Privacy policy

Last updated October 2026

This policy explains how Cosmosis Studio Pty Ltd (ABN 44686204008) collects, uses and protects personal information when you visit cosmosis.studio or work with us. We follow the Australian Privacy Principles and, for visitors and clients in the UK and EU, the GDPR.

What we collect

• Information you give us: your name, job title, company, email and anything else you include when you contact us, book a call or become a client.

• Project information: the materials, account access and feedback you share during an engagement. Occasionally this includes personal information about your customers or team, such as analytics data or form submissions.

• Billing information: the details needed to invoice you. Card payments are handled by our payment provider, and we never see or store full card numbers.

• Website data: limited technical information such as your browser, device, approximate location and the pages you visit, collected through cookies and analytics.

How we use it

We use your information to reply to enquiries, deliver and manage our services, send invoices, keep records the law requires, and improve our website. If you subscribe to Insights updates, we’ll email you new articles, and you can unsubscribe at any time.

Legal basis

Where the GDPR applies, we rely on:

• contract: to deliver services you’ve engaged us for

• consent: for example, a newsletter subscription

• legitimate interests: such as replying to an enquiry or keeping our systems secure

• legal obligation: such as keeping tax records

Who we share it with

We share information only with the providers that help us run the business, and only what each one needs. These include our website platform (Framer), email, scheduling, file storage, accounting and payment tools, and AI tools. We may also disclose information when the law requires it. We never sell or rent personal information.

AI tools

When AI tools are used in client work, we only work with tools whose settings stop your data being used to train their models. Confidential material never goes into an AI tool without your written approval. Our AI use policy explains this in more detail.

Where your data is stored

Several of our providers are based in, or store data in, the United States and other countries outside Australia. When information leaves Australia, the UK or the EU, we rely on providers that offer recognized safeguards, such as standard contractual clauses.

How long we keep it

• Enquiries that don’t lead to work: up to two years.

• Client project files: for the length of the engagement plus two years.

• Financial records: at least five years, as Australian tax law requires.

After that, we delete or anonymize the information.

Security

We protect information with secure, access-controlled accounts, two-factor authentication and providers that encrypt data. Only Cosmosis and the contractors working on your project can access it.

Cookies

Our website uses cookies for basic functionality and to understand how visitors use it. You can block or delete cookies in your browser settings, and the site will still work.

Your rights

You can ask to see, correct or delete the personal information we hold about you. You can also object to or restrict how we use it, withdraw consent, or ask for a copy in a portable format. We’ll reply within 30 days.

Complaints

If you’re unhappy with how we’ve handled your information, contact us first and we’ll try to put it right. If we can’t, you can contact the Office of the Australian Information Commissioner (oaic.gov.au), or your local data protection authority if you’re in the UK or EU.

Changes to this policy

We’ll post any updates on this page and change the date at the top.

Contact

Email michael@cosmosis.studio with any privacy questions or requests.