Your information, looked after.

What personal information pylotstudio collects, why, who we share it with (including the AI tools we use), and how to reach us about it.

Version 2026-10-20c (updated 20 October 2026). Effective 20 October 2026.

This policy explains how pylotstudio handles your personal information when you visit pylot.studio, join our launch list, send us an enquiry, buy from us, or work with us through Mission Control, your project portal. We’ve written it in plain English. If anything is unclear, email contact@pylot.studio.

If you work with us, please read “AI tools and your files” below. It explains that the files you give us go into third-party AI tools, which may keep them and may use them to train AI.

Who we are

pylotstudio is an AI creative studio in Brisbane, Queensland, Australia. We make websites, digital templates, video and image content, and offer Template Setup and Website Care. pylotstudio is run by Ena Spitzenberg as a sole trader. In this policy, “we”, “us” and “our” mean pylotstudio.

The Privacy Act. Most small businesses, those with an annual turnover of A$3 million or less, aren’t covered by the Privacy Act 1988 (Cth), and pylotstudio is currently one of them, and we haven’t registered to opt in to being covered. That means the Australian Privacy Principles don’t legally bind us, and the Australian Information Commissioner generally can’t take complaints about us. We still aim for good privacy practice: we only collect what we need, tell you how we use it, keep it secure, delete it on the timetable below, and let you see, correct or delete what we hold. This policy describes what we actually do. If you’re worried about anything, email contact@pylot.studio (see “Complaints”).

AI tools and your files

Please read this before you send us anything. pylotstudio is an AI creative studio. To make your content, we use third-party AI tools, such as Higgsfield and other AI image, video, voice and content generation tools.

If you work with us:

Your files go into AI tools. The files, images, video, voice recordings, text and other material you give us (through Mission Control, email or share links) are uploaded to and processed by those third-party AI tools to create your content. That includes any people, faces or voices in that material.
Those providers may keep it and may use it to train AI. The AI tool providers may store your material, and may use it to train or improve their AI models, under their own terms and privacy policies. We don’t control those terms, and we can’t promise that your material won’t be used this way or that it can be deleted from their systems.
This may happen overseas. These providers may store and process your material outside Australia (see “Overseas disclosure”).
Only send what you’re happy to have used this way. Please don’t give us anything you don’t want used like this. Don’t include personal or sensitive information about other people unless they’ve agreed to it.
You need the rights to what you send. You must own, or have permission to use, everything you give us. That includes the permission of anyone whose image, likeness, name or voice appears in it (see “People in your files”).
Questions first? Just ask. If you’re unsure about a file, email contact@pylot.studio before you upload it and we’ll talk it through.

We ask for your consent separately. Before you can add files in Mission Control, we ask you to tick a separate box. It’s never ticked for you, and it isn’t part of agreeing to our terms. We record that you ticked it, when, and which version of this policy it relates to. Buying templates only doesn’t need it, because you don’t send us files.

The box explains what this section says, and one more thing: if you agree, we won’t have to take steps to make sure the overseas AI tool providers handle your information in line with the Australian Privacy Principles. They may not be bound by Australian privacy law, and if they mishandle your information you may not be able to seek a remedy under Australian law.

We can’t make your content without this consent, because every project uses these tools. If you don’t want to agree, or want to ask first, email contact@pylot.studio before you pay or upload anything. You can withdraw your consent at any time by emailing us. We’ll then stop putting new material into AI tools, but we can’t take back what’s already been processed, and we may not be able to finish your project.

People in your files

Your files may show or include other people, such as your staff, customers or family, or their faces, voices or names. Those people’s personal information goes into third-party AI tools too.

You need their permission. When you send us files, you confirm that everyone shown or heard in them has agreed to their image, voice or name being used to make your content with AI tools, as described in this policy. Ideally get a written release from each person. Our project brief asks you to confirm this before you submit it.
Children. Don’t send us images, video or voice recordings of anyone under 15 unless their parent or guardian has agreed. For anyone under 18, please check with their parent or guardian first.
If you appear in a client’s files. You can contact us at contact@pylot.studio to ask whether we hold your information, what we’re doing with it, or to ask us to delete it. We’ll stop using it in new work and delete our copies, unless we must keep a record by law. Copies already given to AI tool providers are handled under their own terms (see “AI tools and your files”).

