Privacy policy

In force from 7 November 2026.

VISKO (visko.com.au, operated by …, ABN …) prints business cards, stickers, large adhesive prints (including window and floor graphics), banners, rigid signs, and posters and roll media, ordered through ChatGPT or Claude and paid for on this website. This policy explains what personal information we collect, what we do with it, who we share it with, where it is held and how you can reach us about it.

What we collect

Through your AI assistant (ChatGPT or Claude)

• What you ask to print: product, size, material, finishing and quantity, and a postcode if you give one.
• Your artwork files and their file names. If you attach a file in a ChatGPT chat, we fetch it from OpenAI's file link.
• Order numbers you ask about.

We don't ask for your name, email or address through the assistant: those are only given on this website. Your conversation itself stays with OpenAI or Anthropic; we receive only what the assistant sends to VISKO's tools.

Usage statistics of VISKO's tools

Each time an AI assistant uses one of VISKO's tools, we keep a short usage record:

• Which tool, when, whether it worked, and the reason when it didn't.
• Which assistant the call came through (ChatGPT, Claude or another), and the name and version the assistant's app gives for itself. From Claude, also which of Anthropic's apps the call says it came through (such as Claude.ai or Claude Code), as Claude sends it with the call.
• For prices, uploads and quotes: the product, size and quantity asked about; for a price, also whether we sell what was asked for and the state or territory of the delivery postcode (not the postcode itself).
• The upload, artwork version and order the call was about, if any, so we can see how many prices lead to an upload, a quote and a paid order.
• Through ChatGPT only: the anonymous IDs ChatGPT gives VISKO for you and for the conversation, so we can count how many different people and conversations use VISKO. We store them only scrambled with a secret key (a one-way hash), never as ChatGPT sent them. Claude sends no such ID.

To tell which calls come from Claude, we check whether a call was sent from Anthropic's published network addresses; that IP address isn't kept. A usage record never holds an IP address, your postcode, your location, your files or anything said in your conversation.

On this website

• Your account: email address, a password (stored only as a one-way hash we can't read back), any passkeys you add, and your sign-in sessions, which record the IP address and browser they were made from.
• For delivery: the recipient's name, phone number and delivery address; optionally a business name and ABN for your tax invoice.
• Your orders: what was ordered and paid, the artwork versions you uploaded, the checks we ran on them, the changes we asked for, and your confirmation of the proof (when, which file, and which warnings you acknowledged).
• Payments: you enter your card details into Stripe's payment form shown on our page; they go to Stripe, not to us. We give Stripe your account's email address, the order number, a description of what you're printing and the amount, but not your delivery address. We receive whether the payment succeeded, the amount and Stripe's references. Stripe's dashboard also shows us some details of the payment, such as the card's brand and last four digits; we use them only for refunds and disputes.
• The emails we send you about your orders and account, and whether they were delivered or bounced. We don't track whether you open them or click their links.
• Your IP address, and a one-way hash of the email address you sign in or ask for a code with, to limit how often sign-ins, uploads and order lookups can be tried (so nobody can guess order numbers or passwords).
• Page views, counted for us by Vercel Web Analytics: the page's address (with any order number, upload ID and everything after a "?" taken out before it leaves your browser), when, the website you came from, and the country, region, city, browser, operating system and device type Vercel works out from your connection. It tells the people viewing the site apart by a code made from the request that Vercel resets every day, so page views can't be linked across days or to other websites. It uses no cookies and stores nothing in your browser.

When you contact us

• What you send us when you email, write or call: for example cancellation requests, and reports and photos of a problem with your order.

What we use it for

• Pricing your print, checking your artwork, making your quote and taking payment.
• Checking whether a first-order offer applies: we compare your email address, and your delivery address together with the phone number, with the paid orders in other accounts, so that the offer is used once per customer.
• Printing and delivering your order, and emailing you whenever its status changes.
• Refunds, and answering your questions.
• Keeping the service secure and stopping misuse.
• Keeping the records the law requires of us, such as tax records.
• Usage records and page views: understanding how VISKO is used (how many people use it and through which assistant, what they ask to print and where, how many go from a price to a paid order, and which tools fail) so we can improve it. We look at them as counts and totals, not to build a profile of you.

