Studio by Ecodia
Privacy Policy
Last updated 29 June 2026
This explains what Studio collects, where it lives, who can read it, and what we never do with it. It is written to be checked, not just believed.
1. Who handles your data
Studio is run by Ecodia Pty Ltd (ABN 89 693 123 278), in Australia. We are responsible for the data described here.
2. What we collect
The email and password you sign in with; the sites and content you create; a meter of how much of your monthly allowance you use; and the connections and keys you choose to add so your Friend can use your tools.
3. Where it lives and who can see it
Your account and content are kept in a managed Postgres database (Supabase). Every table is scoped to your account by row-level security, so through the studio you only ever see your own data.
4. Your keys and passwords
The keys and passwords you save are encrypted (AES-256-GCM) under a key unique to your site. The encrypted values cannot be read by your browser or by any other account; only our server decrypts a secret at the moment it is used to do a job you asked for, and every access is written to an audit log.
5. Your Friend and the AI
To carry out a task, your Friend is sent your message and the context it needs, such as your site’s structure and brand. It is never sent your saved passwords or keys. Today the reasoning runs on DeepSeek’s API; we send it only the task and that context.
We do not sell your data, and we do not use it to train our own models.
6. Who else helps run the service
A small set of providers process data on our behalf so the service can run: Supabase (database and sign-in), Vercel (serving the studio and deploying your site), Google Cloud (running your Friend’s engine), and the AI model provider that powers your Friend. Anything you connect yourself, such as Stripe or GitHub, uses your own keys and is governed by that provider’s own terms.
7. Your choices
You can ask to see, correct, export, or delete your data. Deleting a site removes everything attached to it, and closing your account removes your data from our database. To make a request, email code@ecodia.au.
8. Children
Studio is not directed at children under 16, and we do not knowingly collect their data.
9. Changes
When this policy changes we will update this page and the date at the top.
10. Contact
Reach us about anything on this page at code@ecodia.au. For the precise detail of where each kind of data sits, see our Data Handling page.