What we collect

We only collect what we need. Depending on how you deal with us, that can include:

When you join our launch list (the email box on our pre-flight page at pylot.studio/pre-flight, and our Get Started page):

your email address
which page you signed up on, including any campaign tags in the link (such as utm_source). This tells us which ads and pages are working.

When you send an enquiry (the form on our home page):

your name, email and business name
the services you’re interested in, your budget range (optional) and your message.

The form sends your enquiry straight to us. If it can’t send, for example because of a connection problem, it opens your own email app with the enquiry filled in, and you choose whether to send it.

When you ask about Website Care (the Enquire pop-up on our Websites and Care pages): your email, your phone number if you give it, your order reference if you have one, the plan you’re asking about and the page you asked from.

When you order:

your name and email
what you’ve ordered
the currency and exchange rate used to show you prices
that you agreed to our terms, which version, and when
whether you’re happy for us to feature your work in our portfolio.

When you pay: card payments are handled by Stripe on Stripe’s secure checkout page. Your card details go straight to Stripe. We never see or store your full card number. Stripe tells us the payment went through and gives us limited details, such as the amount, your billing country or address, the card type and the last four digits.

After you order:

the project brief: your business, package, brand links, brief and deadline
upgrade requests: your name, email, the change you want and any notes.

In Mission Control (your project portal):

your brief answers, messages, revision feedback and approvals
a record of your project’s progress
the files and share links you upload, such as logos, photos, footage, fonts, testimonials and documents.

Files you upload can contain other people’s personal information, such as a customer’s photo or a person’s face or voice. Please only send these if you have that person’s permission, because they’ll go into third-party AI tools (see “People in your files”). Please never send passwords. The portal screens briefs and messages for anything that looks like one.

When you find your order or change your email:

Find my order: to look up your portal, you enter your order number and email. To stop people guessing, we limit repeated attempts using a scrambled (hashed) form of your internet (IP) address.
Changing your order email: we send a code to your old address and one to your new address.

For website builds:

details about your domain and existing site
your page content and, for online stores, your product list.

If you invite us into your Shopify store, we may be able to see your store’s own data, including your customers’ details. We only use that access to build and look after your site.

When you browse our site:

Logs: our host keeps standard technical logs, such as IP addresses, browser type and the pages requested, for a limited time.
Visit statistics: some pages use Cloudflare Web Analytics, which counts page views and measures page speed without cookies (see “Cookies and browser storage”).
Spam checks: our host screens website form entries for spam before they reach us.
Fonts and video: some of our pages load a font from Google Fonts and, on larger screens, a background video from a content delivery network (Amazon CloudFront). As with any web request, those services see your IP address and browser details when your browser fetches the file. They don’t receive anything you type into our forms.
Your country: our host works out which country you’re in from your connection, so we can show prices in your currency (see “Cookies and browser storage”).

What we don’t collect: we don’t ask for sensitive information, such as health details. Please don’t include it in your brief.

Staying anonymous: you can browse our site without telling us who you are, and you’re welcome to ask us general questions without giving your full name. We do need your real name and email to take an order and run your project.

How we collect it

Directly from you, through our website forms, checkout, Mission Control and email.
From Stripe, when it confirms your payment.
Automatically, through our host’s logs, Cloudflare Web Analytics, the country cookie, and your browser’s storage (see below).
From your own accounts, such as your Shopify store, but only when you give us access.

Why we collect it and how we use it

We use your information to:

reply to your enquiry or Website Care question
email you when you join our launch list (usually a welcome email shortly after you sign up), and tell you when we launch
take payment, deliver your order, and run your project and portal
make your content, using third-party AI tools (see “AI tools and your files”)
send you updates about your order
issue invoices and receipts, and keep business and tax records
give you support, and keep your portal secure
show your work in our portfolio, but only if you’ve said yes
understand which pages and ads bring people to us (campaign tags on launch-list sign-ups only), and how many people visit our pages and how fast they load (Cloudflare Web Analytics, totals only)
meet our legal obligations.

