Privacy Policy

2. Personal information we collect

The personal information we may collect depends on how you use the Platform, but generally includes:

For Potters

• your name, email address, profile photo and any other information you add to your profile;
• login credentials (we store passwords in encrypted form);
• photos and notes about your pottery pieces (photo metadata such as location, device information and timestamps is stripped on your device before upload, so we do not collect or store this metadata);
• the studios you connect with and your activity at each studio (including firings, classes, purchases and Studio Credit balances);
• payment information for any paid subscription or transaction (collected and processed by Stripe — see below); where you save a card with a studio, we additionally store a secure token reference and your card's brand, last four digits and expiry date (your full card number is held only by Stripe);
• prompts and queries you submit to our AI-powered guidance features and the responses generated;
• messages and content you exchange with studios or other users through the Platform;
• information about your device (including device type, operating system, IP address, time zone and app version); and
• any other information you provide to us, including when you contact us for support.

For Studios

• the studio's business name, ABN, address and contact details;
• contact details for the studio's authorised representatives, teachers, technicians and other personnel who use the Platform;
• studio bank and payment account details, processed through Stripe Connect;
• information you upload to your studio profile (including photos, pricing, policies and class information); and
• information about your members and operations that you process through the Platform.

For website visitors and others

• contact details you provide when you make an enquiry or sign up for updates;
• information about your device and how you interact with our website (including IP address, browser type, pages visited, and similar standard web log information); and
• information collected through cookies and similar tracking technologies (see Cookies and tracking below).

3. Personal information of children and young people

Some pottery classes and Studio activities may involve participants under the age of 18. Where we collect personal information about a person under 18:

• we assess capacity to consent on a case-by-case basis. As a general rule, individuals aged 15 or older may be able to provide their own consent if they understand what is being proposed;
• where a person does not have capacity to consent, we will seek consent from a parent or guardian; and
• a parent or guardian may contact us at the details below to review, manage or request deletion of their child's personal information.

We do not knowingly collect personal information from children under 13 without parental consent. If you believe we have done so, please contact us and we will delete the information.

4. How we collect personal information

We collect personal information directly from you and from third parties, including when you:

• create a Potter or Studio account, or use the Platform;
• submit pieces, photos, payments, AI prompts or other content through the Platform;
• connect to a Studio or accept a Member request;
• contact us through our website, email, phone or social media;
• subscribe to updates or fill out forms on our website; or
• interact with our marketing or social media content.

We also collect information automatically through your use of the Platform, including through cookies, web beacons and similar tracking technologies.

5. Cookies and tracking

We use cookies and similar technologies to remember your preferences, keep you logged in, understand how the Platform is used, and improve its performance.

Cookies are small files stored on your device. You can disable cookies through your browser settings, but parts of the Platform may not function properly if you do.

We may use third party analytics tools to help us understand how the Platform is used. These tools may collect information about your device and usage patterns, and may include session recordings in which all text inputs are masked. We currently use PostHog for analytics. We do not currently use advertising cookies or similar advertising tracking tools.

6. How we use personal information

We use personal information for the following purposes:

• to provide, operate, maintain and support the Platform;
• to create and manage your account;
• to facilitate connections between Potters and Studios, including processing piece tracking, firing requests, class enrolments and Studio Credit;
• to process payments and remit funds to Studios (through Stripe);
• to provide AI-powered guidance through the Platform's AI features;
• to send administrative notifications and updates about your account, pieces, firings, classes or payments;
• to provide customer support and respond to your enquiries;
• to improve the Platform and develop new features (including by analysing usage patterns);
• to send marketing communications about MudBuddy products and services (you can opt out at any time using the unsubscribe link in any marketing email);
• to comply with our legal obligations, including tax, record-keeping and lawful requests from authorities;
• to enforce our Terms of Service and Studio Partnership Agreements, and to investigate suspected misuse or fraud; and
• for any other purpose you have consented to or as permitted by law.

7. Who we share personal information with

We may share your personal information with:

• Studios you connect with — if you are a Potter, the Studios you join will be able to see your name, email, profile photo, pieces you submit, and your activity at that Studio. Each Studio is responsible for its own use of that information in accordance with applicable Privacy Laws.
• Other users — to the extent the Platform allows you to share content (for example, photos of your pieces) with Studios, teachers or other users you authorise.
• Service providers — third parties who provide services to us, including:
  • hosting and cloud infrastructure providers;
  • payment processors, including Stripe, which processes all payments on the Platform as direct charges to the relevant Studio's connected Stripe account and stores card and bank details under its own privacy policy at www.stripe.com/privacy. If you save a card with a Studio, Stripe stores it as a secure token against that Studio's Stripe account so the Studio can process the firing, product and Studio Credit charges you authorise. MudBuddy itself stores only that token reference and your card's brand, last four digits and expiry date — used to display your saved card and record your authorisation — and never stores or has access to your full card number;
  • our AI service provider, currently Anthropic, which processes prompts and context you submit to the AI Features so responses can be generated for you. We have contractual arrangements with our AI provider that limit its use of that content to providing the service to us, and we do not authorise the use of your content to train AI models without your consent;
  • email, SMS and notification delivery providers;
  • analytics providers (including Google Analytics);
  • customer support tools; and
  • professional advisers, including lawyers and accountants.
• Law enforcement and regulators — where we are required or permitted by law to do so.
• Business successors — if we sell, merge or restructure our business, we may transfer personal information to the successor entity. We will notify you of any such transfer.

