Privacy Policy

MyStdio, a product of Zyon Entertainment Pty Ltd (ABN 24 640 498 997, 383 Pitt Street, Sydney NSW 2000, Australia) (we, us or our), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our video production client portal platform. Zyon Entertainment Pty Ltd is the entity responsible for this Platform and, unless a separate controller is identified for a particular processing activity, acts as the controller of the personal information described in this policy.

This policy applies to users in all jurisdictions including the United States, Canada, European Union, United Kingdom, and Australia. Specific rights for users in certain regions are detailed in the "Your Rights by Region" section below.

Information We Collect

We collect the following categories of personal information:

• Identity Information: Name, job title, company name, and user profile details.
• Contact Information: Email address, phone number, and business address.
• Account Information: Username, password (encrypted), account preferences, and authentication data.
• Transaction Information: Project history, quotes, invoices, payment records, and service details.
• Project Content: Project briefs, video feedback, comments, approvals, and uploaded materials (logos, footage, brand assets).
• Technical Information: IP address, browser type, device information, operating system, and access timestamps.
• Usage Information: Pages visited, features used, search queries, and interaction patterns within the platform.
• Communication Data: Messages, feedback, support requests, and notification preferences.

How We Collect Information

• Directly from you: When you create an account, submit projects, provide feedback, or contact support.
• Automatically: Through cookies, analytics tools, and similar technologies when you use our platform (with your consent where required).
• From your organization: When a company administrator adds you to their tenant account.
• From third parties: Payment processors, video hosting and content-delivery platforms, and identity verification services.

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our services under our agreement with you or your organization.
• Legitimate Interests: Processing for our legitimate business interests, such as improving our platform, preventing fraud, and ensuring security.
• Consent: Processing based on your explicit consent, such as for marketing communications and optional analytics cookies.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations.

How We Use Your Information

• Provide, maintain, and improve our platform and services
• Process transactions and send related information
• Manage your account and provide customer support
• Enable video review, feedback, and approval workflows
• Send administrative notifications and service updates
• Send marketing communications (with your consent where required; you may opt out at any time)
• Analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our terms

AI and Machine Learning

We use artificial intelligence provided by third-party AI providers (United States) to power several optional features of our Platform, including social-media caption and image generation, AI video summaries and transcripts, and AI-assisted storyboard planning and image generation. These features are enabled or disabled for your organization by your organization's administrator (or, for platform-wide availability, by us), rather than through a per-project opt-out. Depending on which features your organization uses, we send the categories of content described below to these AI providers.

• Text and caption generation: We use a third-party AI provider (United States) for social-media caption, hashtag, and title generation, and to produce AI-generated summaries of review videos. For caption generation, we send this provider your prompt and related brand or project context. For video summaries, we upload a copy of the relevant video to the provider's servers for analysis; because that video may show or be about identifiable people, faces and voices captured in the footage may be processed as part of this analysis. This provider processes data in the United States. We rely on Standard Contractual Clauses (and any other applicable safeguards) for this international transfer.
• Audio transcription: We use a third-party AI provider (United States) to generate automatic transcripts of review videos. We send this provider the audio extracted from a video so it can produce a transcript; because that audio contains people's voices, it may include identifiable speech. This provider processes this data in the United States, and we rely on Standard Contractual Clauses for this transfer.
• Storyboard planning and content screening: We use a third-party AI provider (United States) to help plan AI storyboards (generating a shot list and extracting characters, locations, and props from a script) and to screen storyboard image prompts for references to real, identifiable people before an image is generated. We send this provider the relevant script, prompt, or project text, which may name or describe real people if your script or prompt refers to them. This provider processes this data in the United States. Our use is under that provider's commercial terms, which state that inputs sent through this service are not used to train the provider's models, together with Standard Contractual Clauses for the international transfer.
• Image generation: We use a third-party AI provider's image-generation models (United States) to create AI storyboard frames, social-media thumbnails, and reference images. We send this provider your text prompts and any reference images you upload, which may include photos of real people (for example, a talent or brand reference), together with prior AI-generated frames where relevant. This provider processes this data in the United States. Our use is under that provider's API terms, which state that API content is not used to train the provider's models by default, together with Standard Contractual Clauses for the international transfer.

