Privacy Policy.

CJM Studios ("we", "us", "our") is a web design and development studio based in Brisbane, Australia. We build websites and custom software, and provide website hosting. This policy covers this website, the CJM Portal (portal.cjmstudios.com) and the CJM Portal iPhone app.

Questions about this policy can be sent to cjmstudios.au@gmail.com.

We only collect information you give us, or that we need to provide our services:

• —Contact and project brief forms — your name, email, the kind of website you want, your message, and any logo files you upload. Sent to our own secure admin system.
• —Your CJM Portal account — your name, email address and password (stored only as a salted hash, never in readable form).
• —Project and billing records — quotes, your acceptance of them (name typed, date, IP address and browser), invoices, hosting plans, the domains we host, project updates and support tickets, including any photos or screenshots you attach.
• —Payments — card payments are handled entirely by Stripe. We never see or store your full card number.
• —iPhone app — if you allow notifications, a device token from Apple so we can send them. If you turn on Face ID or Touch ID, that check happens on your phone; we never receive biometric data.
• —Cookie consent preference — stored in your browser's local storage only (never sent to a server).

We do not use analytics trackers (e.g. Google Analytics) and do not serve advertising or retargeting cookies.

• —To respond to your project enquiry or support request.
• —To provide you with the services you requested, including your client portal, quotes, invoices and hosting.
• —To send service messages about your account — by email, and as push notifications in the iPhone app if you allow them (you can turn these off in your iPhone's Settings).
• —To send a one-time follow-up if we have not heard from you within a reasonable time (you can opt out at any time by replying to that email).
• —To comply with our legal obligations under Australian law.

We will never sell, rent, or share your personal information with third parties for their own marketing purposes.

This website uses browser local storage — not traditional cookies — to store a single item:

This item is essential for the consent banner to function. It is never transmitted to any server and expires when you clear your browser data.

The CJM Portal uses one essential sign-in cookie to keep you logged in. The iPhone app keeps its sign-in token in the iOS Keychain instead.

Google Fonts are loaded from Google's CDN when you visit the site. Google may log your IP address as a result. See Google's Privacy Policy.

• —Enquiries and correspondence are kept for up to 2 years for business purposes.
• —Your portal account and project records are kept while you're a client. Invoices and payment records are kept for at least 5 years, as Australian tax law requires.
• —Local storage items persist until you clear your browser data or we update the consent mechanism.
• —We delete personal data upon request (see Section 8).

We use the following third-party services which may process your data according to their own privacy policies:

We implement industry-standard measures to protect your information, including:

• —HTTPS/TLS encryption for all data in transit.
• —HTTP security headers (Content Security Policy, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security) on our web server.
• —Bot and spam protection on our contact form.
• —Passwords stored only as salted hashes, and sign-in attempts rate-limited.
• —No storage of payment card details on our systems — all payment processing is handled by PCI-DSS compliant third parties.

No method of electronic transmission is 100% secure. If you believe your data has been compromised, please contact us immediately at cjmstudios.au@gmail.com.

Under the Australian Privacy Act 1988 (and where applicable, the EU GDPR), you have the right to:

• —Access — request a copy of personal data we hold about you.
• —Correction — request correction of inaccurate data.
• —Deletion — request deletion of your personal data, subject to legal retention obligations.
• —Objection — object to processing of your data for direct marketing.
• —Portability — receive your data in a portable format (where technically feasible).

To exercise any right, email cjmstudios.au@gmail.com with the subject line "Privacy Request". We will respond within 30 days. You can also ask for your account to be deleted from inside the CJM Portal or iPhone app (Settings → Delete my account).

Our services are not directed at children under 13 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page. Continued use of our website after any change constitutes your acceptance of the new policy.

For material changes we will endeavour to provide a more prominent notice.

For any privacy-related questions, requests, or complaints, contact us at: