Privacy Policy

Smudge Artspace is a children's art studio in Surrey Hills, Melbourne. This covers our website, our app, the Smudge Hub, Studio Blueprint and the bookings we take at the studio. If anything here is unclear, email us at hello@smudgeartspace.com and we will explain it properly.

When you book a class, a party or a holiday program we ask for your name, email address and phone number, your child's name and date of birth, and anything we need to know about allergies or medical conditions.

Your card details go straight to Stripe when you pay, so we never see them and we never store them.

We also collect your email address if you subscribe to our newsletter, download one of our free guides, buy a Smudge at Home book, or message us through the website or social media.

We use it to take your booking and your payment, to send you confirmations and reminders, and to keep your child safe while they are with us, which is what the allergy and medical information is for. If you have asked to hear from us, we use your email address to send news about classes, holiday programs and what we are making at the studio.

We also look at how people move around the website so we can make it work better.

Hub members can submit photos, captions, comments and replies for other signed-in members to see after moderation.

Smudge stores the member account identifier with each post so the content can be moderated, reported, blocked, exported and removed from the community when needed.

A report stores the reporting member, the reported content or account, the reason selected and Smudge's moderation record.

A block stores the two account identifiers needed to stop those members seeing or interacting with each other in the community.

If a photo includes a child, the person posting it must be the child's parent or guardian, or have clear permission from the child's parent or guardian.

A handful of companies run the parts of Smudge that we do not build ourselves, and your information passes through them so those parts work. Each of them is bound to protect it and to use it only for what we have asked them to do.

• Stripe takes the payment.
• Supabase holds our bookings database, on servers in Sydney.
• Clerk looks after signing in to the Hub, Studio Blueprint and our app.
• Resend sends our booking confirmations and newsletters.
• Vercel hosts the website and the app, on servers in Sydney.
• Telegram receives metadata-only alerts for staff when community content or a report needs review, without the photo, caption, comment, member name or report details.
• Google, Pinterest, Meta and HubSpot receive website activity through the tags described below.

Some of them store or process information outside Australia, including in the United States. We only use companies that apply recognised security and privacy standards.

We never sell your information, and we never pass it to anyone else to sell.

Some cookies keep the site working, so you stay signed in and your booking is still there when you reach checkout. If you turn cookies off in your browser, booking and signing in are likely to stop working.

We also run tags that report back to other companies, and we would rather say so plainly than bury it:

• Google Analyticstells us which pages people visit and how they found us, so we can see what is working. It also passes what you did on the site to Google's advertising systems, which is what lets us show ads to people who have been here before.
• A Pinterest tag records that you visited and adds you to an audience we can show ads to on Pinterest later.
• A Meta (Facebook) pixel does the same on our Studio Blueprint and Smudge at Home pages only.

Our older Smudge Hub pages, the ones under smudgeartspace.com /smudgehub, still run on the platform we used before this website. They carry their own tags from that setup, including Google Ads and HubSpot, which we do not control from here.

You can block all of this in your browser settings, or through the ad settings in your Google, Pinterest and Facebook accounts.

Your information is stored on password-protected, encrypted services, and only the Smudge staff who need it can open it. Class lists and allergy notes go to the educators teaching that session, and no further.

Hub member photos are delivered through a signed-in server route, and pending photos are available only to the member who posted them and authorised Smudge staff.

New community posts wait for moderation, and a valid member report hides the reported content while Smudge reviews it.

Booking and payment records are kept for at least five years, because Australian tax law requires us to hold business records that long. Marketing contacts are kept until you unsubscribe.

The Hub does not currently apply an automatic deletion schedule to community content, reports or moderation records.

Closing a Hub account removes its community database records, but the current closure flow does not separately verify removal of an uploaded image file from storage.

Email us if you want information reviewed, corrected or deleted, and we will confirm what can be removed and what must be kept.

We collect a child's name, date of birth and any medical or allergy details so we can put them in the right class and look after them properly. That is the only reason we hold it.

We never sell it, and we never use it for advertising. Bookings and accounts are made by a parent or guardian, not by children.

How we handle photographs of children is set out in our photography and social media policy.

Every marketing email we send has an unsubscribe link at the bottom, and one click is enough. You can also reply and ask us to take you off the list. Booking confirmations and reminders keep coming while you have a booking with us, because you need them.

Email hello@smudgeartspace.com and ask. You can see what we hold, correct anything that is wrong, or ask to have it deleted.

If we change how any of this works, we will update this page and change the date at the top.

Email us first and we will sort it out. We follow the Australian Privacy Principles, and if you would rather take it further you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au.