Video Playback Analytics

Our video hosting and content-delivery provider collects playback analytics to enable video review features and optimize performance. This includes:

• Watch duration and completion rates
• Seek positions and playback quality settings
• Buffering events and playback errors
• Device type and browser information

This data helps us provide features like viewing progress tracking and video performance optimization. Analytics data is processed in accordance with our video hosting provider's privacy policy.

How We Share Your Information

We may share your information with:

• Your Organization: Other users within your company or tenant account as permitted by your organization's settings.
• Service Providers: Third parties who perform services on our behalf, including:
  • Cloud hosting and infrastructure providers (European Union)
  • Object and file storage providers (United States)
  • A content delivery and video streaming network
  • A transactional email provider (United States)
  • Payment processing (Stripe)
  • Third-party AI providers (United States) for image generation, text generation, video analysis, and audio transcription; see "AI and Machine Learning" above
  • Error diagnostics (a self-hosted, GlitchTip/Sentry-compatible error-monitoring tool)
  • Analytics (Google Analytics, with consent)
  • Advertising and conversion measurement (Meta Pixel, Google Ads, with consent; see below)
• Legal Requirements: When required by law, court order, or government request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.
• With Your Consent: When you direct us to share information with third parties.

A current, itemised list of our named sub-processors is available on request by emailing privacy@mystdio.com and forms part of our Data Processing Agreement.

Meta Pixel and joint controller responsibility. Where you have consented to Marketing cookies, we use the Meta Pixel (and, in some cases, Meta's server-side Conversions API) on our marketing website to measure the effectiveness of our advertising, including tracking sign-up completions. For the collection and initial processing of this Meta Pixel event data, MyStdio and Meta act as joint controllers, as described in Meta's Business Tools Terms and Controller Addendum. Meta's own further use of this data, for example to improve its own advertising products, is governed by Meta's Privacy Policy, and Meta acts as an independent controller for that further use. See our Cookie Policy for more detail on how to control this.

International Data Transfers

We are headquartered in Australia, but our technical infrastructure and service providers are located in several countries. Your personal information may be transferred to, and processed in, countries other than your country of residence, including:

• European Union: Our application database runs on cloud hosting and infrastructure providers located in the European Union.
• United States: Uploaded files (project assets, brand materials, and similar content) are stored with object and file storage providers based in the United States. Our transactional email (account, invoice, and notification emails) is sent through a transactional email provider based in the United States. Our third-party AI providers (see "AI and Machine Learning" above) process data in the United States.
• European Union (with global content-delivery locations, including the United States and Australia): Our content delivery and video streaming network provider has origin infrastructure based in the European Union, and its content-delivery network caches copies of video and image previews at edge locations around the world, including in the United States and Australia, to improve loading speed.
• Australia (our home jurisdiction, and a content-delivery edge location)

A current, itemised list of our named sub-processors is available on request by emailing privacy@mystdio.com and forms part of our Data Processing Agreement.

When we transfer personal information internationally, including from the European Union, the United Kingdom, or other jurisdictions with data-transfer restrictions, we rely on appropriate safeguards, including the Standard Contractual Clauses approved by the European Commission (and, where applicable, the UK's International Data Transfer Agreement or Addendum), together with our vendors' other applicable certifications, for example the EU-U.S. Data Privacy Framework where a vendor participates in it.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including:

• Account Data: For the duration of your account plus 2 years after closure for legitimate business purposes.
• Project Data: For the duration of your account or as agreed with your organization.
• Transaction Records: 7 years for tax and legal compliance.
• Analytics Data: 26 months (aggregated/anonymized data may be retained longer).

Your Rights by Region

European Union, UK & Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten") in certain circumstances.
• Restrict Processing: Request that we limit how we use your data.
• Data Portability: Receive your data in a structured, machine-readable format or have it transferred to another controller.
• Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Lodge a Complaint: File a complaint with your local data protection authority.

