SURFGRAPHIX PRIVACY POLICY

Last updated: 15 November 2026

1. Who We Are

Surfgraphix ("Surfgraphix", "we", "our", "us") is operated by Rafael Franzese, sole trader trading as Surfgraphix, ABN 42 521 911 385, based in Gold Coast, Queensland, Australia.

Surfgraphix is an online marketplace where surf filmers upload footage of surf sessions and surfers can browse sessions and buy clips of themselves. Optional extras include beach notifications, tagging, and facial recognition.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we follow the guidance of the Office of the Australian Information Commissioner (OAIC), particularly on biometric information. We do this whether or not the small business exemption in the Privacy Act would otherwise apply to us.

Contact for all privacy matters: contact@surfgraphix.com (subject "Privacy"). Rafael Franzese is responsible for privacy at Surfgraphix.

2. Scope

This Privacy Policy applies to the Surfgraphix website (surfgraphix.com), marketplace, dashboards, notification services, facial recognition services, and all related communication channels, including our social media accounts and emails.

By using the Platform you acknowledge this Privacy Policy. Facial recognition is never switched on by acknowledgement alone. It needs your separate, explicit consent, given by ticking a dedicated checkbox, as described in Section 5.

3. What Information We Collect

a) Surfers and buyers

Full name, email address, and password (stored by our login provider as a hash, never in plain text)
Country, region, stance (regular or goofy), and the beaches you surf most
Purchase history, order details, and delivery records. If you buy without an account ("guest checkout"), we create a basic surfer record under your email so we can deliver your clip and keep it re-downloadable
Favorites, surf logs (including surfs you plan to do), notification settings, and referral details
Discount coupons issued to your account, such as the tag reward (see Section 5B)
Tagging information: anyone can suggest a tag linking a clip to a name or email, and a reviewed tag can link that clip to your account (see Section 5B)
Optional: facial recognition enrollment data (see Section 5)

b) Filmers

Full name, email address, and business or brand name (if applicable)
Session details (name, beach, date, time, conditions) and the footage you upload
Plan type, commission rate, and pricing settings
Payout destination: your PayPal email address, and the bank account you connect through Stripe. Bank account numbers are held by Stripe, not by Surfgraphix. Stripe gives us a fingerprint of the bank account (not the number), which we use to detect duplicate accounts (Section 5.8)
Portfolio information and social media handles (optional)
The equipment you shoot with and the beaches you shoot most (optional), shown on your public profile and used to tell you about surf plans at those beaches

b1) Filmer tax and identity details

Before we release a payout, we collect:

Your legal full name
Your date of birth, used to confirm you are 18 or over
Your residential or business address
Your Australian Business Number (ABN), if you have one. If you do not, you tell us instead that you are not carrying on a business

We collect this because Australian law requires online marketplaces to identify the sellers who earn money through them and to report that income to the Australian Taxation Office, and because selling on Surfgraphix is restricted to adults.

These details are held separately from your public filmer profile. They are never shown on your profile, in the filmer directory, on session pages, or to surfers. We keep them for five years after your last transaction, which is the record-keeping period the ATO requires, and then delete them.

c) People appearing in footage (including non-users)

Filmers record surf sessions at public beaches. Uploaded footage may show people who do not have a Surfgraphix account, including minors. We host and display this footage on behalf of filmers. Our automated systems process the images in that footage as described in Sections 5.5 and 5.9. Someone may also tag a clip with the name or email of a person who does not have an account, so that person can be notified if they later register. If you appear in footage or have been tagged and want the footage or tag removed, see Section 9 (Content Removal).

d) Technical information

IP address, device and browser information, and log data
Cookies and similar technologies (see Section 8)
Website usage analytics: Google Analytics, and heatmaps and session recordings through Microsoft Clarity. Session recordings capture how you scroll, click and move around the site, and what was on the page while you did
Approximate location data, only with your permission

e) Payment information

Payments are processed by Stripe and PayPal. We do not receive or store full card numbers or PayPal passwords.

