Privacy Policy

2. For Everyone

This section applies to all MudBuddy users.

How to Contact Us

Your Rights

All users have the right to:

• Request access to your data
• Request corrections to inaccurate data
• Request deletion of your data
• Withdraw consent for optional data processing
• Export your data in a portable format
• Opt out of analytics and session recordings

To exercise these rights, email privacy@mudbuddypottery.com.

Third-Party Services

MudBuddy uses these services to operate:

Cookies and Tracking

We do not use advertising cookies, Google Analytics, or Facebook Pixel.

You can opt out of analytics in your account settings. Disabling essential cookies will prevent the app from working.

Data Security

We protect your data with:

• Encrypted database storage (Supabase)
• Encrypted data transmission (HTTPS/TLS)
• Secure authentication (PKCE flow)
• Access restricted to authorised team members

No system is 100% secure. We take reasonable measures but cannot guarantee absolute security.

International Data Transfers

Your data may be processed in:

By using MudBuddy, you consent to these transfers.

3. For Potters

This section is specifically for individual potter accounts.

What We Collect About You

How We Use Your Data

AI Features and Your Data

When you use AI features:

• Your photos (with metadata removed) and messages are sent to OpenAI for processing
• OpenAI may retain this data for up to 30 days
• OpenAI may use data to improve their services (unless we have an enterprise agreement)
• Your conversation history is stored to maintain context

Subscription and Payments

• Your subscription tier is stored to manage feature access
• Stripe handles all payment card processing - we never see your full card number
• Payment history is retained for tax and legal compliance

Data Retention

Deleting Your Account

When you delete your account:

• Your profile, pieces, photos, and chat history are permanently deleted
• Historical firing records at studios may be retained for their business records
• Data with third parties (OpenAI, Stripe, PostHog) follows their retention policies

To delete your account, go to Account Settings or email privacy@mudbuddypottery.com.

4. For Studios

This section is specifically for studio business accounts.

What We Collect About Your Business

How We Use Your Business Data

Payment Processing (Stripe Connect)

• Stripe collects your bank account and business verification details directly
• MudBuddy never sees or stores your bank account numbers
• Stripe handles all payment compliance (KYC, tax reporting)
• Payout details are visible in your Stripe dashboard

Your Responsibilities for Member Data

When potters join your studio, you become a data controller for certain information. You must:

• Use member data only for providing pottery studio services
• Not sell, share, or export member data to third parties
• Respond to member requests about their data
• Keep member data secure
• Notify us immediately of any data breach

See our Terms of Service for full details on your data handling obligations.

Data Retention

If You Close Your Studio

When you close your studio account:

• Your studio profile is deleted
• Active members are removed from your studio
• Historical firing and payment records are retained for legal compliance
• Member data returns to their individual potter accounts

5. When Potters and Studios Interact

This section explains how data flows between potters and studios.

What Studios Can See About Their Members

When a potter joins your studio, you can see:

You cannot see:

• Their AI chat conversations
• Their subscription status
• Their membership at other studios
• Pieces not submitted to your studio

What Potters Can See About Studios

As a member, you can see:

When a Potter Joins a Studio

When you join a studio:

• A membership record is created linking your account to the studio
• The studio can immediately see your name, email, and profile photo
• As you submit pieces for firing, the studio can see those pieces and photos

When a Potter Leaves a Studio

When you leave a studio:

• Your membership becomes inactive
• Your historical firing records remain visible to the studio (for their business records)
• Your credit balance is frozen (contact the studio for refunds)
• Your personal piece collection remains in your account
• You can rejoin the same studio later

Data Access After Leaving

6. Legal

GDPR Rights (EU Users)

If you're in the European Economic Area, you have additional rights:

• Right to access - Get a copy of your data
• Right to rectification - Correct inaccurate data
• Right to erasure - Delete your data ("right to be forgotten")
• Right to data portability - Receive data in machine-readable format
• Right to object - Object to processing, including session recording
• Right to restrict processing - Limit how we use your data
• Right to withdraw consent - Withdraw consent anytime

Our legal basis for processing:

• Contract performance - Providing the service you signed up for
• Legitimate interest - Improving our service, preventing fraud
• Consent - Marketing emails, session recordings

Australian Privacy Principles

MudBuddy complies with the Australian Privacy Principles under the Privacy Act 1988. Australian users have rights to access and correct their personal information.

Children's Privacy

MudBuddy is not intended for children under 16. We don't knowingly collect data from children under 16. If you believe a child has provided us personal information, contact us and we'll delete it.

Updates to This Policy

We may update this policy. If we make significant changes, we'll notify you by:

• Email (if you have an account)
• Notice on our website

Changes take effect when we update the "last updated" date above. We encourage you to review this policy periodically.

Questions?

Contact us at privacy@mudbuddypottery.com with any questions about this policy.