Privacy Policy

1. About This Policy

Plus Also Studios Pty Ltd (“Plus Also”, “we”, “us”, “our”) operates the website plusalsostudios.com.au and provides campaign rollout production services. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services.

We are an Australian company and comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where our services are used by individuals in the European Union or United Kingdom, we also comply with the General Data Protection Regulation (GDPR) and UK GDPR respectively.

By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

3. How We Use Your Information

We use the information we collect to:

• Provide our services: produce your campaign rollout, generate asset files in the formats you specify, and deliver completed work to you
• Process payments: create Stripe checkout sessions and verify payment for your orders
• Send transactional communications: send order confirmations and delivery notifications via email (using Resend)
• Store and deliver files: securely store your uploaded files and produced assets in Cloudflare R2, and provide time-limited download links
• Improve our website: analyse usage patterns through Google Analytics and Microsoft Clarity to improve user experience
• Communicate with you: respond to inquiries and provide customer support
• Comply with legal obligations: maintain records for accounting, tax, and regulatory purposes

4. Legal Basis for Processing (GDPR)

For individuals in the EU/UK, we process personal data under the following legal bases:

• Performance of a contract: processing necessary to fulfil your order and deliver our services
• Legitimate interests: website analytics and service improvement, provided these do not override your rights
• Consent: where you have opted in to non-essential cookies or marketing communications. You may withdraw consent at any time
• Legal obligation: where required to comply with applicable laws

5. Third-Party Services

We share personal information with the following third-party service providers who assist us in operating our business:

We do not sell your personal information to third parties. We only share information as described above or where required by law.

6. File Storage and Retention

• Uploaded files are stored securely in Cloudflare R2 (encrypted at rest). Files are retained for 7 days after order completion to allow for re-delivery if needed
• Download links expire 7 days after delivery. After this period, the files will no longer be available
• Order records are retained for 7 years to comply with Australian tax and accounting obligations
• Analytics data is retained according to the default retention periods of Google Analytics (14 months) and Microsoft Clarity (13 months)

You may request deletion of your uploaded files at any time by contacting us (see Section 10).

7. Data Security

We take reasonable steps to protect your personal information:

• Encryption in transit: all data transmitted between your browser and our servers is encrypted using HTTPS/TLS
• Encryption at rest: files stored in Cloudflare R2 are encrypted at rest
• Signed download tokens: file download links are cryptographically signed (HMAC-SHA256) with expiration to prevent unauthorised access
• PCI compliance: payment processing is handled entirely by Stripe, which is PCI DSS Level 1 certified
• Edge computing: our application runs on Cloudflare Workers, providing DDoS protection and security at the edge
• Rate limiting: upload and checkout endpoints are rate-limited to prevent abuse

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. International Data Transfers

Plus Also Studios is based in Australia. When you use our services, your information may be transferred to and processed in countries outside your jurisdiction:

• Cloudflare: operates a global network; your data may be processed at the nearest edge location
• Stripe: headquartered in the United States
• Resend: headquartered in the United States
• Google Analytics: data processed in the United States
• Microsoft Clarity: data processed in the United States

These transfers are protected by appropriate safeguards including the service providers’ data processing agreements, Standard Contractual Clauses (SCCs), and compliance frameworks.

9. Your Rights

To exercise any of these rights, contact us using the details in Section 10. We will respond to your request within 30 days (or sooner where required by law).

10. Children’s Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will take steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will:

• Update the “Last updated” date at the top of this policy
• Post a notice on our website
• Notify existing customers by email where appropriate

We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Individuals in the EU may also contact their local supervisory authority.