4. How We Use Your Information

We use personal information to:

Create and manage accounts and verify email addresses
Operate the marketplace: list sessions, display previews, process purchases, and deliver purchased media
Tell the filmer who made a sale (Section 7)
Send session notifications for your selected beaches
Run the optional facial recognition service for enrolled surfers (Section 5)
Check uploaded footage for content that is not surf footage or is unsafe (Section 5.10)
Detect duplicate or fraudulent accounts (Section 5.8)
Process filmer payouts and subscription billing
Confirm filmer identity and age, and meet our reporting obligations to the Australian Taxation Office
Send transactional emails (purchase confirmations, download links, match notifications, account notices)
Send marketing emails where you have agreed to receive them. You can unsubscribe at any time
Send one reminder email if you leave clips in your cart: when you are logged in and add clips to your cart, or when you enter your email at checkout but do not finish the purchase, we keep the clips you chose and your email for up to 30 days and may send you a single reminder. Every reminder has an unsubscribe link, and logged-in surfers can also turn reminders off in their notification settings
Promote the Platform, including short excerpts of session footage on our website and social media (see Section 6)
Analyse and improve the Platform, prevent fraud and abuse, and keep the Platform secure
Comply with legal obligations

We do not sell personal information. Section 5A explains the decisions our computer systems make automatically.

5. Facial Recognition and Biometric Information

Facial recognition involves biometric information, which is sensitive information under the Privacy Act. These rules govern it.

5.1 Optional and opt-in. Facial recognition is optional and off by default. You can browse every session, buy clips, save favorites and use every other feature without it. During sign-up we offer it once, and you can skip it. It only starts if you choose to enroll and tick the dedicated consent checkbox. Face matching is not 100% accurate, so browsing sessions yourself will always find waves the scanner misses.

5.2 What we collect at enrollment. You can enroll in one of three ways:

Guided recording. Your camera takes up to 24 still frames while you turn your head. We keep the best front, left and right frames (up to three images) and delete the rest straight away. No video file is stored.
Photos. You upload up to three photos of yourself (front, left and right). Photos of you surfing work best.
Checkout. See Section 5.2A.

From these images, Amazon Web Services (AWS) Rekognition creates mathematical face templates linked to your account. We keep both the images and the templates while your enrollment is active, because the images are needed to verify matches (Section 5.4) and for human review (Section 5.6). Images are stored in AWS S3 and templates in an AWS Rekognition collection, both in the Sydney, Australia region. The images are sent from your device through our application servers (Vercel), which may process them outside Australia (Section 7).

5.2A Enrollment at checkout ("Find my waves"). When you buy a clip, you may tick a separate, optional, unticked checkbox confirming you are the surfer in that clip and that you are 18 or older. Ticking it is never required to complete a purchase. If you tick it, we record your consent (with the wording you saw, the time, your IP address and browser) and create or use your surfer record under the email you bought with. A person on our team then reviews your claim. Only if they confirm it do we create face templates from up to three frames of the clip you bought and start scanning. If our review finds the clip is not you, or that the person in it is under 18, no template is created. Until 13 November 2026 templates were created straight away, before review; any created that way from a claim we did not confirm are deleted. Everything else in this Section 5 applies the same way to checkout enrollment.

5.3 How matching works. When a filmer uploads a new session, still frames from each clip are compared against the templates of enrolled surfers. Our system only treats a clip as a possible match if the stance of the rider (regular or goofy) is consistent with the stance on your profile. If you run "Find me in past sessions", the same comparison runs against sessions already on the Platform. A Surfgraphix administrator may also run a scan for you, for example while handling a support request or checking that matching works. Possible matches are checked by AI (Section 5.4) and then by a person (Section 5.6). A confirmed match puts the clip in your dashboard and, if your notification settings allow it, we email you.

5.3A Confirmed matches improve your templates. When a match is confirmed, we may add your face from that clip as an extra template on your account (up to 10). This helps the system recognise you in surfing conditions, which look very different from a selfie. These extra templates are deleted together with the rest of your face data.

5.4 AI verification of possible matches. To reduce wrong matches, each possible match is checked by third-party AI vision services, currently OpenAI and Google (Gemini). For each check they receive your enrollment images (up to six) and an enlarged crop of the face found in the clip frame, and they answer whether these show the same person. If the system's first guess was wrong, that crop shows someone who is not enrolled. These providers process the images in the United States and possibly other countries. We send the images through their developer APIs, not their consumer chat apps. Under their API terms the providers may keep the data for a limited period, for example to monitor abuse. Your face templates never leave AWS in Sydney.

5.5 People who are not enrolled. To find enrolled surfers, our system has to look at every face in the frames it searches, including the faces of people who never enrolled. Those faces are compared against the enrolled templates and then discarded. We do not create templates for them, add them to any face database, identify them, or link them to anyone. The frames themselves are the clip's own preview images, which stay with the clip. If a non-enrolled person is mistaken for a possible match, a crop of their face is sent for AI verification as described in Section 5.4, and a person reviews the result. No one can search the Platform using a photo of another person.

