Studio Sakura Privacy Policy

1. What We Collect

When you use Studio Sakura, we collect:

• Account information: Name, email address, and authentication provider (Google, Microsoft, Apple) used to sign in.
• Agent configuration: Your industry, agent name, governance rules, and preferences.
• Conversation data: Messages between you and your Studio Sakura agent, stored in your isolated workspace.
• Audit trail: Governance decisions, rule enforcement actions, and agent tool usage, logged for your compliance records.
• Usage data: Session counts, feature usage, and performance metrics (anonymised).

Demo visitors (no account): We do not collect personal information from visitors using the landing page chat demo. Demo conversations are not stored.

2. How We Use Your Data

• To provide the service: Provisioning your agent, enforcing your governance rules, generating audit trails.
• To improve the product: Anonymised usage patterns help us improve agent capabilities. We never use your conversation content for AI model training.
• To communicate with you: Service updates, billing, and support.

We do NOT:

• Sell your data to third parties.
• Use your data to train AI models.
• Share data between customer tenants.

3. Data Isolation

Each customer receives a fully isolated workspace:

• Separate database instance for your agent's memory and governance data.
• Separate configuration directory for your agent's identity and rules.
• No cross-tenant data access, your data is invisible to other customers and to our internal team.

4. Data Storage and Security

• All data stored on servers located in Australia (Sydney region).
• Encryption in transit (TLS 1.3) and at rest.
• Authentication tokens stored in encrypted secret management systems, not in plaintext.
• Access restricted to authorised personnel for support purposes only.

5. Third-Party AI Providers

Your agent uses AI models provided by Anthropic (Claude). When your agent processes a request:

• Your conversation content is sent to Anthropic's API for processing.
• Anthropic's data handling is governed by their own privacy policy and terms.
• Anthropic does not use API inputs for model training (per their commercial API terms).

6. Data Retention

• Active accounts: Data retained for the duration of your subscription.
• Cancelled accounts: Data retained for 30 days after cancellation, then permanently deleted. You may request immediate deletion.
• Trial accounts: Data deleted 7 days after trial expiry.
• Audit trails: Retained for the duration of your subscription plus 12 months (to support regulatory requirements). Exportable at any time.

[LEGAL REVIEW, reconcile with AML/CTF Act s.116(3) 7-year retention clock referenced in public-facing quick facts on /legal hub.]

7. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

• Access your personal information held by us.
• Correct inaccurate personal information.
• Request deletion of your personal information.
• Export your data (conversation history, audit trail, agent configuration).
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

To exercise these rights, contact privacy@studiosakura.ai.

8. International Data

If you are located outside Australia, your data may be processed in Australia where our servers are located. By using our service, you consent to this transfer. We comply with applicable data protection laws including the Australian Privacy Principles (APPs).

9. Cookies and Analytics

• Session cookies: To maintain your login state. Essential, cannot be disabled.
• Analytics: Anonymised usage data only. No third-party tracking pixels.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email to registered users. The effective date at the top of this page indicates the latest revision.

11. Contact

• Email: privacy@studiosakura.ai
• Entity: IJSL Consulting
• ABN: pending, to be inserted pre-execution