Privacy Policy - Hot Cut

Last updated: 4 November 2026

In short: We make laser-cut and plasma-cut signs and art. We collect what you give us (contact details, orders, messages and pictures) and some technical details when you use our websites. We use it to quote, make, deliver and support your order, and for advertising. We share it with service providers, including AI services, Google and Meta. Some are overseas, mostly in the United States. We don’t sell it. You can ask to see or correct your information, opt out of marketing, or complain (sections 9, 12 and 13). Contact: [email protected] or (08) 8317 6055.

About this policy

Hot Cut Laser and Plasma Art Pty Ltd (“Hot Cut”, “we”, “us”) makes laser-cut and plasma-cut signs, panels and art in Adelaide. This policy explains what personal information we collect, why, who we share it with, where it can end up, and what choices you have.

It covers our websites (hotcut.com.au and commercial.hotcut.com.au) and every other way you deal with us: email, phone, text messages, social media, and at our showroom. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can ask us for a copy of this policy in another format.

“Personal information” means information about a person who can be identified, such as a name, contact details, an order history, or a photo that shows someone.

1. Who we are and how to contact us

Hot Cut Laser and Plasma Art Pty Ltd, ABN 67 654 056 005 (ACN 654 056 005)

Address: 755a Port Road, Woodville SA 5011
Phone: (08) 8317 6055
Email: [email protected] (attention: Privacy Manager)

Please use these details, addressed to our Privacy Manager, for any privacy question, request or complaint.

2. What we collect and how

What you give us

Contact details: your name, email address, phone number, delivery or pick-up address, postcode, and business name if you have one.
Orders and payments: what you ordered, delivery details, order notes, and how you paid. Card payments are handled by Fat Zebra, an Australian payment provider, and we never see or store your full card number. You can also pay with PayPal, Afterpay or Zip, by bank transfer, or with cash on pickup.
Enquiries and design requests: the type of sign, size, material, where it will hang, when you need it, your design brief, and how you’d like us to contact you.
Pictures, designs and files: see section 3.
Messages: emails, text messages, phone calls and social media messages between you and us, and the notes our team makes about them.
Photo competition entries: your name, email address and the photos you submit.
Reviews, comments and feedback: your name, email address (not published), any website you add, your phone number and order number if you give them, and your ratings and words. If you have a profile picture linked to your email (Gravatar), it can appear next to a review. To show it, our website sends Gravatar (Automattic) a scrambled (hashed) version of the reviewer’s email address.
Gift cards: the buyer’s details, plus the name and email address of the person receiving the card and any message. Please only give us the email address of someone who is expecting it.
An account: your name, email address and password if you register on our website.

What we collect automatically

When you visit our websites: we record your IP address, approximate location, device, browser and operating system, the pages you look at and what you click. We also record how you found us (a search, an ad or a link) and tracking codes in links, such as Google’s ad click code. We use cookies for this (see section 8). On commercial.hotcut.com.au a tool can also record how you move through our pages, such as where you click, scroll and move your mouse.
When you send some of our website forms: we also save your IP address, approximate location, browser, operating system, the page you came from and any tracking codes along with your enquiry.
Phone calls and texts: we don’t record calls. Our customer system keeps a log of calls (the number, the name shown, the time, how long it lasted and which team member took it) and the full text of messages.

What we get from other places

Facebook and Instagram: if you fill in a form on one of our ads, Meta passes the details you entered (such as your name, email, phone number and answers) on to us, through Zoho CRM.
Zoho CRM: some enquiries, including some from Facebook and some from our website forms, may pass through Zoho CRM on their way to our customer system.
Emails sent to our team: the sender’s address and any attachments, such as pictures, from emails that arrive in our team’s mailboxes (see section 3).
Payment providers: confirmation that a payment went through.

Sensitive information

We don’t ask for sensitive information (such as health, religion or ethnic origin). Pictures you send can show it by accident, for example a memorial portrait or a photo of a family. We take extra care with pictures like that, but they go through the same steps as any other picture you send (see section 3), including our automatic sorting.

Staying anonymous, and if you don’t give us details

You can ask general questions without giving your name, or use a nickname, unless we need your details to quote, make or deliver. Our websites still record some technical details when you browse (see section 8). If you don’t give us your contact and delivery details, we can’t quote, make or deliver your order.

3. Pictures, designs and files you send us

You can send us pictures, sketches, photos, logos or design files by email, website form, product page or quote request. We keep them so we can quote, design and make your order, and to build a library of design ideas. They can contain personal information, for example a name or address on a sign, a vehicle number plate, your home or business, or people in a photo.