Portfolio permission is optional. You can withdraw it at any time by emailing contact@pylot.studio.

Emails from us and opting out

Order emails: if you order, we’ll email you about your order and project. These aren’t marketing.
Launch list: if you join our launch list, we’ll usually send you a welcome email shortly after you sign up, and we’ll tell you when we launch. We send nothing else to the list. Every email says who it’s from. To unsubscribe, reply “unsubscribe” to any of our emails or email contact@pylot.studio. We’ll take you off the list within 5 business days and won’t email you again unless you sign up again.
Other marketing: we don’t send any. If that changes, we’ll only send it with your consent, and every email will include a way to unsubscribe.

We don’t sell your personal information or share it with anyone for their own marketing.

We use a small number of service providers to run pylotstudio. We only share what each one needs to do its job for us:

Netlify: hosts our website, receives our website forms (and screens them for spam), runs checkout and portal functions, and stores portal orders and files. Receives: form entries, order and portal data, uploaded files, technical logs.
Stripe: processes card payments. Receives: your payment details (directly from you), name, email, order details.
Google Workspace: our email (contact@pylot.studio). It also sends the launch-list welcome email, and we check our sent mail so nobody gets the welcome twice. Receives: emails you send us, copies of form entries, and emails we send you.
Make: runs our automations. It receives copies of our website form entries so we can track enquiries and orders, and sends the launch-list welcome email through our Google Workspace email. Make keeps a short log of each run. Receives: form entries (for example name, email, phone, message); for the launch list, your email and the page you signed up on.
AI tools (such as Higgsfield and other AI image, video, voice and content generation tools): create your content from your brief and files. They may store what we upload, and may use it to train or improve their AI models under their own terms. Receives: the files, images, video, voice recordings, text and brief details you give us for your content, including any people, faces or voices in them.
Cloudflare: runs the domain name system (DNS) for pylot.studio, and provides Cloudflare Web Analytics on some pages. Website traffic doesn’t pass through Cloudflare. Receives: nothing you type into our forms. For analytics: the page you’re on, the site that referred you, page-load timings, and your IP address and browser details when your browser sends the statistics (see “Cookies and browser storage”).
Google Fonts and Amazon CloudFront: deliver a font and a background video on some pages. Receives: your IP address and browser details when your browser loads the file.

AI tool providers handle your material under their own terms, which we don’t control, and they may use it for their own purposes, such as training their AI models. See “AI tools and your files”.

We may also share information with our professional advisers, such as our accountant or lawyer, or when the law requires it.

Overseas disclosure

Some of our providers store or process information outside Australia, mainly in:

the United States: Netlify, Google (Workspace and Fonts), Stripe, Amazon CloudFront, Cloudflare (analytics), and AI tools such as Higgsfield
the European Union: Make. Our Make automations run in its EU region.
other countries: the AI tools we use may store and process your material wherever they or their own providers operate, and that can change from tool to tool.

Some providers may also use servers in other countries where they or their sub-processors operate. We choose established providers and only share what each one needs. For our hosting, email, payment and automation providers, we rely on their standard data protection terms. AI tool providers use your material under their own terms, which we don’t control, and the overseas laws that apply may not protect it in the same way as Australian law. Cloudflare stores analytics data mainly in the United States and the European Economic Area, and may access it from other countries where it operates.

How we keep it safe

Secure connections: our site and portal use secure (HTTPS) connections.
Private portal links: each project portal opens with a private link that’s unique to your order.
Expiring download links: portal file links expire after one hour, and template download links after 24 hours.
Find my order: limits repeated attempts and never confirms whether an email is on file.
Changing your order email: needs a code sent to your old address and one sent to your new address.
Password screening: briefs and messages are screened for passwords.
Team access: the team portal needs a sign-in.

No system is perfect. If a data breach is likely to cause you serious harm, we’ll tell you as soon as we can, along with what you can do to protect yourself.

