Privacy Policy

1. Who we are

Studio Terra Florals is a sole trader business based in Sydney, NSW, Australia (ABN 24126034534). We operate studioterraflorals.com and sell preserved and dried floral arrangements online and by commission.

For privacy enquiries, contact us at: studioterra.florals@gmail.com

2. Information we collect

• Order & enquiry data: name, email address, phone number, and delivery address — collected when you place an order, submit a custom enquiry, or contact us directly.
• Payment details: processed entirely by Square Payments. We do not receive, store, or have access to your card number, CVV, or full payment credentials.
• Email address: collected when you subscribe to our mailing list, with your explicit consent.
• Sage chat & custom orders: if you use Sage, our chat assistant, we keep the conversation, and if you start a custom order we collect the details you provide — occasion, budget, colours, delivery address, and any inspiration photos you upload.
• Giveaway & partner sign-ups: name, email address, and Instagram/social handles when you enter a giveaway or join our partner program.
• Anonymised session analytics: a randomly generated session ID, pages visited, time on page, and the referring website. No personally identifiable data is collected in our own analytics.
• Advertising measurement: we advertise on Google, and use the Google tag to measure which ads lead to enquiries, sign-ups and orders. This sets cookies in your browser and shares limited, non-identifying event data (such as the fact an enquiry was submitted, and its value) with Google. It is not used on our admin pages. You can opt out of personalised Google advertising at adssettings.google.com, and control cookies through your browser settings.

3. How we use your information

• Processing and fulfilling your order or commission
• Communicating with you about your order, enquiry, or arrangement
• Sending promotional or newsletter emails — only to addresses that have opted in
• Improving the website through anonymised, aggregate analytics
• Measuring which advertising brings people to us, so we spend on what works
• Meeting our legal and tax obligations

4. Disclosure to overseas recipients (APP 8)

We use third-party service providers that may store or process your data outside Australia. By using our website or placing an order you consent to this cross-border transfer.

• Square Payments (United States) — payment processing and checkout
• Resend (United States) — transactional and marketing email delivery
• Twilio (United States) — SMS order notifications
• OpenAI (United States) — generating replies for Sage, our website chat assistant, plus AI-assisted invoice parsing and content drafting in our admin tools
• Vercel Inc. (United States) — website hosting, serverless functions, and data storage

We take reasonable steps to ensure each provider maintains appropriate data security practices.

5. AI-assisted features

Sage, our website chat assistant, is AI-powered. The messages you type in the chat are sent to OpenAI (United States) to generate Sage's replies. Please don't share sensitive information in the chat — Sage will never ask for card details or payment credentials. When you place a custom order through Sage, the order details themselves (your name, email, delivery address and photos) are collected and stored by our own systems and are not sent to OpenAI.

Our administration system also uses OpenAI to assist with parsing supplier invoices and drafting product descriptions and blog posts. All AI-generated content is reviewed by a human before publication.

6. Analytics

We operate our own lightweight analytics using anonymised session identifiers. We record which pages are visited, time spent on each page, and the referring website. No personally identifiable data is recorded. No third-party analytics platforms (such as Google Analytics) are used on this website.

7. Email marketing — Spam Act 2003

We only send marketing emails to addresses that have explicitly opted in. Every marketing email contains a clearly visible unsubscribe link. We honour all unsubscribe requests promptly. We do not purchase, rent, or share email lists.

8. Data retention

• Order records: retained for 7 years to meet Australian Taxation Office requirements.
• Subscriber email addresses: retained until you unsubscribe or request deletion.
• Analytics events: retained for approximately 90 days.
• Enquiry messages: retained for up to 2 years, then deleted.
• Sage chat conversations: abandoned chats with no contact details are deleted after about 30 days; conversations where you shared contact details after about 90 days. Inspiration photos are deleted with the conversation. Chats that become orders are kept with the order record.

9. Security

All data is transmitted over HTTPS. Our administration system is password-protected. We do not store card numbers or any payment credentials — Square's PCI-compliant infrastructure handles all payment data.

10. Your rights

Under the Australian Privacy Act 1988, you have the right to access, correct, or request deletion of personal information we hold about you. Email studioterra.florals@gmail.com and we will respond within 30 days.

11. Complaints

If you believe we have breached the Australian Privacy Principles, please contact us first at studioterra.florals@gmail.com. If unsatisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Notifiable Data Breaches

We comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. In the event of an eligible data breach likely to result in serious harm, we will notify affected individuals and the OAIC as required by law.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision.