Casa Lumee

Privacy Policy

Last updated: 29 September 2026. We update this page whenever our approach changes.

Casa Lumee is a small brand and content studio in Melbourne. When you get in touch, you’re trusting us with your details, and we don’t take that lightly. Here’s what we collect, why, who helps us look after it, and how you can see it, fix it or ask us to stop.

We choose to follow the Australian Privacy Principles (APPs) in the Privacy Act 1988.

The short version

  • We never sell your details.
  • Our website has no Google Analytics and doesn’t follow you around the internet with our ads, though our enquiry form notes how you found us.
  • You can ask to see or correct what we hold about you at any time.
  • To stop hearing from us, reply STOP to a text or “unsubscribe” to an email.

Who we are

Casa Lumee (ABN 74 625 895 975), based in Werribee VIC 3030, is run by our co-founders, Sash and Valentina.

This page covers our website, casalumee.com.au, and our own dealings with you. Websites and systems we run for clients fall under that client’s own privacy policy.

What we collect

Our enquiry form

The form asks for your phone number and email address (both required) and, if you like, your name. As a page loads, before you type anything, the form notes:

  • the page you’re on
  • the website, search or ad that referred you
  • your country, worked out from your IP address
  • a random code for your browser
  • how many times you’ve visited

This record is attached to any enquiry you send, and we use it only to see where enquiries come from.

Texts from us. Both tick boxes on the form are optional and start unticked. The first is for non-marketing texts about replies to your enquiry and appointment reminders. The second is for marketing and promotional texts to the number you gave us, such as special offers, discounts and new product updates. If you tick neither, we’ll still reply to your enquiry by email or phone.

Calls, texts, emails and social media

We keep your phone number or email address and what you tell us. If we ever record a call, we’ll tell you at the start of the call. If you book a chat, we also keep your name, contact details and chosen time.

If you message, comment on or review us on social media or Google, we see your public profile name and what you write.

If we contacted your business first

We don’t buy lists. We find businesses through what they publish: their Google listing, website, business Instagram and LinkedIn. We note the business’s name, suburb and published contact details, the people it lists and their roles, and research notes about its online presence. We only use contact details the business has published itself, never anyone’s private number. Our first message says who we are and how to stop hearing from us, and you can ask us any time where we found your details.

We also keep details people hand us, for example at networking events.

If you’re our client

We keep our clients’ contact details, project notes, files and photos. We may also look after some of your customers’ details, such as your enquiry list, the systems or website we run for you, or photos of people who’ve signed a release. We use them only for your work and as you ask, unless the person has agreed to more (for example, a model release that also covers Pics By Sash).

Why we use it

  • To reply to enquiries and keep in touch
  • To deliver and manage client work
  • To contact businesses we think we can help
  • To see which pages, searches and ads bring us enquiries
  • To keep our website secure and free of spam
  • To keep our accounts and records

For anything else, we’ll ask you first, unless the law requires or allows otherwise.

Stopping our texts and emails

Every marketing message we send says it’s from Casa Lumee, gives our contact details and offers a free way to stop. Reply STOP, “unsubscribe”, “no thanks” or similar to any email, text or direct message, or tell us on a call. You can also ask us where we got your details, and we’ll tell you. We’ll stop on every channel within five working days, usually the same day, and keep a note so you don’t hear from us again.

If you haven’t given us your details yourself, we’ll only use an address or number you’ve published, only about something relevant to your business or role, and never if you’ve said no to marketing. Before we make a sales call to a mobile number, we check it against the Do Not Call Register, unless you’ve asked us to call.

If you’re a client, we may occasionally email you about our other services that relate to the work we do together, with the same ways to stop.

Who we share it with

We never sell personal information. We share it only with our team, the services below, another business if you’ve agreed, and anyone the law requires.

These services may hold or see your details:

  • HighLevel (also called LeadConnector) and its suppliers, such as Twilio and Mailgun: our enquiry form, contacts, calls, texts, emails and bookings, and our website, which runs on HighLevel’s managed WordPress hosting
  • Cloudflare: sits in front of our website to deliver it and keep out spam bots, and runs the spam check on our enquiry form
  • Google: email, shared files, calendar and Google Meet video calls (including the chats you book with us), our Google Business Profile, our website’s fonts and some AI image tools
  • Zernio: social media posts, messages and reviews, for us and our clients
  • Supabase and Vercel: our client reporting dashboard
  • Anthropic (Claude), OpenAI and OpenRouter: AI tools that help us with research, writing and client work, so information we hold can pass through them. OpenRouter passes each request to the AI maker that answers it, such as Google.
  • Meta: our Facebook and Instagram pages, and the ad accounts we manage
  • ClickUp, Telegram, 1Password, Dropbox, GitHub and Apple iCloud: tasks, team chat, passwords, files and notes

Outside Australia. Many of these services are based overseas, so your details may be stored in, or seen from, the United States, the United Kingdom, India, the European Union and other countries where these providers operate. Some of our team also work from outside Australia, in Colombia, Spain and India. Privacy laws overseas differ from Australia’s, so we choose established providers and stay responsible for how your information is handled.

Cookies and similar tools

We don’t use Google Analytics or ad pixels. When a page loads, though, a few tools store small files in your browser or receive basic details:

  • Cloudflare sets a cookie called __cf_bm that helps tell real visitors from spam bots. It isn’t linked to who you are and expires after 30 minutes of inactivity. Our enquiry form’s spam check, Cloudflare Turnstile, receives your IP address and browser details.
  • Our enquiry form (HighLevel) keeps its record of how you arrived, including the random code and your visit count, in your browser.
  • Google: our typefaces and part of our enquiry form load from Google, which receives your IP address and browser details.

These load with the page, so not filling in the form doesn’t stop them. You can clear or block them in your browser, and you can always call, text or email us instead. If we ever add analytics, a pixel or any other advertising tool, we’ll update this page first.

Keeping it safe

We use established providers, keep shared logins in a password manager and are tightening who can reach each of our systems. No system is perfectly secure, so if your information is ever lost or accessed in a way that could seriously affect you, we’ll tell you as soon as we can what happened and what we’re doing about it.

How long we keep it

We keep personal information only while we need it, then delete it or remove the details that identify you.

  • Enquiries that don’t go ahead: 12 months after our last contact
  • Businesses we researched or contacted that didn’t reply: 12 months after our research or last message, whichever is later
  • Client project files and photos, including photos of people who’ve signed a release: 2 years after the work ends, unless the client asks us to keep them longer
  • Invoices and other tax records: 5 years, as the ATO requires
  • Our clients’ customer details (such as enquiry lists and customer records): returned or deleted within 30 days of the work ending
  • Calls, texts and emails: kept with the record they belong to
  • Requests to stop contacting you: kept for good, so we keep honouring them

Seeing and correcting your information

You can ask what we hold about you and have anything wrong corrected, free of charge. Email info@casalumee.com.au or call 0468 169 007. We may check it’s you first, so your details never go to the wrong person.

We’ll reply within 30 days, and if we can’t help, we’ll tell you why in writing and how to complain. If your details are in a system we run for a client, we’ll pass your request to that business and let you know.

If you’re not happy

Please email info@casalumee.com.au or call 0468 169 007 first. We’ll look into it and tell you in writing, within 30 days, what we found and what we’ll do.

If your complaint is about marketing emails, texts or calls you didn’t want, you can also contact the Australian Communications and Media Authority (ACMA) at acma.gov.au.