When your pictures and files reach our customer system (from email or our website forms), we copy them into private cloud storage in Sydney and scan them for viruses before anyone can open them. The original email or website upload also stays in our email system or on our website host (Amazon Web Services, Sydney).
We also look through pictures attached to emails our team receives, both new emails and those from the last 12 months, from customers and from other people, to find design ideas. For emails we don’t use, we keep a record of the sender, subject and file names for 90 days.
We don’t reuse customers’ logos or personal artwork. We may use ideas from the pictures people send us when we create our own designs. If you don’t go ahead with an order, a design we made for you, including one made with AI help, may be reused for other products, but only if it is generic (for example a general animal or pattern design).
We use AI services to help sort and describe pictures (see section 5).
The photo competition: photos sent through “Submit Your Photos” are covered by the Customer Supplied Photos Terms and Conditions you accept when you enter. We can use them on our website, social media, emails and ads, and we take reasonable steps to remove or hide details such as street addresses, vehicle registrations and full names (except business names on signs). Entries can’t be withdrawn once submitted.
Only send us a photo of another person, especially a child, if you are entitled to, for example as their parent or guardian, or because they have agreed.

4. Why we use your information

We use personal information to:

reply to you, quote, design, make, deliver and invoice your order, and look after you afterwards (returns, faults, refunds, warranty);
take and check payments, and prevent fraud;
keep a record of your orders and enquiries, and follow up a quote you asked about (our team may follow up by email or text, and we stop if you ask);
sort and describe the pictures and files you send us, including with the help of an AI service (see section 5), so we can find, group and reuse designs;
help our team draft replies to your emails, texts and enquiries, using an AI service (see section 5);
run, secure and improve our websites, products and advertising, including measuring which ads and pages lead to orders and enquiries, and showing our ads to people who have visited our websites;
tell you about news, offers and competitions, if you’ve asked us to or you’d reasonably expect it from a business you’ve dealt with (you can opt out any time: see section 9);
run our photo competition;
meet our legal, tax, insurance and accounting obligations, and deal with disputes; and
anything else you would reasonably expect that is related to the above, or that you’ve agreed to.

5. How we use AI

We use two AI services to help our team. They help us sort and draft. A person at Hot Cut makes every decision about your design, your quote and your order, and checks every AI-drafted reply before it is sent. No computer program decides whether we take your job or whether we deal with you. The one exception is our automatic follow-up emails, which go out without being read first and may use AI-written wording.

Anthropic, PBC (the provider of the Claude AI service) helps us sort and describe the pictures and files you send us. For example, it helps us tell sketches and designs apart from logos, screenshots and documents, read the wording on a design, and tag what a design shows. We send Anthropic the picture (often a smaller copy) and our own instructions, not your emails or texts. Anthropic processes them on our behalf only to provide that service and, under its commercial terms, does not use them to train its AI models.
OpenAI helps our team draft replies and follow-ups. We send it the details in your enquiry and recent messages: your name, business name, what you asked for, and recent emails and texts (including any contact details in them). OpenAI says it doesn’t use data from its business service to train its models, and may keep it for up to 30 days to check for misuse.
Wording on designs: when AI reads wording off a design, we replace names, addresses and numbers in the searchable copy with a general tag, such as “family name” or “address”. This is automatic and can miss some. We also keep the original wording in a restricted record that only administrators can open.
Where it’s processed: Anthropic and OpenAI may process this information in the United States, and may keep it for a limited time under their own terms (see section 7).
New AI providers: if we add another AI provider that will receive your pictures or messages, we’ll update this policy and tell you first (see section 16).

6. Who we share your information with

We choose providers carefully and try to share only what each one needs for its job. We ask them to use it only to provide their service to us. The exception is advertising and analytics tools such as Google and Meta, which also work under their own privacy policies. We don’t sell your personal information. We do share some details with Google and Meta so they can measure and show our ads (see section 8).

Running our business

Google (Google Workspace and Gmail): our email. Emails, attachments and addresses sit in it.
Zoho CRM: enquiries and leads we keep in Zoho’s Australian data centre, including leads from Facebook ads. A Zoho script on our website can also record how visitors reached us (see section 8).
ClickSend: an Australian company that sends our text messages. It receives your mobile number and the message.
VOIPline: an Australian phone provider that runs our business phone and text number. It handles calls and texts to and from us.
Amazon Web Services: hosts our customer-management system, our website and online shop (WordPress and WooCommerce) and your files, all in Sydney, and keeps encrypted backups there. The gateway that sends our purchase details to Meta (see “Advertising and analytics”) also runs on Amazon servers in the United States.
Cloudflare: protects and speeds up hotcut.com.au. Traffic to that site, including forms and uploads, passes through it.
Retool and Make: dashboard and automation tools. They connect directly to the database behind our website and online shop, from their own servers outside Australia. Retool’s login can read, add, change and delete any record in that database, which includes customers’ names, email addresses, phone numbers, delivery addresses, orders, order notes, reviews and website account details. Make connects to the same database. We use them for dashboards and to update order numbers and statuses.

