Privacy Policy

2. For Everyone

This section applies to all MudBuddy users.

How to Contact Us

Your Rights

All users have the right to:

• Request access to your data
• Request corrections to inaccurate data
• Request deletion of your data
• Withdraw consent for optional data processing
• Request a copy of your data by contacting privacy@mudbuddypottery.com
• Opt out of analytics and session recordings by contacting privacy@mudbuddypottery.com

To exercise these rights, email privacy@mudbuddypottery.com.

How You Access MudBuddy

MudBuddy is available as:

• Web app at app.mudbuddypottery.com
• iOS app (App Store) and Android app (Google Play)

Our mobile apps load the web app in a native container and use the same features and terms. Mobile apps request camera access for QR scanning and photo uploads. Camera data is processed locally. No video or camera feed is sent to our servers. Most app updates deploy via the web without requiring an app store update.

Third-Party Services

MudBuddy uses these services to operate:

Cookies and Tracking

We do not use advertising cookies, Google Analytics, or Facebook Pixel.

Data Security

We protect your data with:

• Encrypted database storage (Supabase)
• Encrypted data transmission (HTTPS/TLS)
• Secure authentication (PKCE flow)
• Access restricted to authorised team members

No system is 100% secure. We take reasonable measures but cannot guarantee absolute security.

International Data Transfers

Your data may be processed in:

By using MudBuddy, you consent to these transfers.

3. For Potters

This section is specifically for individual potter accounts.

What We Collect About You

How We Use Your Data

AI Features and Your Data

When you use AI features:

• Your photos (with metadata removed) and messages are sent to Anthropic for processing
• When you ask MudBuddy AI a question, it may look up your pottery data (piece names, stages, materials, firing history, credit balance) to provide relevant answers. This data is sent to Anthropic as part of the conversation. The AI can only access your own data, never other users' data
• Anthropic does not use your content to train AI models
• Anthropic retains data for up to 30 days for safety and abuse monitoring only
• Your conversation history is stored to maintain context

Subscription and Payments

• Your subscription tier is stored to manage feature access
• Stripe handles all payment card processing - we never see your full card number
• Payment history is retained for tax and legal compliance

Studio Credit Purchases

When you purchase studio credit:

• Credit purchases generate payment records processed by Stripe
• Credit ledger entries contain a "reason" field which may include context provided by the studio (e.g. "Birthday gift")
• Financial records (credit ledger, payment history) are retained for 7 years to meet Australian tax/audit requirements, even after account deletion. This data is anonymised on deletion but not erased

Data Retention

Deleting Your Account

When you delete your account:

• Your profile, pieces, photos, and chat history are permanently deleted
• Financial records (firing payments, credit transactions) are retained for 7 years to meet Australian tax requirements. These records are anonymised: your name and email are removed, but transaction amounts and dates are preserved for the studio's business records
• Data with third parties (Anthropic, Stripe, PostHog) follows their retention policies

To delete your account, go to Account Settings or email privacy@mudbuddypottery.com.

4. For Studios

This section is specifically for studio business accounts.

What We Collect About Your Business

How We Use Your Business Data

Payment Processing (Stripe Connect)

• Stripe collects your bank account and business verification details directly
• MudBuddy never sees or stores your bank account numbers
• Stripe handles all payment compliance (KYC, tax reporting)
• Payout details are visible in your Stripe dashboard

Studio Insights and Analytics

Studios can view aggregated insights about member activity, including submission patterns, piece counts, and usage trends. These insights help studios manage their operations. Individual member activity is visible to the studio as part of the membership relationship.

Your Responsibilities for Member Data

When potters join your studio, you become a data controller for certain information. You must:

• Use member data only for providing pottery studio services
• Not sell, share, or export member data to third parties
• Respond to member requests about their data
• Keep member data secure
• Notify us immediately of any data breach

See our Terms of Service for full details on your data handling obligations.

Data Retention

If You Close Your Studio

When you close your studio account:

• Your studio profile is deleted
• Active members are removed from your studio
• Historical firing and payment records are retained for legal compliance
• Member data returns to their individual potter accounts

5. When Potters and Studios Interact

This section explains how data flows between potters and studios.

What Studios Can See About Their Members

When a potter joins your studio, you can see:

You cannot see:

• Their AI chat conversations
• Their subscription status
• Their membership at other studios
• Pieces not submitted to your studio

Pottery Classes

When a studio creates pottery classes:

• Teachers can see enrolled student names, email addresses, and class piece data
• Students see only the teacher's name
• Class pieces are visible to the teacher and studio staff
• Studios remain the data controller; teachers act under the studio's authority
• When a student drops out, pieces remain in the student's account but the class association is removed

When a studio designates a teacher for a class, the teacher has access to enrolled student names, email addresses, and class piece data under the studio's direction.

What Potters Can See About Studios

As a member, you can see:

When a Potter Joins a Studio

When you join a studio:

• A membership record is created linking your account to the studio
• The studio can immediately see your name, email, and profile photo
• As you submit pieces for firing, the studio can see those pieces and photos

When a Potter Leaves a Studio

When you leave a studio:

• Your membership becomes inactive
• Your historical firing records remain visible to the studio (for their business records)
• Your credit balance is frozen (contact the studio for refunds)
• Your personal piece collection remains in your account
• You can rejoin the same studio later

Data Access After Leaving

6. Legal

GDPR Rights (EU Users)

If you're in the European Economic Area, you have additional rights:

• Right to access - Get a copy of your data
• Right to rectification - Correct inaccurate data
• Right to erasure - Delete your data ("right to be forgotten")
• Right to data portability - Receive data in machine-readable format
• Right to object - Object to processing, including session recording
• Right to restrict processing - Limit how we use your data
• Right to withdraw consent - Withdraw consent anytime

Our legal basis for processing:

• Contract performance - Providing the service you signed up for
• Legitimate interest - Improving our service, preventing fraud
• Consent - Marketing emails, session recordings

Australian Privacy Principles

MudBuddy complies with the Australian Privacy Principles under the Privacy Act 1988. Australian users have rights to access and correct their personal information.

Children's Privacy

MudBuddy is not intended for children under 16. We don't knowingly collect data from children under 16. If you believe a child has provided us personal information, contact us and we'll delete it.

For pottery classes that include participants under 16, those participants must use the studio's physical systems rather than creating app accounts. Studios are responsible for managing any data about minor participants according to their own policies.

Updates to This Policy

We may update this policy. If we make significant changes, we'll notify you by:

• Email (if you have an account)
• Notice on our website

Changes take effect when we update the "last updated" date above. We encourage you to review this policy periodically.

Questions?

Contact us at privacy@mudbuddypottery.com with any questions about this policy.