Privacy
What we keep, and why.
Last updated 9 September 2026. Tusk CMS is operated by Emile de la Rey trading as Napkin Group (ABN 38 586 173 074), Australia. Questions: admin@oryxbga.com.
What Tusk stores
- Account details. Your name, email address and a hashed password. For studios, the studio name and plan.
- Website content. The words, photos and files your clients edit, and the pages and fields you define. This is your content; we store it to show it back to you and to your build.
- Activity. Who published, invited, signed in or changed a setting, and when. Studios see this for their own sites.
- Billing. Handled by Stripe. We keep the customer and subscription identifiers Stripe gives us, never card numbers.
- Technical logs. Our hosting provider keeps request logs for a short period to keep the service running.
What we do not do
- We do not sell or share personal information with advertisers.
- We do not read your clients' content except to provide support you ask for.
- We do not put personal information in links. Invitations carry a random token that expires.
Who can see what
A client sees only the sites they have been given access to. A studio sees only its own sites and clients. Tusk staff can access accounts to provide support or keep the service secure, and every such access is logged.
Where it lives
Tusk runs on Vercel with a Neon database and Vercel Blob storage. Email is sent through Resend. These providers process data on our behalf under their own agreements. Data may be stored outside Australia.
Your rights
You can ask for a copy of your personal information, ask us to correct it, or ask us to delete your account and its content. Email admin@oryxbga.com and we respond within 30 days. Deleting a studio deletes its sites, pages, media, clients' seats and activity.
Cookies
One cookie, oryx_session, keeps you signed in for up to 30 days. No tracking or advertising cookies.
Changes
If this policy changes in a way that matters, we tell studio owners by email before it takes effect.