How long we keep it

Final files in Mission Control: deleted automatically 90 days after final delivery (for website builds, after launch). Mission Control shows the deletion date and warns you 14 days and 3 days before. Please download your own copies in time. If you need them again later and we still have a copy, we can send them again for A$47 per order. It’s free if the problem is on our side. We can’t promise we’ll still have a copy after the 90 days.
Files you upload in Mission Control (logos, photos, footage, fonts, documents and other brief materials, and any share links you paste): automatically deleted from Mission Control and its file storage 60 days after you upload each one, or 60 days after final delivery (for website builds, launch), whichever is later. If we close a project before it’s delivered (for example, because it’s been on hold too long), the 60 days run from the date we close it instead. Nothing you upload is deleted before final delivery or closure. For monthly retainers, the date is 60 days after that month’s delivery. Mission Control shows the deletion date next to each file once it’s set. We keep a deletion log with file references and dates only, not the files or their contents. If we still need a file after that, we’ll ask you to upload it again. Copies of your files in our email, Google Drive and working folders (including files you send us by email or share link) aren’t deleted automatically. We clear them by hand on the same schedule: our team portal reminds us when an order’s uploads are deleted, and again 60 days after delivery or closure. You can also ask us to delete them at any time. Copies already given to third-party AI tools are kept under those providers’ own terms, which we don’t control (see “AI tools and your files”).
Order, payment and invoice records: kept for at least 5 years, as Australian tax law requires.
Enquiries and Website Care questions that don’t become orders: kept for up to 2 years, then deleted from our forms inbox, Make and email.
Launch list: until you unsubscribe, or 12 months after we launch, whichever comes first.
Portal messages and project history: kept with your order records, for at least 5 years. Portal messages are text only and can’t carry files, so this doesn’t extend how long we keep your uploads.
Portfolio permission: until you withdraw it.
Technical logs and automation run logs: kept for a limited time by our host and Make, then deleted automatically.

When we no longer need information, we delete it or de-identify it.

Cookies and browser storage

We keep this to a minimum:

Country cookie: one cookie, pylot_country. It holds only your two-letter country code, so we can show prices in your currency, and lasts one day.
Your browser’s storage (stays on your device):
- your cart, and the brief you’re writing in Mission Control, are saved in your browser so they’re still there when you come back
- on our Get Started page, a note that you’ve already signed up, so the page stays unlocked for you
- checkout details, Website Care checks and price settings are kept only for the current browser tab
- clearing your browser data removes all of this.
Analytics (Cloudflare Web Analytics): some pages of pylot.studio use Cloudflare Web Analytics to count visits and page views, see which sites send people to us, and check how fast our pages load. Cloudflare Web Analytics doesn’t set cookies or use your browser’s storage, and Cloudflare says it doesn’t fingerprint or track individual visitors. Our reports show totals only, such as page views, the pages viewed, referring sites, countries, device types and browsers. They don’t tell us who you are. As with any web request, Cloudflare sees your IP address and browser details when your browser loads the analytics script. No advertising trackers: we don’t use advertising pixels or social media trackers on pylot.studio, and we’ll update this policy before we add any. The font and video services mentioned above don’t set cookies on our site.
Stripe Checkout: when you pay, you’re on Stripe’s secure checkout page, which uses its own cookies, for example to prevent fraud.

Seeing and correcting your information

You can ask us for a copy of the personal information we hold about you, or ask us to correct it or delete it. Email contact@pylot.studio. We may need to check it’s you first. We’ll reply within 30 days. We don’t charge for this. If we can’t do what you ask (for example, because we must keep tax records, or because a copy is held by an AI tool provider under its own terms), we’ll tell you why.

Complaints

If you’re worried about how we’ve handled your personal information, email contact@pylot.studio and tell us what happened. We’ll look into it and reply within 30 days.

If you’re not happy with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. The OAIC can generally only investigate businesses covered by the Privacy Act.

Contact

Privacy questions, access requests and complaints:

Email: contact@pylot.studio

Changes to this policy

We’ll update this policy when the way we handle information changes. The version and date at the top show the latest version.