5.6 Human review. A Surfgraphix administrator reviews possible matches before they are confirmed. To do this they can see your enrollment images, the clip, and the comparison results. Administrators also see enrollment images when reviewing a duplicate-account alert (Section 5.8). Enrollment images are never shown to filmers, other surfers, or the public.

5.7 Turning it off, retention and deletion. You can withdraw your consent at any time from the Face Recognition page in your dashboard ("Turn off face recognition"), or by emailing contact@surfgraphix.com with the subject "Facial Recognition Request". Turning it off deletes your enrollment images and all of your face templates (including those added under Section 5.3A), stops all scans for you, and keeps the rest of your account. Deleting your account does the same and deletes the account. We delete this data when you ask, and in any case within 48 hours. Matches already confirmed stay in your dashboard until you delete your account. You can enroll again later, with fresh consent.

5.8 Duplicate-account checks. Each account may belong to only one person. When you enroll, we also compare your new templates against other accounts at a very high similarity threshold. We do the same with bank account fingerprints and PayPal emails for filmers. If your face closely matches another account, your new account is automatically put on hold, and you will see a notice when you log in. An administrator then reviews it, usually within a day, and either lifts the hold or contacts you. You can ask for a review at any time by emailing support@surfgraphix.com. We never close an account or delete anything because of this check without a person deciding.

5.9 18+ only. Facial recognition is only for people aged 18 or older. Every enrollment path (guided recording, photos, and the checkout opt-in) requires you to confirm you are 18 or older. We do not verify age with documents, so we rely on that confirmation. If we find that someone under 18 has enrolled, or that templates were made from a minor's image through a checkout claim, we delete that biometric data immediately. Minors can still be tagged and can buy clips. Those features do not use biometric data.

5.10 Other automated image checks. These checks do not identify anyone:

Content checks. The cover frame of each uploaded clip is checked by AWS Rekognition (in Sydney) and by OpenAI and Google, to confirm it is surf footage and does not contain unsafe content. If a clip fails, its session is taken off the public site until an administrator reviews it.
Stance detection. To tell whether the rider in a clip is regular or goofy (Section 5.3), we may send an image of the rider (their body on the board) to AWS Rekognition, OpenAI and Google.

5.11 What we never do. We do not allow selfie searches for other people, surveillance, tracking, or law enforcement use. Enrolling images of another person is prohibited and results in account termination and deletion of the data.

5A. Decisions Made by Computer Systems

Some decisions are made, or partly made, by our systems:

Possible face matches are found automatically and checked by AI, but a person confirms every match before it reaches you (Sections 5.3 to 5.6).
Duplicate-account holds are applied automatically when a new enrollment closely matches another account, and lifted or confirmed by a person (Section 5.8).
Content checks on uploaded clips run automatically. If a clip fails, its session is taken off the public site until a person reviews it (Section 5.10).

If you think an automated outcome is wrong, email contact@surfgraphix.com and a person will review it.

5B. Tagging

Separately from facial recognition, a clip can be tagged with the surfer in it. Tagging does not use biometric data.

Anyone can suggest a tag with a name and, optionally, an email. Every tag is reviewed before it is applied.
If you have an account, an approved tag links the clip to your account and we notify you.
If you do not have an account, we may hold the name or email against the clip so you can be notified if you later register. We hold it only for this purpose.
You may ask us to remove a tag, name or email at any time under Section 9.
If you tag someone while logged in and they later buy that clip or photo, we issue a personal discount coupon to your account. We record which of your tags earned it. We never tell the person you tagged who tagged them.

5C. Surf Plans

If you log a surf you plan to do (beach, day and optional time), we review it and may share the beach, day and time with the Filmers who list that beach on their profile, by email and in their dashboard. We never share your name, email or any other detail that identifies you. You can delete a surf log at any time from your dashboard.

6. Previews, Highlight Reels, and Promotional Use

Public previews (cover frames, short preview videos and a free sample per session) are shown on the Platform so surfers can find their clips. Full-resolution media is only delivered after purchase.

