How we handle
your data.

WHO WE ARE

DREAM IO is a technology studio based in Sydney, Australia. We design and build websites, custom apps, and AI systems.

Trading name: DREAM IO. ABN to be registered — details updated here on registration.

For any privacy question, email hello@dreamio.studio.

WHAT WE COLLECT

We only collect what we need to respond to you and run the site.

• Contact form (/contact) — your name, email address, and the message you send us.
• Project brief (/brief) — your name, email, phone, and a comprehensive set of answers about your business, project, brand, technical environment, and commercial context across the brief's eight steps. This includes categories such as business goals, competitors, stakeholder names, pain points, budget range, target launch date, decision-maker details, and existing hosting or admin access. See /brief for the full field set. Fields are optional unless marked required.
• Technical metadata — on form submission we record a truncated SHA-256 hash of your IP address (16 characters, not reversible to the original IP) for rate limiting and abuse prevention, plus a short excerpt of your browser's user-agent string.
• Brief autosave — the brief form saves your in-progress answers to your own browser's localStorage so you can close the tab and resume later. This data stays on your device until you submit or clear it. We never see it unless you submit.

WHY WE COLLECT IT

• To reply to your enquiry.
• To scope a project and prepare a written proposal.
• To prevent spam and abuse (rate limiting via hashed IP).
• To deliver and improve the service.

We do not sell your data. We do not use it for advertising. We do not share it with third parties except the service providers listed below, who process it on our behalf.

WHERE IT'S STORED

The providers listed below run dreamio.studio itself — they're how your enquiry reaches us. The infrastructure we use for client projects is scoped per engagement and can differ.

We use a small number of service providers to run the site:

• Firebase / Google Cloud — form submissions are written to a Firestore database in Google's australia-southeast1 region (Sydney). Cloud Functions also run in this region. Data stays in Australia, except to the extent Google uses global infrastructure for operational or security purposes.
• Firebase Hosting / Fastly CDN — the static site is served via Google's global edge network (which includes Fastly). This delivers HTML, CSS, and JavaScript to your browser; no form submissions flow through it.
• Resend — when you submit a form, a notification email is sent to hello@dreamio.studio via Resend. Resend's infrastructure for our account is in the ap-northeast-1 region (Tokyo). The email contains the submission details so we can reply.
• Google Analytics 4 — if you accept analytics cookies, aggregated usage data (page views, session duration, referrer, approximate location derived from IP) is processed by Google Analytics on Google's global infrastructure (primarily United States). Nothing is sent to Google unless you click "Accept" on the cookie banner. See the Cookies section below for detail.

By submitting a form or accepting analytics cookies, you consent to your information being processed by the overseas service providers listed above (notably Resend in Japan and, where applicable, Google in the United States). This constitutes a cross-border disclosure under Australian Privacy Principle 8. We've taken reasonable steps to confirm those providers handle personal information consistent with the Australian Privacy Principles.

HOW LONG WE KEEP IT

We keep your information for as long as needed to deliver the service — typically the life of the project plus a reasonable period afterwards for accounting, correspondence, and reference. If you want your data deleted sooner, email hello@dreamio.studio and we will delete it on request.

YOUR RIGHTS

Under the Australian Privacy Principles (APPs), you can:

• Access the personal information we hold about you.
• Correct it if anything is wrong.
• Request deletion of your information.
• Complain if you think we've mishandled it.

Email hello@dreamio.studio to exercise any of these rights. We'll respond within 30 days. If you're not happy with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

SECURITY

Traffic to and from the site is served over HTTPS. Forms are rate-limited and protected by a honeypot field to deter automated abuse. We do not collect passwords, payment details, or financial information through this site. No system is perfectly secure, so we also ask that you avoid sending us sensitive information you don't need to share.

COOKIES

We use Google Analytics 4 to understand how visitors use this site — which pages get read, how long sessions last, where traffic comes from. Analytics only runs after you click Accept on the cookie banner. The default posture is denied: if you take no action, or click Reject, nothing is loaded and no cookies are set.

If you accept, Google Analytics sets the following cookies in your browser:

• _ga — assigns an anonymous visitor identifier so return visits can be recognised. Retained for 13 months (Google Analytics default).
• _ga_<ID> — property-specific session state used to group page views into a single visit. Retained for 13 months.

We use the analytics data in aggregate only. We do not tie it to the contact or brief forms, we don't use it to build advertising profiles, and we do not enable Google Signals, remarketing, or Google Ads linking.

We also implement Google Consent Mode v2, which means: before you grant consent, Google's tag loads in a "consent denied" state and does not set cookies. All advertising-related consent categories (ad_storage, ad_user_data, ad_personalization) are permanently denied — this site does not use them.

How to opt out. Click Reject on the cookie banner on your next visit, or clear the dreamio_consent entry from this site's storage to make the banner reappear. You can also install the Google Analytics Opt-out Browser Add-on to block GA4 across every site you visit, or clear existing _ga / _ga_<ID> cookies through your browser's privacy settings.

The project brief also uses your browser's localStorage to save your progress — this is a local feature of your browser and is not a cookie. No data is transmitted until you submit.

CHILDREN

This site is aimed at business owners and project decision-makers. It is not directed at children under 18, and we don't knowingly collect personal information from them.

CHANGES TO THIS POLICY

We may update this policy from time to time — for example, when we add a new tool or change what we collect. The "last updated" date at the top of the page will change, and material changes will be announced on this page.

GOVERNING LAW

This policy is governed by the laws of New South Wales, Australia.

CONTACT

DREAM IO
Sydney, NSW, Australia
Email: hello@dreamio.studio