California, USA (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know: Request information about the categories and specific pieces of personal information we collect, use, disclose, and sell.
• Delete: Request deletion of your personal information, subject to certain exceptions.
• Opt-Out of Sale: We do not sell personal information, so this right does not apply.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Correct: Request correction of inaccurate personal information.
• Limit Use of Sensitive Information: Request limits on processing of sensitive personal information. We do not intentionally collect sensitive personal information as that term is defined by the CCPA (for example, we do not ask for government identification numbers, precise geolocation, or health information). However, video, images, and other files that you or your organization upload may depict identifiable individuals, including their likeness or voice, and we process IP addresses as part of our standard technical logging; we note this here for transparency, and this content is handled in accordance with this Privacy Policy.

Canada (PIPEDA)

If you are in Canada, you have the right to:

• Access: Request access to your personal information held by us.
• Correction: Request correction of inaccurate information.
• Withdraw Consent: Withdraw consent to the collection, use, or disclosure of your information, subject to legal or contractual restrictions.
• Complain: File a complaint with the Privacy Commissioner of Canada if you believe we have violated your privacy rights.

Australia (Privacy Act 1988)

If you are in Australia, you have rights under the Australian Privacy Principles including:

• Access to your personal information
• Correction of inaccurate information
• Complaints to us or to the Office of the Australian Information Commissioner (OAIC)

New Zealand (Privacy Act 2020)

If you are in New Zealand, you have rights under the Privacy Act 2020 and the 13 Information Privacy Principles (IPPs), including:

• Access: Request access to your personal information (IPP 6).
• Correction: Request correction of inaccurate personal information (IPP 7).
• Deletion: Request deletion of your personal information where it is no longer required for the purpose it was collected.
• Purpose Limitation: Your information will only be used for the purpose for which it was collected (IPP 10).
• Complaints: File a complaint with us or with the Office of the Privacy Commissioner (OPC) if you believe your privacy rights have been breached.

You can contact the Office of the Privacy Commissioner at www.privacy.org.nz.

Exercising Your Rights

To exercise any of your privacy rights, please contact us using the details below. We will respond to your request within 30 days (or sooner if required by applicable law). We may need to verify your identity before processing your request.

Cookies and Tracking

We use cookies and similar technologies to enhance your experience, analyze usage, and deliver targeted advertising (with your consent). Categories include:

• Essential Cookies: Required for platform functionality and security.
• Functional Cookies: Remember your preferences and enable enhanced features.
• Analytics Cookies: Help us understand how you use our platform (Google Analytics).
• Marketing Cookies: Used for advertising purposes (Google Ads, Meta Pixel).

You can manage your cookie preferences at any time through our Cookie Settings or your browser settings. For more information, see our Cookie Policy.

Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest, secure authentication, regular security audits, and access controls. However, no method of transmission over the Internet is 100% secure.

Children's Privacy

Our Platform is intended for business use. Consistent with our Terms of Use, our Platform is not directed to, and may not be used independently by, individuals under 16 years of age (or under 13 in jurisdictions where that is permitted); a person below this age may only use the Platform with the consent and supervision of a parent or legal guardian. We do not knowingly collect personal information directly from a child outside of this parent- or guardian-supervised context. If we learn we have collected personal information from a child in a manner inconsistent with this policy, we will delete it promptly.

Automated Decision-Making

We do not use your personal information to make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement. Our AI features (for example drafting assistance, transcription, and image generation) assist our users and do not make automated decisions about individuals.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes, we may also send you an email notification.

Contact Us

For questions about this Privacy Policy or to exercise your rights, please contact us:

EU Representative (Article 27 GDPR). Because we offer our Platform to individuals in the European Union, we are appointing an EU representative under Article 27 of the GDPR. Once appointed, their contact details will be published here, and you or a supervisory authority may contact them in addition to contacting us directly. In the meantime, please contact us at privacy@mystdio.com.

UK Representative (Article 27 UK GDPR). Because we offer our Platform to individuals in the United Kingdom, we are appointing a UK representative under Article 27 of the UK GDPR. Once appointed, their contact details will be published here, and you or the Information Commissioner's Office (ICO) may contact them in addition to contacting us directly. In the meantime, please contact us at privacy@mystdio.com.

For users in the European Union, you may also contact your local data protection authority if you have concerns about how we handle your personal data.