Privacy and Data

How The Studio handles your information.

Last updated: 19 April 2026

What we collect

When you use The Studio, we collect:

Your conversation with WAiDE — the messages you exchange during a session. This is used only to generate WAiDE's responses and your report. It is stored on our servers for session recovery, but it is not visible to Wade Institute staff.
Any files you upload — documents, screenshots, spreadsheets, or images. Uploads are used only to coach you within the session. They are not visible to Wade Institute staff.
Reports you generate — the structured output created when you finish a session (headline, insights, actions, workshop outputs). Reports are visible to Wade Institute so the team can understand what The Studio is producing and improve it.
Your email address — only if you choose to create an account, save your session, receive a report, or request a magic link. We never collect your email without your explicit action.
Your password — if you create a password-based account. Passwords are hashed using bcrypt before storage and are never stored in plain text. We cannot see or recover your password.
Your name and organisation — only if you provide them in the lead capture form at the end of a session.

What we do not collect

We do not collect browser fingerprints or IP addresses for profiling.
We do not sell or share your data with third parties for marketing purposes.

Cookies and analytics

The Studio uses Google Analytics 4 (GA4) to understand how people use the tool — for example, which exercises are most popular and where users drop off. GA4 may set cookies on your browser. These cookies are used for analytics only, not for advertising or cross-site tracking.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

We also store a random device identifier in your browser's local storage to enable session recovery and memory features. This identifier is not linked to your identity unless you provide your email address.

How your data is used

Session content (messages and uploaded files) is sent to Anthropic's Claude API so WAiDE can generate responses. Anthropic does not use API inputs or outputs to train its models. See Anthropic's privacy policy. This content is stored on our servers for session recovery but is not visible to Wade Institute staff.
Reports you generate are stored on our servers and visible to Wade Institute for product and program improvement, as described below.
Email addresses are used to send your session report, magic link for session recovery, and occasional follow-up communication from Wade Institute. Emails are delivered via Resend.
Lead information (name, email, organisation, role) is synced with Wade Institute's CRM (HubSpot) for relationship management, and may be used to recommend relevant programs or resources. You can opt out at any time by contacting us.
Session analytics (exercise used, session duration, anonymised interaction events) may be shared with Google Analytics for product improvement. No conversation content is sent to Google.
Lead data (name, email, organisation, exercise used) may be synced to a Google Sheets spreadsheet maintained by Wade Institute for operational reporting.
Session insights — when you submit a lead form, we use AI to extract anonymised tags from your session (such as industry, venture stage, challenge category, and sentiment). These tags help Wade Institute understand how The Studio is being used and are never shared outside Wade Institute for marketing purposes.

What Wade Institute sees — and what it doesn’t

Wade Institute sees the reports you generate. Reports are the polished output of a session — headline, insights, actions, workshop outputs — and are used by Wade staff to understand what The Studio is producing, spot patterns across users, and improve the tool and Wade’s programs.

Wade Institute does not see:

The conversation transcript you exchanged with WAiDE.
Any documents, screenshots, spreadsheets, or files you uploaded during a session.
In-session board cards or drafts before you commit to a report.

Alongside report review, Wade Institute analyses anonymised, aggregated tags extracted from sessions (industry, venture stage, challenge category, sentiment) to inform program development. If many users are working through challenges related to AI adoption, for example, that pattern might shape a new course.

To be explicit:

We will never share your session transcript, uploaded documents, or individual ideas with third parties.
We will never use your session content to develop competing products or ventures.
We will never identify you personally in any aggregated analysis.
Reports are reviewed by Wade staff only — transcripts and uploads are not.
Anthropic (our AI provider) does not use your conversations to train their models. Their API usage policy explicitly prohibits this.

Data storage and retention

Active sessions are stored on our servers while you work through them. If you save a session for later via a magic-link email, the resume link expires 30 days after the last activity, after which the session is marked expired and removed from the active set.
Expired sessions and stale auth tokens are purged on a scheduled cron job — nothing is kept indefinitely on a “just in case” basis.
Shared reports (links you choose to create via the Share button) are stored on our servers for as long as the share link exists. Anyone with the link can view the report. You can request deletion at any time.
Lead-capture data (name, email, company, role, and report summary) is stored in Wade Institute’s systems and in our CRM (HubSpot) for relationship management. It is retained for the life of the business relationship unless you request deletion.
You can request deletion of all your data at any time using the “delete my data” link in any email we send you, or by contacting enquiries@wadeinstitute.org.au. Deletion cascades through our primary database and also flags your record in HubSpot as opted-out so downstream campaigns stop immediately.

AI-generated content

The Studio uses artificial intelligence to facilitate exercises and generate reports. All outputs are generated based on what you share during the session. AI-generated content may contain errors or omissions. It is provided for educational and developmental purposes only and should not be treated as professional advice.

Your rights

You can:

Request a copy of any data we hold about you.
Request correction of any inaccurate data.
Request deletion of your data at any time. If you have a The Studio account, you can use the self-service deletion link in any email we send you, or contact us directly.
Opt out of follow-up communications using the unsubscribe link in any email. When you unsubscribe we also update your record in HubSpot so ongoing marketing campaigns stop targeting your address.

Data breach notification

If we discover a breach of your personal information that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). Our commitments:

We will notify affected individuals within 30 days of becoming aware of a breach, or sooner where the risk is urgent.
Notifications will describe what happened, the kinds of information involved, the steps we have taken, and the steps you should consider taking.
We will contact you at the email address you provided. If email is not practicable, we will publish a notice on studio.wadeinstitute.org.au.
Eligible data breaches are also reportable to the OAIC; you can follow up with them directly via the link above.

Cross-border data transfers

To provide this service, your data may be transferred to and processed by service providers located outside Australia, including in the United States:

Anthropic (United States) — processes conversation content to generate AI responses and reports.
Resend (United States) — delivers transactional emails on our behalf.
HubSpot (United States) — stores lead and contact information for relationship management.
Google (United States) — provides analytics (GA4) and web fonts.

Wade Institute takes reasonable steps to ensure these providers handle your data in accordance with the Australian Privacy Principles. By using The Studio, you acknowledge that your data may be processed in these jurisdictions, where data protection laws may differ from those in Australia.

Complaints

If you believe your privacy has been breached or you are unhappy with how we have handled your personal information, please contact us at enquiries@wadeinstitute.org.au. We will investigate and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Governing policy

Wade Institute of Entrepreneurship operates under Ormond College, University of Melbourne. All data handling is governed by the Ormond College Privacy Policy and the Privacy Act 1988 (Cth).