Privacy Policy.
1. About this policy.
This policy explains how YAHSAR ("we", "us") handles personal information about brands and their staff, people who send us an enquiry, users of our client portal, and creators. We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Creators applying to our network should also read our Creator Network Terms & Privacy Notice.
2. What we collect.
- Enquiries: your name, email, company or brand, website and social handles, and what you tell us about your project, such as products, audience, launch dates and budget.
- Clients and portal users: your name, email, and a securely hashed password (we never store or see your actual password); your messages, comments, approvals and decisions in the portal; and project records such as proposals, invoices and payment status.
- Creators: the details listed in our Creator Network Terms, including the gender and date of birth we use to match creators to briefs (never shared with clients), your delivery address for samples and, if you add it, your ABN for paying you, plus the rates, availability, project history, usage rights and signed agreements we record when you work with us.
- Technical information: a one-way scrambled (hashed) form of your internet address and your browser type, used only to prevent spam and abuse, and a secure session cookie that keeps you logged in. We don't use advertising or tracking cookies.
3. Why we use it.
- To respond to enquiries, prepare proposals and run your project.
- To give you secure access to your portal, documents, approvals, deliverables and invoices.
- To send emails about your project, such as invitations, approval requests, reminders, invoices and replies. These are service emails, not marketing.
- To find, propose and work with creators, and to pay them.
- To keep accurate business, tax and contract records, and to keep our systems secure.
We don't sell personal information, and we don't use it for anything unrelated to these purposes without your consent unless the law allows or requires it.
4. Who can see it.
- The YAHSAR team, through our private studio app. Every team login requires a password and an emailed code.
- You and your colleagues: portal users only ever see their own organisation's projects. Internal notes, costs and margins are never shown in the portal.
- Clients, about creators: when we propose creators for a campaign, clients see the creator's first name, photo, profile details and selected content samples, never their contact details. When a client ships a product straight to a creator under our coordinated delivery, we give the client only the creator's delivery name and address, to be used for that shipment only.
- Service providers who help us run the business: Cloudflare (website hosting, database, file storage and email routing) and Zoho Mail (email). They process information for us under their own security and privacy commitments.
- Others where the law requires, for example to comply with a court order or a tax obligation.
5. Storage and overseas disclosure.
Our records are stored with Cloudflare and Zoho. Our database is served from Cloudflare's Australian and Oceania locations and our email account is hosted in Zoho's Australian data centre, but these providers operate globally and some data may be processed or stored on servers outside Australia, including in the United States. We choose providers with strong security practices and take reasonable steps to make sure they handle information consistently with the APPs.
6. How we protect it.
- Encrypted (HTTPS) connections everywhere, and secure, HTTP-only session cookies.
- Strict access control: every request is checked on our servers, and each client can only reach their own organisation's records.
- Private files are only available through signed links that expire after an hour.
- Passwords are stored as one-way hashes; login attempts are rate-limited; team logins need an emailed code.
- Regular backups, an audit trail of important changes and approvals, and a plan for responding to data breaches, including notifying you and the Office of the Australian Information Commissioner (OAIC) where the Notifiable Data Breaches scheme requires it.
7. How long we keep it.
- Enquiries that don't go ahead: up to 24 months from your last contact with us, unless you ask us to delete them sooner.
- Client projects: for the life of the project and then for 7 years, because Australian tax law requires us to keep business records.
- Creator applications: up to 24 months from submission, or while you're in the network (applications past this period are deleted automatically). Signed agreements and payment records are kept for 7 years.
- Portal accounts: until access is removed. Login sessions expire automatically.
8. Your choices and rights.
You can ask to access or correct the personal information we hold about you, or ask us to delete it, by emailing hello@yahsar.studio. We'll respond within 30 days. Where we need to keep some records by law (for example invoices), we'll keep only what's required and remove the rest. Portal users can update their name and password in the portal at any time.
9. Complaints.
If you have a concern about how we've handled your personal information, please contact us first and we'll work with you to resolve it. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
10. Changes.
We may update this policy as our services change. The date at the top shows the latest version.