We do not sell your personal information.

8. Storage and overseas disclosure

We primarily store personal information on cloud infrastructure hosted in Australia (Sydney region). Some sub-processors operate from overseas - including our AI provider and payment processor in the United States, and our analytics provider in the European Union - and personal information is disclosed to those recipients to the extent needed to provide the Platform.

If we disclose personal information to a recipient outside Australia, we take reasonable steps to ensure that the recipient handles the information in a manner consistent with the Australian Privacy Principles.

9. Studios and Member Data

If you are a Potter and you connect to a Studio through the Platform:

• the Studio is the controller of personal information you provide to the Studio through the Platform, and is responsible for its own privacy practices;
• MudBuddy acts as the Studio's processor in respect of that information, meaning we process it on the Studio's behalf to operate the Platform;
• you should read the Studio's own privacy notices for more information about how the Studio uses your information; and
• if you want a Studio to delete your information, you should contact the Studio directly. We will assist where reasonably possible.

10. AI features

The Platform includes AI-powered features that provide guidance, suggestions and other outputs. When you use these features:

• your prompts and relevant context (such as information about a piece you are asking about) are sent to our AI service provider so a response can be generated for you;
• our AI service provider processes your content under its contract with us, which restricts its use to providing the service;
• we do not authorise the use of your prompts or content to train AI models without your consent; and
• AI outputs are general guidance only and should not be relied on as a substitute for professional advice or your own judgement.

11. Automated decision-making

We may use automated systems (including AI) to help us operate the Platform, including to detect fraud or misuse, to suggest content, or to manage Account access.

If an automated decision significantly affects you (for example, if your account is automatically restricted or suspended for suspected fraud), you may request human review by contacting us using the details below.

12. Security

We take reasonable steps to keep personal information secure. Our security measures include:

• encrypting data in transit and at rest;
• password-protected accounts and access controls;
• restricting access to personal information to authorised personnel; and
• using reputable hosting and infrastructure providers.

However, no system is completely secure. While we use reasonable measures to protect your information, we cannot guarantee absolute security.

13. How long we keep your information

We keep personal information for as long as we need it to provide the Platform, comply with our legal obligations, resolve disputes and enforce our agreements.

In general:

• active account information is retained while your account is active;
• information about transactions, firings and payments may be retained for up to 7 years after the relevant transaction for tax, accounting and legal compliance purposes;
• when we no longer need personal information, we will take reasonable steps to delete or anonymise it; and
• historical firing records at a Studio are retained by that Studio for its business records, even after a Potter leaves the Studio (for accounting, dispute resolution and operational continuity purposes).

14. Your rights and choices

You have the following rights in relation to your personal information:

• Access — you may request a copy of the personal information we hold about you.
• Correction — you may ask us to correct information that is inaccurate, out of date or incomplete.
• Deletion — you may ask us to delete your personal information, subject to any legal or operational reason we may have to retain it.
• Marketing opt-out — you may opt out of marketing communications at any time using the unsubscribe link in any marketing email, or by contacting us.
• Withdraw consent — where we rely on your consent to process your information, you may withdraw that consent at any time (although this may affect our ability to provide the Platform to you).

To exercise any of these rights, please contact us using the details below. We may need to verify your identity before responding. We will respond to your request within a reasonable timeframe (and in any event within 30 days where required by law).

If you are based in New Zealand, the Privacy Act 2020 gives you substantially equivalent rights, which we will honour on request.

15. Additional rights for users outside Australia

If you are located in the European Economic Area, the United Kingdom or another jurisdiction with similar privacy laws, you may have additional rights, including:

• the right to access your personal information;
• the right to request correction or deletion;
• the right to restrict or object to certain processing;
• the right to data portability (to receive your information in a portable format);
• the right to withdraw consent where processing is based on consent; and
• the right to lodge a complaint with your local data protection authority.

Our legal bases for processing personal information under the General Data Protection Regulation (where applicable) are:

• Contract — to provide the Platform under our Terms of Service.
• Consent — where you have given us consent for a specific purpose (for example, marketing).
• Legitimate interests — to operate, improve and protect the Platform, and to communicate with you about our services.
• Legal obligation — to comply with applicable laws.

16. Third party links

The Platform may contain links to third party websites or services that we do not control. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with personal information.

17. Complaints

If you have a concern about how we have handled your personal information, please contact us using the details below. We will investigate your complaint and respond within a reasonable timeframe.

If you are not satisfied with our response, you may complain to:

• the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au;
• the Office of the Privacy Commissioner (New Zealand) at www.privacy.org.nz; or
• your local data protection authority if you are based outside Australia.

18. Contact us

For any questions about this policy, to exercise your rights, or to make a complaint, please contact us at: