Privacy.

Who is collecting what

tyso is a one-person studio in Canberra, Australia. There is no data team, no appetite for collecting more than the work needs, and nothing collected here is sold or traded. A handful of third-party tools do run on the site. Each one, and what it is for, is listed below.

What gets collected

If you send an enquiry, book a call, or run the free audit, I receive what you put in the form: your name, your email, your phone number and business name if you give them, whatever you wrote, and for the audit, your website address and your answers to its questions.

If you email me directly, I keep the email.

Like every website, the server keeps routine technical logs for a short time: the request, the rough location it came from, the browser. The site also runs measurement tools and one advertising pixel, and enquiries are saved so I can follow up. The next two sections spell out exactly what and why.

Measurement and advertising

Vercel Web Analytics counts page views and where visitors arrive from. It is aggregate only: no cookies, no personal profiles.

Microsoft Clarity records anonymised sessions and builds click and scroll heatmaps, so I can see which parts of a page land and which get skipped. It masks the text you type into forms by default, so what you write in a form field is not captured in a replay.

PostHog logs product events: which forms get started, whether an audit finishes, which buttons get pressed. It is served through this domain at /ingest rather than loaded from PostHog's own address, so it behaves as first-party. The events themselves are stored on PostHog's US cloud. None of it is used for advertising.

The Meta pixel is the advertising one. It notes page views, and when a contact enquiry or an audit is completed it records that as a conversion event, so I can tell whether my Facebook and Instagram ads are working and show follow-up ads to people who have already been here. It sets a cookie to do that. It receives the fact that a form was submitted, not the details you typed into it. It only runs when a pixel is configured.

So I can tell which ad or link actually brought you in, the site sets a first-party cookie called tyso_ft and keeps it for 90 days. It holds the source, campaign and landing page. No personal details, no sharing: it is read back only to credit that source if you get in touch.

If you would rather not be measured or retargeted, a browser with Do Not Track or a content blocker switched on keeps you out of the analytics and the pixel, and you can switch off ad personalisation inside your Facebook and Instagram settings.

What happens to an enquiry

It is used to reply to you, to run the audit you asked for, and to do the work if we end up working together.

Enquiries, bookings and audits land in my inbox and are saved in a CRM I run on Supabase. Alongside each one the system writes a short AI-generated note on whether the enquiry looks like a fit and why, so I know who to call back first. It is a working note for me. Nothing is decided automatically, and you can ask to see what it says about you.

Any email I send back, a confirmation or a report, goes out through Resend.

Your details are never sold, rented or traded. No mailing list exists, so you cannot be added to one.

The audit and AI

The audit checks your website, then passes some of what it finds, along with what you typed, to OpenAI's API to write the read. Treat the form like a postcard: business details are fine, but keep passwords and anything sensitive out of it.

Tyso Receipts

Tyso Receipts is the receipt scanner in the toolbox. If you use it, your receipt images and the details read from them are stored privately against your account, and only you can see them. Storage is on Supabase, in the Sydney region (ap-southeast-2).

To read a receipt, its image is processed by Anthropic's Claude. Under Anthropic's API policy that image is not used to train models. Payments, if you go Pro, run through Stripe, so your card details never touch tyso.io.

You can export your receipts to a spreadsheet at any time. Deleting your account is a full purge: your account, every receipt, and every image go for good. A receipt you delete on its own sits in a bin for 30 days first, then it is gone too. Keeping records for five years is the ATO's ask of you, not something we do on your behalf: we hold your data only while your account exists.

Seeing, correcting or deleting your details

Email tys@tyso.io and ask. I will tell you what I hold about you, correct it, or delete it. There is exactly one place to look, so this does not take long.

Changes and questions

If how this works changes, this page changes with it. Questions go to the same place everything else does: