What I do with your information

Who I am

Doxasi Studio is a one-person studio in Brisbane, Australia. I build AI agents for small businesses, and I do music production and video post-production. I do the work myself, and you can reach me through the contact page.

Visiting this website

This site has no analytics, no tracking and no advertising, and I set no cookies.

Two other companies are involved when a page loads:

• Fonts come from Google. Loading them tells Google your IP address and roughly what browser you are using.
• Cloudflare serves the site. It keeps short-lived technical records of requests to keep the site up and block attacks. It may set its own cookie to tell real visitors from automated traffic.

Sending me a message

If you fill in a form here, it goes through a service called Web3Forms and arrives as an email in my inbox. I receive what you typed: usually your name, your email address and your question. I keep it while we are talking and delete it afterwards. I do not sell it, share it or add it to a mailing list.

If I build you an AI agent

An agent works by reading the systems you already use and telling you what needs your attention. You connect each system yourself.

What it can and cannot do

• It starts as read only. It can look at what you connect. It cannot send, pay, delete or change anything.
• Doing more is your decision. If you later want it to do a task for you, such as drafting a reply or changing a booking, you approve that access separately. I tell you beforehand exactly what it will be able to do.
• Nothing goes to your customers without your approval.
• You can switch it off without asking me. Each connection sits in your own account and you can remove it there at any time. It stops straight away.

What it reads, and what it keeps

Which systems it connects to depends on what I build for you. These are the common ones.

• I never see your passwords. You sign in on the provider's own page, such as Google's or Xero's. I hold a key they issue, which allows only what you agreed to on that page.
• Old records are deleted automatically, every day.

What it keeps from working with you

• Your conversations with it, in Slack or in your dashboard: ninety days, on my server, in a locked database. An answer about your email goes after fourteen days, like the email itself.
• Messages it sent you, such as the morning brief and the weekly updates: ninety days, so you can ask for one again. Their email lines go after fourteen days.
• Charts you save, and your notes on them: until you delete them.
• Voice typing works only in Chrome on a computer. Your speech is turned into text on that computer, and the sound is sent to no one.

Where else your information is held

• With the AI provider, for up to thirty days. To sort a message or write a summary, the text is sent to Anthropic. They delete it within thirty days. If their automated safety checks flag something, they keep it for up to two years.
• In your own Slack. Messages from the agent stay in your private channel for as long as your Slack settings keep them. I can help you shorten that.
• A rule you teach it keeps its example. If you say "stop showing me these", it keeps the subject line of that one message until you delete the rule.
• What you tell it about your business. If you say "we close at noon on Fridays", it remembers that until you tell it to forget.
• In a backup on a separate drive in Brisbane. Each backup is deleted after fourteen days.

Who else is involved

These are the companies involved. Some are overseas.

Your email, bookings and accounts stay in your own accounts. I keep only what is listed above.

When something breaks

• The agent reports its own faults to me. The reports include settings, timings and a reference number. They do not include subject lines, sender names or customer names.
• If it cannot answer a question, it tells me what you asked for and why it could not answer, so I can fix it.
• If you ask it to pass a message to me, I receive your message as you wrote it.

Training

I do not use your information to train AI. That includes everything read from your email, your booking system and your accounting software. The AI provider does not use it to train their models either.

If you are a health service

Before I start with a health client, I put the arrangement in writing:

• What is connected and what is not.
• How long anything is kept.
• Who else is involved.
• What happens if something goes wrong.

Two more things apply to a clinic's booking system:

• Patient names are not kept. They are not sent to the AI provider unless you ask me to switch names on. If you type a name in a question, the AI provider sees that name.
• Your conversations keep no patient names either. A name it looks up is never stored. A name you type is removed overnight.
• Clinical notes are not read.

Your choices

• Ask me what I hold about you, and I will tell you.
• Ask me to delete it, and I will, unless the law requires me to keep it.
• Disconnect a system yourself. In Xero it is under Settings, then Connected apps. In Google it is under your account's third-party connections.
• Make a complaint. Contact me first and I will try to fix it. If I cannot, you can go to the Office of the Australian Information Commissioner.

Changes

If this page changes in a way that affects you as a client, I will tell you directly.

Questions go through the contact page. I answer them myself.