Privacy

Who we are, and what this covers

Graaft Studio, formerly NicheSpeak, designs and builds brands, websites and apps, and markets them through search, social and email. This policy explains how we handle personal information on our website at graaft.co. We are the responsible party under South Africa’s Protection of Personal Information Act (POPIA), and the entity accountable under Australia’s Privacy Act 1988 and the Australian Privacy Principles (APPs).

We work from Perth, Australia and Johannesburg, South Africa, and we hold ourselves to both laws, whatever size threshold might otherwise apply.

Personal information means information that identifies you, or that could reasonably identify you.

What we collect

We collect what you choose to give us. When you send a brief through the contact form, we receive your first and last name, your email address, your mobile number if you add it, and what you write. When you email us, we receive your address and your message.

We also collect basic technical information when you visit, through our hosting provider: your IP address, your browser and device, the pages you view, and the date and time. We use it to serve the site, keep it secure and find faults.

If you allow it, Google Analytics counts your visit: the pages you view, how you arrived, your device and browser, and your approximate location. We use it in aggregate, to see which pages people read and where the site needs work. We do not run advertising trackers or marketing cookies, and we do not sell or rent your personal information.

Why we collect it

We use your personal information to reply to your brief and, if we work together, to do the work. To run, secure and improve the website. To meet legal obligations where they apply.

Under POPIA we rely on your consent, and on our legitimate interest in running the studio. Under the APPs we use your information for the purpose you gave it to us, and for related purposes you would reasonably expect.

Giving us your information is voluntary. You can browse graaft.co without telling us who you are. Without your contact details, we cannot reply to you.

Analytics, cookies and embedded players

The first time you visit, we ask whether we may use Google Analytics. Nothing from Google loads until you choose Allow. If you do, Google sets its own cookies, named _ga and _ga_ followed by an ID, to tell visits apart, under Google’s privacy policy. If you choose No thanks, we keep only that answer, in your own browser, so we do not ask again.

Each note has a podcast player from Spotify. It loads from Spotify as it comes into view, so Spotify may receive your IP address and device information and set its own cookies, under Spotify’s privacy policy, even if you do not play an episode.

Our fonts, pictures and films are served from the site itself.

Who we share it with

We do not sell your personal information, and we do not share it for anyone else’s marketing.

We use a small set of service providers to run the website and reply to you. Vercel hosts the website. Resend delivers the briefs sent through the contact form to our inbox. Google provides Analytics, if you allow it. Our email and productivity tools hold our correspondence. They act on our instructions, under terms that require them to protect your information and to use it only to provide their service to us.

We may disclose information if the law requires it, or to establish or defend a legal claim.

Sending information overseas

Vercel, Resend and Google are based in the United States, so your personal information may be processed there.

South Africa (POPIA section 72)

We transfer personal information abroad only where the recipient is bound by laws or contracts that give it protection substantially similar to POPIA, where you have consented, or where the transfer is necessary to provide what you asked for.

Australia (APP 8)

Before personal information is handled overseas, we take reasonable steps to ensure the recipient treats it consistently with the Australian Privacy Principles, and we remain accountable for it.

How long we keep it

We keep personal information only as long as we need it. A brief is kept while we deal with it; if we work together, for as long as the work and the law require; and otherwise for a reasonable period afterwards, then deleted. Google Analytics keeps its records for 14 months. Technical logs are kept for a short period.

We keep information for longer only where the law requires it. You can ask us to delete your information sooner, and we will, unless we are required to keep it.

How we protect it

We take appropriate technical and organisational measures to protect your personal information against loss, misuse and unauthorised access. We choose reputable providers, limit who can reach your information, and review our safeguards. We keep what we hold small, which is itself a protection.

If something goes wrong

If a breach affects your personal information, we act quickly to contain it and put things right. We tell you and the relevant regulator when the law requires it.

South Africa (POPIA)

We notify the Information Regulator and the people affected as soon as reasonably possible after we become aware of a compromise.

Australia (Notifiable Data Breaches scheme)

Where a breach is likely to result in serious harm, we notify the Office of the Australian Information Commissioner and the people affected.

Your rights

You have rights over the personal information we hold about you. They differ slightly by country.

South Africa (POPIA)

You can ask for access to your information. You can ask us to correct or delete it. You can object to how we use it, and to direct marketing. You can ask not to be subject to a decision based only on automated processing. You can complain to the Information Regulator.

Australia (Privacy Act and the APPs)

You can ask for access to your information and ask us to correct it. You can opt out of direct marketing. You can deal with us anonymously or under a pseudonym where that is lawful and practical.

How to use them

Write to ask@graaft.co. We may need to confirm your identity first. We reply as soon as we can, and within thirty days. It is free, although POPIA allows a reasonable fee for some copies of records.

Children and sensitive information

The website does not use your personal information to make automated decisions that have a significant effect on you.

The website is not aimed at children, and we do not knowingly collect personal information from children through it. We do not ask for special or sensitive information through it, such as health, race, religion or biometric data. If you believe a child has given us personal information, write to ask@graaft.co and we will delete it.

Contact us, and how to complain

For any privacy question, or to use your rights, write to ask@graaft.co. We are Graaft Studio, in Perth, Australia and Johannesburg, South Africa.

If you are not satisfied with our reply, you can take it further with the regulator in your country.

South Africa: Information Regulator

Visit inforegulator.org.za, email POPIAComplaints@inforegulator.org.za, or call +27 (0)10 023 5200.

Australia: OAIC

Please raise it with us first. If it is still unresolved after thirty days, visit oaic.gov.au or call 1300 363 992.

We review this policy and update it as our practices change. This version is effective 26 October 2026.