We don't sell your personal information or use it for advertising.

Decisions our software makes

Some steps on VISKO are decided by our software, without a person checking first:

• whether your file passes our quick artwork check, using the file you upload and the product you chose. Until it passes, you can't pay for that order;
• whether we can deliver to your address, using the delivery address you give. We don't deliver outside our delivery area or to PO Boxes;
• whether a first-order offer applies, by comparing your email address, and your delivery address together with your phone number, with paid orders in other accounts;
• how many requests we accept from one internet (IP) address in a short time, to stop misuse.

If you think one of these got it wrong, email us at … and a person will look at it.

Who we share it with

• Our partner printer, which prints your order and delivers it in VISKO's name: we give it your artwork, the recipient's name, phone number and delivery address, and the business name you gave at checkout, if any, as the delivery's company name. Its courier gets these delivery details to deliver your order. We don't give the printer your email address or ABN.
• The providers that run VISKO for us: Vercel (website, servers, file storage, page-view statistics and the isolated sandboxes that check artwork), Neon (database), Stripe (payments), SMTP2GO (the emails we send) and Google (our mailbox, Google Workspace). They handle your information to provide their service to us. Stripe also uses payment information for its own purposes, such as preventing fraud, under its own privacy policy.
• Checkly, which checks for us that this website is up: every few minutes it asks the site from Sydney whether it answers, and our hourly job tells it each time it has run. It gets no information about you or your orders.
• OpenAI and Anthropic: what VISKO's tools answer in your chat (prices, check results, your order's status) becomes part of your conversation, which their own privacy policies cover. Order status given to an assistant never includes your name, email or address.
• Anyone the law requires us to give it to.

Where it is held, and what leaves Australia

We store your information in Sydney: our database (Neon, in Amazon Web Services' Sydney region), your artwork files (Vercel Blob, Sydney), the servers that run this website and VISKO's assistant tools (Vercel, Sydney), the sandboxes that check your artwork (Vercel Sandbox, Sydney), and our email service (SMTP2GO's Australian data centre in Sydney). Some information, or copies of it, goes outside Australia. The overseas recipients are likely to be in the United States, India, New Zealand and the European Union, and, for our providers' support and backups, in the other countries listed by Vercel, Databricks (for Neon) and Google. These lists change; the linked pages are current. In detail:

• Annotated previews of your artwork. When we review your file after payment, we make preview images of it with the trim, bleed and safe lines drawn on. These images are passed out of the checking sandbox through Vercel's Sandbox control service, which runs in the United States (Washington, D.C. area), before being stored in Sydney. Your artwork file is checked and stored in Sydney, but Vercel keeps backups of the data it holds for us and copies them outside Australia.
• Payments. Stripe processes your payment and may hold and process payment information outside Australia, including in the United States and India; see Stripe's privacy policy.
• Your conversation. ChatGPT and Claude are run by OpenAI and Anthropic, which may process your chat outside Australia under their own policies.
• Emails we send you travel to wherever your email provider keeps your mailbox.
• Website checks. Checkly keeps the results of its checks of our website, and the times our hourly job reported in, in the European Union (Amazon Web Services' Ireland region). Results of the checks it runs from Sydney may be kept in Sydney, and to recover from a disaster its data may be moved to the United States. It holds no customer information.
• Our providers' systems and staff. Our providers may reach the information we store in Sydney from other countries, for example for logs, backups, monitoring or support. Vercel says its main processing facilities are in the United States, that it may process data wherever it or its sub-processors operate, and that it replicates its backups of our data globally. Neon (part of Databricks) uses Grafana Labs in the United States, and Databricks' support staff and suppliers may reach our database from North and South America, Europe, the Middle East and Asia–Pacific, including the United States and India (see Databricks' list). SMTP2GO handles our account in its Sydney data centre but is a New Zealand company, and may process email data, such as delivery reports, outside Australia, including in the United States.
• Page-view statistics. Vercel doesn't say where it keeps them, so they may be held outside Australia, including in the United States.
• Emails you send us. Our mailbox is run by Google (Google Workspace), which doesn't let us choose to store it in Australia, so emails you send us may be held outside Australia, for example in the United States.
• Our partner printer says it may transfer personal information overseas for its services and administration, without naming the countries.