Our website and shop

Fat Zebra: an Australian payment provider that processes card payments.
PayPal, Afterpay and Zip: if you choose to pay with one of them, it receives what it needs to process your payment. They may handle information outside Australia.
Automattic (Jetpack and WordPress.com): website statistics and speeding up our pages, plus Gravatar profile pictures on reviews.
Google reCAPTCHA: checks that a person, not a robot, is using our register and feedback forms.

Delivery and making your order

Australia Post and Sendle: your name, delivery address and contact details so they can deliver your parcel.
Local trade suppliers, such as powder coaters: they get the job details they need to finish your parts, but not your name or address.

Advertising and analytics

Google: Analytics, Google Tag Manager (a tool that manages our tracking tags) and Ads, to measure how people use our websites and ads, and to show our ads to people who’ve visited.
Meta (Facebook and Instagram): the Meta Pixel and Meta’s Conversions API (a way for our website to send purchase details to Meta directly), for the same reasons. When you order, we send Google and Meta details about the order, and your email, name, phone number and address in scrambled (hashed) form, so they can match it to their users and measure our ads.
Stape: hosts the server-side tagging for our website, on servers in Australia. It passes website activity on to Google and Meta.
Lucky Orange (commercial.hotcut.com.au only): a US company whose tool shows us how visitors use our commercial website, by recording where they click, scroll and move their mouse, and which pages they visit (see section 8).

AI services

Anthropic and OpenAI: see section 5.

Advisers, government and buyers

Our accountant, lawyers, insurers and other advisers.
Government agencies, courts and regulators, when the law requires or allows it.
A buyer or investor, if we sell or restructure the business.

7. Sending your information overseas

Our customer-management system, our website and online shop, the files they store and their backups are kept in Amazon Web Services’ Sydney data centre, and our Zoho CRM records are in Zoho’s Australian data centre. Retool and Make connect to our shop’s database from outside Australia, so they can open its records overseas. Your information in our email and the other tools in section 6 may be held elsewhere, including outside Australia. Our service providers may store or process your information outside Australia. In particular, Anthropic may process the pictures and files you send us in the United States.

United States: Anthropic, OpenAI, Google, Meta, Automattic (Jetpack, WordPress.com and Gravatar), Retool, Lucky Orange, and Amazon Web Services (a US region, used for Meta’s Conversions API). Section 6 says what each one does. Google’s email service may also store messages in the United States.
Europe or the United States: Make.
Many countries: Cloudflare, Google, Meta, PayPal, Afterpay and Zip may handle your information in data centres around the world, so it can end up in other countries. We can’t list them all.
Australia: Zoho CRM, Amazon Web Services (Sydney), ClickSend, VOIPline, Fat Zebra and Stape.

We choose well-known providers and use their written business terms. Google, Meta and some others also handle information under their own privacy policies, which we don’t control. If you have a concern about a provider, contact us.

8. Cookies and online tracking

Cookies are small files that a website stores on your device. Pixels and similar tools do a similar job. We use them on our websites for these purposes:

Essential: keeping your shopping cart, logging you in, website security (including Cloudflare), and remembering that you’ve seen our cookie banner.
Analytics: Google Analytics and Tag Manager, Jetpack Stats and WooCommerce Analytics, Cloudflare Web Analytics, and WooCommerce order tracking, to see which pages are used and how orders and enquiries arrive.
Advertising: Google Ads and the Meta Pixel (with Meta’s Conversions API), to measure our ads and show them to people who have visited. A tracking tool on our website also remembers which ad or link brought you to us, and may store your IP address, in a cookie. We save those details with your enquiry when you send one of our forms.
Visitor recording (commercial.hotcut.com.au only): Lucky Orange can record how you use our commercial website: the pages you visit, where you click, scroll and move your mouse, and your device, browser and approximate location. Our team can play a visit back as a replay. Lucky Orange says it hides what you type into forms by default.
Enquiry tracking (hotcut.com.au): a Zoho CRM script can record how you reached our site, such as an ad click code or campaign tag, so it can be matched to an enquiry in our customer records. It talks to Zoho’s Australian data centre.
Page features: fonts and icons load from Google Fonts, Font Awesome and cdnjs, which can see your IP address and your browser.

Most of these start as soon as you open a page, before you can make a choice. Our cookie banner doesn’t yet let you switch them off, and commercial.hotcut.com.au has no cookie banner. You can limit them with the controls below.

