Privacy policy

This privacy policy explains how Assetal ("we", "us") collects, holds, uses and discloses personal information when you visit our website, create an account, buy or sell digital products, or otherwise interact with our marketplace and related services (collectively, the "Service").

We aim to handle personal information in accordance with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs"). This policy should be read with our Terms of use.

1. Who we are

Assetal operates an online marketplace for digital assets. For privacy enquiries, complaints or access requests, contact us via the Contact page.

2. Scope

This policy applies to personal information we collect through the Service. It does not cover third-party websites, creator storefronts off-platform, or payment providers' own privacy practices; though we describe how we interact with some of those providers below.

3. What personal information we collect

The information we collect depends on how you use the Service. It may include:

3.1 Account and profile information

• name, display name and username or store slug;
• email address and authentication identifiers;
• profile photo, bio, social links and creator storefront details;
• preferences such as marketplace region or currency display.

3.2 Transaction and creator payout information

• purchase history, cart contents, licence selections and download records;
• billing-related metadata processed by our payment partners (such as Stripe), including payment method type, last four digits, transaction IDs, tax amounts and payout status;
• for Creators, Stripe Connect onboarding status, verification requirements and payout ledger entries. We do not store full bank account numbers where those are held by Stripe.

3.3 Content and communications

• listings, files, previews, tags, reviews and messages you submit;
• support requests, moderation reports, and correspondence with us;
• email addresses submitted when you register interest on the homepage waitlist.

3.4 Technical and usage information

• IP address, browser type, device identifiers, operating system and language settings;
• pages viewed, search queries, referral URLs, timestamps and interaction events;
• cookies, local storage and similar technologies (see section 8).

3.5 Sensitive information

We do not generally ask you to provide sensitive information (as defined in the Privacy Act) to use the Service. Do not upload government identifiers, health information or other sensitive data unless we expressly request it for a specific purpose (for example enhanced identity verification through a payment partner). If you voluntarily include sensitive information in public profile fields or listings, you consent to our handling of that information for the purposes described in this policy.

4. How we collect personal information

We collect personal information:

• directly from you when you register, register interest on the homepage waitlist, update your profile, list products, checkout, contact support or participate in surveys;
• automatically when you use the Service, through server logs, cookies and analytics tools;
• from third parties such as authentication providers, payment processors, fraud-prevention services and infrastructure hosts, where necessary to operate the Service.

Where reasonable, you may interact with limited parts of the Service without an account; however, purchases and creator payouts require identifiable information.

5. Why we use personal information

We use personal information to:

• create, authenticate and administer accounts;
• process orders, deliver digital files, calculate taxes and facilitate creator payouts;
• operate, secure, troubleshoot and improve the Service, including moderation and fraud prevention;
• communicate with you about transactions, security alerts, policy updates and support matters;
• send marketing about Assetal where permitted by law and where you have not opted out, including follow-up after you register interest;
• comply with legal obligations (including tax, anti-money laundering and law-enforcement requests) and enforce our Terms;
• produce aggregated or de-identified analytics that do not reasonably identify you.

If we need to use your information for a materially new purpose, we will update this policy or otherwise notify you where required by the APPs.

6. Disclosure of personal information

We may disclose personal information to:

• Creators or buyers: for example, a Creator may see buyer email or order details needed to fulfil support for a purchase;
• Service providers who assist us under contract, including hosting (such as Cloudflare), database and backend services (such as Convex), authentication, email delivery, analytics (such as PostHog where enabled), and payment processing (Stripe);
• Professional advisers (lawyers, accountants, insurers) where necessary;
• Regulators, courts and law enforcement when required or authorised by law, or to protect rights, safety and security.

We require service providers to handle personal information only for the purposes we specify and to apply appropriate security measures. We do not sell personal information.

7. Overseas disclosure

Our infrastructure and subprocessors may store or process personal information outside Australia, including in the United States and other countries where our providers operate data centres. Where we disclose personal information overseas, we take steps that are reasonable in the circumstances to ensure recipients handle the information in accordance with the APPs (for example through contractual protections, provider compliance programs or your consent where appropriate).

By using the Service, you acknowledge that cross-border processing may occur. If you do not agree, you should not use the Service.

8. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, measure performance and understand how the Service is used. Some cookies are essential; others help us improve the marketplace.

You can control cookies through your browser settings. Blocking essential cookies may affect sign-in, checkout or creator dashboard features.

Where we use analytics, we aim to configure tools to minimise collection of directly identifying information and to respect reasonable opt-out mechanisms offered by those providers.

9. Direct marketing

We may send marketing emails or in-product messages about Assetal features, creator programs or promotions where permitted by the Spam Act 2003 (Cth) and the APPs. Marketing messages include a functional unsubscribe or opt-out mechanism. Transactional messages (such as receipts, security alerts and download notices) are not marketing and may still be sent when you have opted out of promotional communications.

10. Security

We implement technical and organisational measures designed to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Measures may include encryption in transit, access controls, monitoring and secure development practices.

No method of transmission or storage is completely secure. You are responsible for choosing a strong password and keeping credentials confidential.

11. Data breaches

If we experience an eligible data breach under the Privacy Act's Notifiable Data Breaches scheme, we will assess the incident, take containment steps and, where required, notify affected individuals and the Office of the Australian Information Commissioner (OAIC).

12. Retention

We retain personal information for as long as needed to provide the Service, resolve disputes, enforce agreements and meet legal, accounting and reporting obligations (including tax records). When information is no longer required, we take reasonable steps to destroy or de-identify it.

13. Access, correction and deletion

Under APP 12 and APP 13, you may request access to the personal information we hold about you and ask us to correct inaccurate, out-of-date, incomplete or misleading information.

You can update much of your profile information in the dashboard. For other requests, contact us via the Contact page. We will respond within a reasonable period and may need to verify your identity. We may decline access where an exception applies under the Privacy Act (for example where disclosure would unreasonably impact another person's privacy).

You may ask us to delete your account. Some information may be retained in backups or records we are required to keep by law.

14. Complaints

If you believe we have mishandled your personal information, contact us first via the Contact page with sufficient detail for us to investigate. We will acknowledge your complaint and aim to respond within a reasonable time.

If you are not satisfied with our response, you may lodge a complaint with the OAIC at oaic.gov.au.

15. Children

The Service is not directed at children under 18. We do not knowingly collect personal information from children without appropriate parental or guardian consent. If you believe a child has provided us personal information, contact us so we can take appropriate steps.

16. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last revised. Material changes will be communicated where required by law or the APPs. Continued use of the Service after an update constitutes acceptance of the revised policy where permitted by law.

17. Contact

Privacy enquiries and requests can be sent via our Contact page.