Privacy policy.

This website is operated by ArmoniaLabs, a sole-trader business registered in Australia under the business name “ArmoniaLabs” (ABN 81 392 893 669), with a principal place of business in New South Wales, Australia. In this policy, “we” and “us” mean ArmoniaLabs.

We voluntarily comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth), even where the small-business exemption would otherwise apply to us. For visitors in the United Kingdom or the European Economic Area, we also apply the principles of UK GDPR and EU GDPR where relevant.

• Contact form submissions: your name, email address, business name if you provide one, the topic you selected, and the message you write. You choose what to include.
• Communications: any email you send us, and the replies we send back.
• Analytics: anonymous, cookieless page-view data from Vercel Web Analytics (visited page, country, referrer, device type). No personal identifiers, no cross-site tracking.
• Server logs: basic request metadata (IP address, user-agent, timestamp, endpoint) retained by our hosting provider for security and debugging.

We do not run advertising pixels, behavioural tracking, or fingerprinting on this site.

To respond to your enquiries, improve what we write and publish here, and keep our infrastructure secure. Under UK and EU GDPR, our legal bases are (a) our legitimate interests in running a functional business website and responding to people who contact us, and (b) your consent when you voluntarily send us a message. You can withdraw consent at any time without affecting processing that happened before you withdrew.

Contact form submissions are transmitted to us via email and stored in the inbox of the founder at claudio@armonialabs.com, hosted on Google Workspace. Website hosting and analytics are served from Vercel’s global edge network; the primary region for visitors from Australia is Sydney (syd1). Email delivery is handled by Resend. See section 5 for the full list.

Inside our organisation, access to your information is limited to the founder. As the studio grows, access expands only to operators on a need-to-know basis.

We use the following third-party subprocessors:

• Vercel — hosts the website and collects anonymous analytics. Data resident in multiple regions including Sydney. Vendor incorporated in the United States.
• Resend — delivers transactional email (contact form replies). Incorporated in the United States.
• Google Workspace — receives and stores the email copy of your contact submission. Incorporated in the United States.
• Cloudflare — provides DNS resolution for the domain. Incorporated in the United States.

Several of our subprocessors are incorporated in the United States. For visitors in the EU and UK, we rely on the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses with each relevant subprocessor. For visitors in Australia, we take reasonable steps under APP 8 to ensure overseas recipients handle your information consistently with the APPs.

Copies of the executed transfer instruments are available on written request to claudio@armonialabs.com.

You have the right to:

• Access the personal information we hold about you.
• Ask us to correct information that is inaccurate or out of date.
• Ask us to delete your personal information, subject to legal retention obligations.
• Ask us to transfer your personal information to you or to another service, where technically feasible.
• Object to processing based on our legitimate interests.
• Withdraw consent for processing based on consent.
• Lodge a complaint with a privacy regulator.

To exercise any of these rights, email claudio@armonialabs.com. We respond within 30 days.

Contact form submissions are kept while they are useful for answering you and for a reasonable follow-up period, then deleted on request or within 24 months by default. Server logs are retained by our hosting provider for up to 12 months.

Data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted by the storage provider. We follow the principle of least privilege for operator access and keep audit logs where available.

If a security incident exposes any personal information, we will notify affected people in line with the Notifiable Data Breaches scheme under the Privacy Act 1988, and the equivalent obligations in the UK GDPR and EU GDPR, typically within 72 hours of confirming a reportable incident.

This website does not set tracking cookies. Vercel Web Analytics is cookieless by design. We may set a small number of strictly necessary technical cookies if required for features we add in future (for example, remembering a theme preference). We will update this section and, where required, ask for your consent before enabling anything non-essential.

This is a business website. It is not directed to children and we do not knowingly collect information from anyone under 16. If you believe we hold information about a child, contact claudio@armonialabs.com and we will delete it.

If you are unhappy with how we have handled your personal information, email claudio@armonialabs.com first. We will acknowledge within five business days and respond substantively within 30 days. If you are not satisfied with our response, you can complain to:

• Australia: Office of the Australian Information Commissioner (OAIC), oaic.gov.au.
• United Kingdom: Information Commissioner’s Office (ICO), ico.org.uk.
• European Economic Area: your national data-protection authority.

We update this policy when the service or the law changes. The current version is always on this page with the “last updated” date at the top.

Privacy questions and rights requests: claudio@armonialabs.com.