Privacy

How we handle your information.

Plain-English summary of what we collect, why, and what you can do about it. Effective 13 July 2026.

Who we are

This site is operated by Creative Milk Pty Ltd ("Creative Milk", "we", "us"). Our registered address is Level 7, 80 Dorcas Street, South Melbourne, VIC 3205, Australia. We are bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth).

What we collect

We collect two categories of information:

  • Information you give us via forms on this site -- your name, email, business type, phone (where provided), and any free-text you enter (e.g. describing a workflow you'd like automated, or answers in the AI Readiness assessment).
  • Information collected automatically when you visit -- IP address, device and browser type, referring URL, pages viewed, timestamps, and interaction events (button clicks, form submissions). We do not collect precise location.

How we use it

  • To respond to enquiries and deliver services you request.
  • To email you the outputs of tools you use on the site (e.g. the AI Readiness playbook PDF).
  • To improve the site -- understand which pages people find useful and where they get stuck.
  • To measure the performance of marketing (which channels bring us aligned enquiries).
  • To meet legal obligations (tax records, dispute resolution, etc.).

We do not sell your personal information.

Third-party services we use

These services process some of your information on our behalf. Each has its own privacy policy governing what they do with it.

  • Google Analytics 4 & Google Tag Manager -- website analytics and event tracking. Uses cookies and processes IP addresses (which Google anonymises before storage). See the Google Privacy Policy.
  • Meta Pixel (Facebook) -- measures the performance of Meta ad campaigns and helps us reach similar audiences. See the Meta Privacy Policy.
  • Supabase -- database hosting for the AI Readiness assessment. Data is stored in the Sydney region. See the Supabase Privacy Policy.
  • Resend -- delivers transactional emails (confirmations, playbook downloads). See the Resend Privacy Policy.
  • Vercel -- website hosting. Automatically logs requests (IP, user agent, path) for a limited period for security and debugging. See the Vercel Privacy Policy.

Cookies and similar technologies

This site uses cookies for analytics, marketing measurement, and essential functionality. You can control cookies via your browser settings:

How long we keep it

  • Form submissions and enquiries: retained while the enquiry is active plus 7 years for tax and legal record-keeping.
  • AI Readiness assessment data: retained indefinitely under the anonymous ID we generate. You can request deletion at any time (see below).
  • Analytics data: aggregated and stored by Google for 14 months per GA4's data retention setting.
  • Server logs: 30 days.

Your rights

Under Australian privacy law you can:

  • Ask what personal information we hold about you.
  • Ask us to correct information that is inaccurate.
  • Ask us to delete your information (subject to legal exceptions like tax records).
  • Withdraw consent to marketing communications at any time.
  • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we've mishandled your information.

To exercise any of these rights, use the contact form and mention "Privacy request" -- we'll respond within 30 days.

Security

We use industry-standard practices to protect your information: HTTPS across the site, encrypted database storage, restricted access to production systems, and rate-limiting on public forms. No system is perfect -- if we ever have reason to believe your data has been exposed, we'll notify you and the OAIC in accordance with the Notifiable Data Breaches scheme.

Data location

Our primary database (Supabase) is hosted in Sydney, Australia. Some third-party processors (Google, Meta, Resend, Vercel) may transfer or process data outside Australia -- typically in the US or EU -- under standard contractual protections.

Children

This site is not directed at children under 16 and we do not knowingly collect information from them.

Changes to this policy

We may update this policy from time to time. The effective date at the top reflects the latest version. Material changes will be noted on the homepage or emailed to affected users where practical.

Contact

Privacy questions or requests: use the contact form or write to us at Level 7, 80 Dorcas Street, South Melbourne, VIC 3205.