Back to Home Legal

Privacy Policy

Last updated 15 November 2026

This policy explains what personal information Red Center Studio collects through redcenterstudio.com and while working with clients, how it is used, who it is shared with, and the choices you have. Red Center Studio is based in Queensland, Australia, and aims to handle personal information in line with the Australian Privacy Principles. Visitors from the European Union and the United Kingdom also have the rights described in section 10.

1. Who we are

Red Center Studio ("we", "us") is an independent studio based in Queensland, Australia, that builds websites, web apps and AI systems and publishes app templates and plugins.

For any privacy question or request, email Hello@redcenterstudio.com.

2. Information you give us

We only collect what you choose to send us:

Project enquiries: your name, email address, what you need, your project details, links you share, your timeline and budget if you give them, and any notes.
Quick-fix and setup briefs: your name, email address, a description of the job, any error message, a link to your website or app, links you share, how you will share access, and the answers to that service's questions (for example your business name, the tools you use, or the names and email addresses of team members you ask us to set up).
Template support requests: your name, email address, the template, your app's name, what happened and any error message.
Emails you send us, and the details you share during a project.
PreStart Pro waitlist: your email address, used only to send you one email when PreStart Pro launches.
App purchases (PreStart Pro, CatchDesk, Housemoot and Binwright): your name, email address and the GitHub username you enter at checkout, used to give your GitHub account access to the code, email your licence and help you with it.
Payments: when you pay through Stripe, Stripe processes your card details. We receive your name, email address, the amount and the payment status, never your full card number.

3. Information collected automatically

Security and hosting data: our website runs on Cloudflare. To deliver pages, prevent abuse and keep the site secure, Cloudflare processes technical information such as your IP address, browser type and the pages requested. Our hosting keeps short-term request logs for troubleshooting.
Bot checks: some forms use Cloudflare Turnstile, which checks browser and device signals to confirm you are a person. It is not used for advertising.
Rate limiting: the free GEO audit and the Single Point of Failure Scanner, on our pages and through our free tools MCP server, limit how many checks one connection can run, using your IP address only for that check. The scanner's hourly count is kept under a one-way coded form of your IP address, not the address itself, and expires after an hour.
Website analytics: we use Cloudflare Web Analytics, and a small first-party counter on our own servers, to understand how the site is used. The counter records the page, the language, the campaign tags in the link (such as utm_source), the site that referred you, your country, and whether a Google Ads click identifier was present (the identifier itself is not stored), together with actions such as starting a checkout, clicking the booking link or sending a form. It recognises a browser only within one day, using a one-way code made from your IP address and browser details that changes every day, so it cannot follow you across days or other websites. It sets no cookies, stores nothing on your device, and does nothing if your browser sends Do Not Track or Global Privacy Control. Events are deleted after 13 months. We only use the results to see which pages and campaigns work.

We do not use advertising trackers, and our own pages do not set cookies. Stripe's payment pages may use their own cookies.

4. The free tools

GEO audit: when you enter a website address, we fetch that public page and a few public files (robots.txt, sitemap.xml and llms.txt) to produce the report. The audited page, its contents and the results are not stored.
Emailed audit copies: if this option is available and you choose it, we store your email address, the audited address, the score, your consent and the time, so we can send the report and follow up once. You can ask us to delete this at any time.
Single Point of Failure Scanner: when you enter a domain, we look up its public DNS records through Cloudflare's public DNS over HTTPS service. Results are cached for one hour so repeat scans are fast, then discarded. Scanned domains are not stored.
Emailed scan copies: if you ask for a copy of a scan and tick the consent box, we store your email address, the scanned domain, the score, your consent and the time, so we can send the report and follow up once. Turnstile checks the request. You can ask us to delete this at any time.
Error decoder: on our decoder page, the text you paste is matched in your browser and is not sent to us. Through our free tools MCP server (below), the text is sent to our server, matched and returned, and is not stored.
WebDesk: we store the business details you enter (business name, services, location, tone, palette, optional notes and the optional public email and phone you want on your site), the website generated from them, and your change notes if you use the redo. To limit free previews, we store a one-way coded form of your IP address, not the address itself. For paid websites, Stripe gives us the email address you used at checkout, which we use only to send your delivery email. The details you enter are sent to Anthropic, whose Claude models write the copy. We also store the language you chose for your pages and your website and, when you check out, the time you ticked the boxes asking for immediate delivery and, if you added setup, an early start to the setup.
WebDesk setup add-on: if you add setup at checkout, we store the answers you give about your domain and setup with your order, and email them to our own inbox so we can do the work. They are deleted with your website, 30 days after delivery.
WebDesk API keys: we store the name you give the key, a one-way fingerprint of the key (not the key itself) and a one-way coded form of your IP address to limit sign-ups. When you buy credits, Stripe gives us the email address used at checkout, which we keep with the order for receipts, support and tax records.
Free tools MCP server and the website-checks plugin: AI assistants such as Claude can call the GEO audit, the Single Point of Failure Scanner and the error decoder through our MCP server at https://redcenterstudio.com/api/tools/mcp, including through our website-checks plugin for Claude. We receive only what the assistant sends for each call: the website address, domain or error text, plus the technical details any web request carries, such as your IP address. These are handled exactly as for the same tools on our pages: not stored, except the one-hour scan cache and the rate limits described above. There are no accounts, and we do not receive or keep your conversation with the assistant.
WebDesk MCP server and the webdesk plugin: when an AI assistant builds a website for you through WebDesk, the business details it sends are handled as described for WebDesk and WebDesk API keys above.
Plugins for Claude: the skills in our plugins run inside your AI assistant and send nothing to us. Data reaches us only through the MCP server calls described above. Your AI assistant provider handles your conversation under its own privacy policy.