How long we keep it

• Your account: until you ask us to close it. We don't close accounts automatically, and closing one doesn't remove the orders in it, which we keep as set out below.
• Orders, payments, refunds, proof confirmations, tax invoices and adjustment notes: at least 7 years after the order is completed or refunded, or longer while the Australian Taxation Office can still review our tax, as record-keeping laws require. They also show what you ordered and approved if there is ever a dispute. We don't currently delete them after that.
• Artwork files and previews: we keep them after your order has been delivered or refunded, so that we can look into any problem with the print. We don't currently delete them automatically. You can ask us to delete them once you've received your order or it has been refunded.
• Unpaid quotes, and files you upload that don't become a paid order: we keep them, and don't currently delete them automatically. A file whose upload is never finished is deleted within a few hours after its upload link expires (upload links last 24 hours). A file we refuse when you upload it, for example because it is empty, too large or not a type we accept, is deleted straight away.
• Copies of the emails we send you about your orders and account, and their delivery records: kept with your account and orders; we don't currently delete them automatically. We don't keep the one-time codes in verification and password-reset emails. If an email to you bounces, is reported as spam or you unsubscribe, we keep your address on a list so that we don't email it again until you ask us to. SMTP2GO, which sends our emails, keeps each email's sender, recipient and subject for 35 days, and a full copy of a small sample of emails (about 1 in 1,000) for 35 days to check its service isn't misused.
• Emails you send us and their attachments: kept in our mailbox; we don't currently delete them automatically.
• Sign-in sessions: each ends 30 days after you sign in, or when you sign out. The record of an ended session, with the IP address and browser it came from, can stay in our database; we don't currently delete these automatically.
• Rate-limit records, which hold IP addresses and a one-way hash of the email address used to sign in or ask for a code: one record per address and kind of action, reused each time its time window starts again. Each is deleted automatically 2 days after its time window last started (the longest window is 1 day).
• Backups: our database keeps a short history so it can be restored to an earlier point (currently up to 6 hours back), so anything we delete can stay in that history for up to 6 hours. Files we delete may also stay in Vercel's backups, for a period Vercel doesn't state.
• Request logs kept by Vercel, which record each request's page address and browser and can include its IP address: 1 day.
• Usage records of VISKO's tools: 13 months. After that we keep only each day's totals, indefinitely: per assistant and tool, how many calls there were, how many failed, and how many different ChatGPT IDs there were that day. The totals hold no IDs.
• Page views: Vercel keeps them for 12 months (the reporting period of our Vercel plan) and may keep them longer.
• Records of system faults (when part of this website fails: what failed, when, and the order it concerned, without your name or contact details), and our emails about them: 90 days after the fault last happened.

Keeping it safe

Passwords are stored only as strong one-way hashes. When you set a password, we check that it isn't on Have I Been Pwned's list of passwords exposed in data breaches: only the first 5 characters of a one-way hash of it are sent, which doesn't reveal your password. Our admin can only sign in with a passkey. Artwork files are private and are checked in isolated sandboxes that are cut off from the internet before your file is opened. Order status given by order number shows no personal details, and order lookups are rate-limited.

Cookies

We use a cookie to keep you signed in to your account and, while you add or use a passkey, a second one that lasts 5 minutes for that step. We don't use advertising or analytics cookies: Vercel Web Analytics, which counts our page views, sets no cookie and stores nothing in your browser. Stripe's payment form may set its own cookies to process payments and prevent fraud.

Your choices and rights

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it where we don't have to keep it. This includes usage records: we can find and delete those linked to your uploads or orders. Other usage records and page views can't be connected to you, so we can't tell which are yours. We keep tax invoices and adjustment notes as they were issued, and don't delete them, even on request. Contact us as below.

If you have a privacy complaint, email us at … or write to us at …. We'll look into it and give you our answer in writing within 30 days.

VISKO is a small business and isn't currently covered by the Privacy Act's Australian Privacy Principles. We still handle your information as this policy describes. If that changes, we'll update this policy.

Contact

Privacy questions: …. Post: …. See also our contact page.