How to control them:

Block or delete cookies in your browser settings. Our cart and checkout may not work without essential cookies.
Turn off Google Analytics for your browser with the Google Analytics opt-out add-on.
Manage the ads Google shows you at adssettings.google.com.
Manage the ads Meta shows you at facebook.com/adpreferences.
Block tracking scripts, including Lucky Orange’s and Zoho’s, with your browser’s tracking protection or a content-blocking add-on.
Contact us if you want us to take you off our follow-up and marketing lists. We can’t remove details Google and Meta already hold, so use the two links above for that.

9. Marketing and opting out

We don’t currently send a marketing newsletter. If we send news, offers or competition updates by email or text, we send them only to people who have bought from us, asked for a quote or asked to hear from us. You can also ask us where we got your details.

You can opt out at any time:

follow the “unsubscribe” link in any marketing email we send;
reply STOP to one of our texts, or tell us by phone or email; or
ask us any other way.

We’ll stop marketing within 5 business days. Opting out of marketing doesn’t stop messages we need to send about your order or enquiry, such as design proofs, delivery updates and replies to your questions. To opt out of targeted ads, see section 8.

10. How long we keep your information

Customer, order and enquiry records: emails, texts, call logs and notes are kept for up to 7 years, then deleted or de-identified. We review our records every year and delete or de-identify what we no longer need. We don’t yet delete them automatically, so we do this by hand.
Financial records: invoices, payment records and other financial records are kept for at least 7 years, as tax and company law require.
Pictures and files: they stay with your order or enquiry record for as long as that record is kept. Pictures in our design library are kept for as long as we use the library.
Short-lived copies: our customer system’s log files are kept for 14 days, the log of what AI wrote for us for 30 days, and encrypted backups for up to 35 days (the last copies are gone within 60 days). Records of emails we looked through for design ideas but didn’t use have the sender and subject cleared after 90 days. The original wording AI read off designs we archive or withdraw is deleted after 12 months. A draft we save with your enquiry, and any message we send you, is kept with your record.
Our providers: Google, Zoho, ClickSend, VOIPline, Fat Zebra, PayPal, Afterpay, Zip, Google Analytics, Meta, Lucky Orange, Retool, Make and others keep information under their own settings and policies.
If you ask us to delete your information, we delete or de-identify the files, records and documents we hold about you where we can, such as texts, call records, notes, pictures, design records, and your Zoho and shop customer records. We keep our emails with you as proof of your request and of what we did. We also keep a scrambled (hashed) copy of your email address so our design-ideas tool doesn’t read your emails again. We may need to keep some records, like invoices, by law. We can’t delete copies held by advertising platforms or by providers on their own terms (see section 6). Photos you entered in the photo competition are covered by its terms. Your information can stay in encrypted backups for up to 60 days.

11. How we keep your information safe

Our customer system needs a staff login, and what staff can open depends on their role.
Taking customer payments in our payment providers’ portals is protected by two-step verification. We can see customers’ names and email addresses there, but never card or bank details.
Files our customer system copies from email and our website are kept in private cloud storage in Sydney and scanned for viruses before they can be opened. Database backups are encrypted.
Our websites and system use secure (HTTPS) connections.
Please don’t send full card numbers by email or text. Use our checkout.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner (OAIC) as soon as we can.

12. Seeing and correcting your information

You can ask us for a copy of the personal information we hold about you, and ask us to correct anything that is wrong or out of date. You can also ask us to delete it (see section 10).

Contact us using the details in section 1. We may ask you to confirm who you are first.
We’ll respond within 30 days, and we don’t charge you for asking.
In limited cases the law lets us refuse, for example if giving access would affect someone else’s privacy. If we do, we’ll tell you why in writing.

13. Complaints

If you think we’ve mishandled your personal information, contact us first, by email or in writing, using the details in section 1. We’ll aim to respond within 30 days.

If we haven’t answered within 30 days, or you aren’t happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC). The OAIC can only take up complaints about organisations the Privacy Act covers. Complaints must be in writing: use the online form at oaic.gov.au, or post to GPO Box 5288, Sydney NSW 2001. For general questions, the OAIC enquiries line is 1300 363 992 (Monday to Thursday, 10am to 4pm).

14. Children

Our websites and shop are for adults. If you’re under 18, please ask a parent or guardian to place an order or contact us for you. We don’t knowingly collect personal information directly from children. If we find we have, we’ll delete it. Pictures sent to us can show children; see section 3.

15. Links to other websites

Our websites link to other sites, such as Facebook and Google reviews. We don’t control them and aren’t responsible for their privacy practices. Please read their policies.

16. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows the latest version.

If we make a significant change, for example adding a new kind of provider that handles your pictures or messages, we’ll tell you before the change takes effect, by email and/or a prominent notice on our website. We keep dated copies of earlier versions, and you can ask us for one.

17. Contact us

Questions about this policy? Use the details in section 1: [email protected] (attention: Privacy Manager) or (08) 8317 6055.