Who we are
che.studio is operated by Cheyanne. For the GDPR, we are the data controller. For the Australian Privacy Act 1988 (Cth), this notice is our APP privacy policy. Contact: hello@che.studio.
What we collect
- Brief form: your name, email, business name and website (optional), the service, budget band, timeline and region you choose, what you write about the job, and your browser's user-agent string.
- Email and calls: whatever you choose to send us, and booking details if you use the calendar.
- Client work: information you give us to deliver a project, under the terms of that engagement.
Why, and the legal basis
| Purpose | GDPR basis |
|---|---|
| Replying to your brief or email | Steps you ask us to take before a contract (Art. 6(1)(b)) |
| Delivering and invoicing work | Contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c)) |
| Keeping the site secure and spam-free | Legitimate interests (Art. 6(1)(f)) |
| Understanding which pages are useful | Legitimate interests, using anonymous data only (Art. 6(1)(f)) |
We don't use your information for automated decision-making, and we don't add you to a mailing list.
Who processes it for us
- Supabase: database for brief submissions, hosted in Dublin, Ireland (EU).
- Resend: sends the notification emails.
- Cloudflare: website hosting.
- Cal.com: call bookings, only if you choose to open the calendar.
Some of these providers are based in, or may access data from, the United States. Where personal data leaves the EU/EEA, transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. For Australian residents, we take reasonable steps under APP 8 to make sure overseas recipients handle your information consistently with the APPs.
How long we keep it
- Briefs that don't become projects: deleted after 24 months.
- Client and invoicing records: kept as long as tax law requires (5 years in Australia, up to 10 years in Portugal).
- Anything else: deleted when it's no longer needed, or sooner if you ask.
Cookies and storage
Cal.com may set its own cookies when the calendar loads.
Your rights
You can ask to access, correct or delete your personal information, to restrict or object to how we use it, to get a copy in a portable format, and to withdraw consent at any time. Email hello@che.studio and we'll respond within 30 days.
If you're unhappy with our response, you can complain to the Office of the Australian Information Commissioner (Australia) or to your local EU supervisory authority, such as the Comissão Nacional de Proteção de Dados in Portugal.
Security
Data is encrypted in transit and at rest. Access to the brief database is restricted to server-side code and to us, with row-level security on and two-factor authentication on every account that can reach it.
Changes
If this notice changes in a way that matters, the date at the top changes and the previous version is available on request.