Cookie Policy

1. Who this policy is for

Drawn AI is a partnership between two founders, Liam (Melbourne, Victoria) and Jacob (Queensland), ABN 89 787 755 848. We build custom AI software, dashboards and automations for Australian businesses on subscription.

This policy covers our public website, drawnai.app. It does not cover software we build for clients — see section 8. Read it alongside our Privacy Policy, Terms and Conditions and Data Security.

2. What cookies actually are

A cookie is a small text file a website asks your browser to keep. On your next visit the browser hands it back, so the site recognises the same device. Two things matter more than the word itself:

• Who sets it. A first-party cookie comes from the site you are visiting. A third-party cookie comes from another company whose code the site embeds — usually an analytics or advertising provider. These are what enable tracking across different websites.
• How long it lasts. A session cookie disappears when you close the browser; a persistent one survives until its expiry date.

Cookies are not the only way to identify a returning device. Browsers also offer local storage, session storage and IndexedDB, and pages can carry tracking pixels — invisible images that report back to a third-party server. We cover them all.

3. What drawnai.app uses today: nothing

We reviewed the site's source code before writing this:

• No cookies. Nothing in the site's code writes one.
• No local storage, session storage or IndexedDB. Nothing is saved to your device between pages or visits.
• No analytics. No Google Analytics, no Tag Manager, no measurement tool of any kind. We do not count visitors, record sessions or build heatmaps.
• No advertising or social tracking. No pixels. The social icons in our footer are drawn by the site itself, not embedded widgets, so they report nothing to anyone.
• No third-party requests at all. Every file comes from drawnai.app. The animation libraries (GSAP, ScrollTrigger, Lenis, Three.js) sit on our own server rather than a public CDN, and our fonts are self-hosted, not loaded from Google Fonts.

That last point is the one most sites get wrong: loading a font or script from another company's server hands them your IP address and the page you are on — no cookie needed.

One ordinary thing does happen: our web host keeps standard server logs, including IP addresses, as every web server does. That is covered by our Privacy Policy, not this one. Our enquiry form has no third-party service behind it, and the date picker beside it is decorative — not a connected calendar.

4. The four categories, and where we sit

This is deliberate. Many of our clients are in financial services, insurance, mining and resources, where security teams vet suppliers — and "we send no data to any third party" is a better answer than a list of trackers.

5. Australian law on cookies, plainly

Australia has no standalone cookie law. There is no Australian equivalent of the EU's ePrivacy Directive — the rule that produced the consent banner on every European website — and no Australian statute requires consent before setting a cookie. An Australian site showing you a banner does so voluntarily, or because it also serves Europe.

What does apply is the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), but only where a cookie or identifier collects personal information: information about an individual who is identified or reasonably identifiable.

"Reasonably identifiable" does not require your name. The test is whether the organisation could, by reasonable means, work out who you are — including by combining the data with other information it holds. A random ID in a cookie may not identify you alone; combined with a login or a detailed behavioural profile, it can. So an analytics cookie is not outside the Privacy Act simply because it holds a number, not a name.

The Act currently exempts many small businesses turning over under $3 million a year. That exemption is still in force as at August 2026 but is scheduled for removal under the next tranche of reforms. We take no position on which side of that line we sit: Drawn AI follows the APPs regardless of turnover, and regardless of whether the Act binds us directly.

Separately, and often confused with this: the Spam Act 2003 (Cth) governs marketing messages, not cookies.

6. If we add analytics later

We may one day want to know which pages are read. If we do, this policy is updated before anything is switched on. Our commitments:

1. We will name the provider, where it stores data, and the cookies or storage it uses.
2. We will prefer cookie-free measurement over anything that profiles people across sites.
3. We will not add advertising or cross-site tracking to this website.
4. If anything non-essential is introduced, we will offer a real choice — refusing as easy as accepting, no pre-ticked boxes.

The same applies to any scheduler. Until this page says otherwise, treat section 3 as current.

7. Booking a discovery call

Discovery calls are arranged by email and through the enquiry form on our contact page. No third-party scheduler is embedded in the site.

Embedding one later would be a real change: the scheduler's own cookies would be set, and it would receive your IP address and — once you book — your name and email. We would name the provider here first and say where it stores data; if offshore, our Privacy Policy's overseas-disclosure section applies.

8. Client portals and software we build

The dashboards, portals and applications we build for clients are separate products, governed by that client's own cookie and privacy policies — not this one.

Those systems usually do need cookies: a portal with a login needs a session cookie to keep you signed in, and no consent regime treats that as optional. The client decides what else it collects and must tell its own users; we act as their service provider under contract. If you use a portal we built for a business you deal with, that business's cookie policy governs it — ask them, not us.

9. If you are in the EU or the UK

We are an Australian business serving Australian clients and do not target the EU or UK. Under the EU/UK GDPR and ePrivacy rules, storing or reading anything non-essential on a device needs prior, freely given consent. Because this site stores nothing, there is nothing to consent to. If we ever knowingly serve EU or UK visitors with non-essential storage, we will add a consent mechanism.

10. How to control cookies in your browser

Nothing here needs blocking, but here is how anyway — the vendors' own instructions.

A private window discards all cookies and storage on close. Blocking every cookie breaks sites that need them to log you in; blocking third-party cookies while allowing first-party ones is the usual middle ground. If you send a Global Privacy Control or Do Not Track signal, we have nothing to apply it to, but would honour it.

Contact us

Questions about this policy, or anything the website does:

• Email: policies@drawnai.app
• Website: drawnai.app
• Business: Drawn AI, ABN 89 787 755 848 — a partnership operating from Melbourne, VIC and Queensland, serving clients Australia-wide.

Enquiries go straight to Liam and Jacob. If our response does not satisfy you, you can contact the Office of the Australian Information Commissioner (OAIC) for advice. Whether the OAIC can accept a complaint about a business our size depends on the turnover threshold in the Privacy Act — see section 17 of our Privacy Policy, where we set that out plainly rather than implying a remedy that may not exist:

• Website: oaic.gov.au — how to lodge a privacy complaint
• Phone: 1300 363 992