Privacy policy.

ONARA Studios (ABN 86 749 370 022) is a Western Australian web design studio. If you have any question about this policy or about information we hold about you, contact us at onarastudios@outlook.com or on 0477 390 479.

Enquiry forms. When you enquire through our website we ask for your name, email, phone number, business details and a message about what you need. You choose what to include. The only information saved with your enquiry is what you type into the form: we do not attach your IP address, device details or location to it.

Technical information. Like every website, the infrastructure that delivers our pages briefly processes basic technical information about each visit, such as an IP address, in order to serve the page, keep the site secure and prevent abuse. We do not use this to identify visitors.

Client onboarding. Accepted clients complete an onboarding form covering business information (such as ABN, licence details, services and service area), website content, and uploads like logos and photos of your work. This is the material we build your website from.

Our own notes. We keep simple working notes against enquiries, such as follow-up reminders and quote amounts, so we can manage projects properly.

Payments. ONARA Care subscriptions are processed by Stripe on Stripe's own secure checkout. Full card numbers and security codes stay with Stripe and never reach our website. Stripe provides us with the information needed to run your subscription, such as your name, the amount paid, your subscription status and limited billing details.

To respond to your enquiry, recommend the right package, quote and scope your project, build and support your website, administer ONARA Care subscriptions, keep proper accounts and tax records, keep the website secure, meet legal obligations, and, when analytics are running, understand how the website is used. We do not sell personal information and we do not add you to marketing lists you did not ask for.

Form submissions and uploaded files are stored with Supabase, our database and file-storage provider, in its Sydney (Australia) region, with uploads kept in a private bucket that is not publicly accessible. Submissions are also delivered to our business email inbox, hosted by Microsoft (Outlook), where they are handled like ordinary business email. Our website is hosted by Vercel, notification emails are delivered via Resend, and ONARA Care payments are handled by Stripe. If analytics or advertising measurement are running, Google and Meta also process the visit information described under Cookies and analytics below. Some of these providers store or process data outside Australia, including in the United States.

Retention of our stored records is enforced automatically by a scheduled cleanup job, not left to memory:

• Project enquiries: deleted from our database 12 months after they are received, unless you become a client.
• Onboarding information and uploaded files: deleted from our database and file storage 60 days after submission. By then your website is live and the original copies are no longer needed.
• Client and business records: kept as long as Australian tax and business record-keeping rules require.
• Email correspondence: enquiry notifications and replies sit in our business inbox and are kept like ordinary business email, separately from the schedules above.

The scheduled deletions clear our active database and file storage. Content we have built into your website naturally remains part of your website, and our service providers may hold their own routine backups for a limited period.

The only cookie our website itself sets is a login cookie for our own admin area, which visitors never receive. Basic page statistics come from Vercel Web Analytics, which is designed to report aggregated statistics without cookies and without identifying individual visitors.

We may use Google Analytics and the Meta (Facebook) pixel to understand how people find our website and to measure advertising. When these tools are running, they set cookies that report pages visited, approximate location and how you reached us, and Google and Meta process that information under their own privacy policies. We do not pass them the details you type into our forms. You can limit these tools through your browser's cookie settings, Google's Ads Settings and Meta's ad preferences.

We only publish client names, testimonials and project details with the client's permission. If we have published something about you or your business and you would like it changed or removed, tell us and we will sort it out.

You can ask us at any time to show you the information we hold about you, correct it, or delete it ahead of the schedules above. Email onarastudios@outlook.com and we will respond within 30 days, usually much sooner. We may first need to verify you are who you say you are before releasing or changing personal information. The only records we cannot delete early are those the law requires us to keep, such as tax records.

The website is served over HTTPS and uploaded files live in private storage accessed through expiring links. Within the studio, stored information is accessible only to the owner. Our technology providers process information where needed to deliver their services, under their own security practices. No system is perfectly secure, so we also deliberately collect little and delete on a schedule, which limits the impact any incident could have.

If you think we have mishandled your information, contact us first. We will acknowledge your complaint, investigate what happened, and come back to you with the outcome and any corrective action, normally within 30 days. If you are not satisfied with our response, and the Privacy Act 1988 applies to the activity involved, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If how we handle information changes, this page changes with it, and the date at the top tells you when. Significant changes will be noted here rather than buried.