Reply's record of your enquiry once it is 30 days old, so within a day of that mark. After that we keep only counts with no personal details, such as how many enquiries came in and how long a suggestion took, so the business can get its weekly summary. The emails the business received are its own copy, and it keeps them as it keeps any other email.

To stop an Ask page being flooded, Ellipse Reply counts how many enquiries arrive from each connection over 10 minutes. For that it stores a one-way hash of your IP address, made with a secret key, never the address itself, and the next daily clean-up deletes it, so it is kept for about a day at most.

To find out what Ellipse Reply holds about you, or to have it deleted, email hello@ellipsestudio.com.au, or ask the business and they can pass it on. Tell us which business, roughly when you sent the enquiry, and the email address you used, and we will answer at that address so we know it's you. We will delete our record as soon as we have found it. The copy in the business's own email is theirs, so ask them to delete that too.

This site is served over HTTPS. Our accounts are protected with strong, unique credentials and multi-factor authentication wherever the provider supports it. No system is ever perfectly secure, but this website holds no customer database, no accounts and no payment details, so there is very little here to lose. Ellipse Reply is separate: it does hold enquiry records, which is why it keeps them for only 30 days.

You can ask us to tell you what personal information we hold about you, correct it if it is wrong, or delete it. Email hello@ellipsestudio.com.au and we will respond within a reasonable time, normally a few business days.

We handle personal information in line with the Australian Privacy Principles. If you are unhappy with how we have handled your information, please tell us first so we can put it right. If we cannot resolve it, you can raise it with the Office of the Australian Information Commissioner at oaic.gov.au.

If this policy changes we will update it on this page and change the date shown above. Material changes affecting existing clients will be raised with them directly.

Questions about this policy, or about information we hold. Get in touch and we will answer properly.