5. How we use your information

To reply to your enquiry and prepare quotes, diagnoses and plans.
To deliver the work you have asked for, including accessing your app or accounts where you give us access.
To take payments, keep business and tax records, and meet our legal obligations.
To provide support for templates and plugins.
To keep the website secure and prevent misuse.

We do not sell your personal information, and we do not use it for advertising.

6. AI-assisted work

Our work, and the information you send us for it, may be reviewed and processed with frontier AI models, such as those provided by Anthropic and OpenAI, to help prepare diagnoses, plans, code and content. A person supervises this work and does the final checks before anything is delivered.

WebDesk is different: it is automated, and its copy is written by Anthropic's Claude models from the details you enter, without a person reviewing each website before delivery.

AI assistants we run for clients are different too. When a business uses one of our AI Assistant plans, the conversations its customers have with the assistant are handled on that business's behalf: they are stored on Cloudflare and processed by Anthropic's Claude models to write the replies, without a person reviewing each reply first. The business decides what the assistant asks for, and the business's own privacy policy applies to its customers.

Where an AI provider offers a choice, we choose settings that do not allow your information to be used to train its public models. Please do not send passwords or other secrets in forms or emails. We will arrange a secure way to share access when it is needed.

We share personal information only with service providers that help us run the business, and only as far as needed:

Cloudflare: website hosting, website analytics, database storage of form submissions, email routing and security.
Stripe: payment processing.
GitHub: when you buy one of our apps, we send your GitHub username to GitHub to invite you to the private code repository.
Our email provider: to receive and reply to your messages.
AI model providers, as described in section 6.
Platforms you ask us to work on (for example Bubble® or Cloudflare accounts you own), within the access you give us.

Their privacy policies: Cloudflare https://www.cloudflare.com/privacypolicy/ , Stripe https://stripe.com/privacy , GitHub https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement , Anthropic https://www.anthropic.com/legal/privacy , OpenAI https://openai.com/policies/privacy-policy/ .

We may also disclose information if the law requires it, or to protect our rights or someone's safety.

8. Storage outside Australia

Some of our providers store or process information outside Australia, including in the United States and other countries where they operate. We use established providers with recognised security practices.

9. How long we keep information

Enquiries that do not go ahead: deleted when no longer needed, usually within two years.
Client and project records: kept for as long as needed to provide the work and support it, and for at least five years where Australian tax law requires records to be kept.
GEO audit results: not stored.
Single Point of Failure Scanner results: cached for one hour, then discarded.
WebDesk: unpaid previews are deleted after 7 days. Paid websites, the details you entered and your checkout email are deleted 30 days after delivery. A record of the order without your email is kept for tax purposes.
WebDesk API keys and credit purchases: kept while the key is in use, and credit purchase records (including the checkout email) for at least five years where Australian tax law requires records to be kept.
PreStart Pro waitlist: deleted once the launch email has been sent, or sooner if you ask.
AI Assistant conversation logs: kept while the plan is active, so the business can review them, and deleted within 30 days after the plan ends, once any export the business asked for has been sent.
App purchases: kept for as long as you have access to the code, and purchase records for as long as tax law requires.
Free tools MCP server calls: not stored, apart from the one-hour scan cache and rate limit counts that expire within an hour.

You can ask us to delete your information at any time, subject to what we must keep by law.

10. Your rights and choices

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. Email Hello@redcenterstudio.com and we will respond within 30 days.

If you are in the European Union or the United Kingdom, you also have the right to restrict or object to our use of your information, to receive a copy in a portable format, and to withdraw consent where we rely on it. We rely on your request (to answer enquiries), our contract with you (to do the work), our legal obligations (records), and our legitimate interest in running and securing the business.

11. Security

We take reasonable steps to protect personal information, including HTTPS across the site, restricted access to stored submissions, and security checks on our forms. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

To report a security vulnerability in our website, apps, MCP servers or plugins, email Hello@redcenterstudio.com with "Security" in the subject. We acknowledge reports within 5 business days and investigate every one.

12. Children

Our website and services are intended for adults and businesses, and are not directed at anyone under 18.

13. Complaints

If you have a concern about how we have handled your personal information, please email Hello@redcenterstudio.com first and we will try to resolve it.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. If you are in the European Union or the United Kingdom, you can contact your local data protection authority.

14. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Significant changes will be noted on this page.

Questions about this page? Email Hello@redcenterstudio.com.