For sessions from filmers on our Pro plan, we build a short highlight reel from a few seconds of many clips in the session. It has no sound, it shows the surfers in it, and it can appear on the session page, on our homepage, and in session listings. With the filmer's agreement we may also post reels and short excerpts on Surfgraphix social media accounts. We do not caption this content to suggest that any identifiable person endorses Surfgraphix, and we do not name or tag identifiable people without their permission. Filmers may opt out of promotional use of their content. Anyone appearing in a reel or promotional post may ask for it to be removed under Section 9.

7. Who We Share Information With

Filmers. When you buy a clip, the filmer who recorded it receives your name and email address with the sale notice and in their sales list, so they know who bought their work. Before a sale, filmers never see who a surfer is: matches, tags and surf plans are anonymised for them.

Service providers. We share personal information with these providers only as needed to run the Platform:

Payments and payouts: Stripe (Australia and United States), PayPal (Australia and United States)
Hosting and application servers: Vercel (United States and other regions), Supabase database (Sydney, Australia)
Storage, media processing and face matching: Amazon Web Services: S3, CloudFront, Lambda and Rekognition (Sydney, Australia; CloudFront delivers public previews from worldwide edge locations)
AI verification, content checks and stance detection: OpenAI (United States), Google Gemini (United States and other countries), as described in Sections 5.4 and 5.10
Email delivery: Brevo (European Union); Google Workspace, for our own mailbox (United States and other countries)
Analytics: Google Analytics and Google Search Console (United States), Microsoft Clarity (United States)
Australian Taxation Office: filmer identity details and earnings, where reporting is required of online marketplaces
Authorities or courts where we are legally required to disclose

Overseas disclosure. As the list shows, some providers process personal information outside Australia, mainly in the United States and the European Union. This includes facial images sent for AI verification, content checks and stance detection, and enrollment images passing through Vercel's servers. Face templates and the stored enrollment images stay in the Sydney region. Before we use a provider, we take reasonable steps under APP 8 to make sure it protects the information, by choosing established providers that are bound by their own privacy and security commitments. Please be aware that overseas providers are subject to the laws of their own countries.

8. Cookies and Analytics

We use cookies and similar technologies for login sessions, preferences, security, and analytics. Google Analytics and Microsoft Clarity load on our pages to help us understand how the Platform is used. Clarity can record sessions (scrolls, clicks and what was on screen). You can block or delete cookies in your browser, and browser privacy tools or extensions can block analytics, although some features may stop working.

9. Content Removal (Your Image in Footage)

You do not need an account to ask us to remove footage of you, or a tag, name or email linked to you. Use the "Request removal" button on the clip's page, or email contact@surfgraphix.com with the subject "Content Removal Request" and include the beach, date and approximate time of the session.

When we approve a request, we take the clip off sale and out of public view, delete its previews, and delete the tag or name. If the footage also appears in a highlight reel or one of our social media posts, we take that reel or post down. If someone already bought the clip before your request, they keep their copy, and we keep the original file only so that buyer can still download it.

9A. Children in Footage

Filmers record surf sessions in public places, and footage can include people who are minors. We take specific care here:

Facial recognition is an 18+ feature (Section 5.9). We do not knowingly create face templates for people under 18, and no one can search the Platform using a photo of another person, so the Platform cannot be used to find or track a specific child. Our systems do process the faces of everyone in the footage they search, including children, as described in Section 5.5, without identifying them or keeping templates.
Parents and guardians can have a child's footage removed, fast. A parent or guardian may request removal of any clip, reel, tag, or name relating to their child using the Content Removal process in Section 9 (no account needed). We treat requests concerning minors as a priority.
No identity is shown before a sale. Buyers browse clips, not named people, so a clip cannot be found by searching for a child's name.
Report a concern. If you believe footage of a minor is being used inappropriately, email contact@surfgraphix.com with the subject "Child Safety" and we will review it urgently.

10. Data Security

We protect personal information with encryption in transit, access controls and least-privilege permissions, secrets management, and Australian-region storage for face data. No system is completely secure, and we review our safeguards regularly.

Data breaches. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC in accordance with the Notifiable Data Breaches scheme.

11. Retention

Account data: until you delete your account
Facial recognition data: until you turn it off or delete your account, then deleted within 48 hours (Section 5.7)
Footage, previews and highlight reels: while the session is on the Platform. Original files of unsold clips in expired Basic sessions are deleted on the expiry date
Order and transaction records: as required for tax, accounting and legal purposes (generally 5 to 7 years), even after account deletion
Filmer tax and identity details: five years after the last transaction (Section 3 b1)
Log and analytics data: for the period reasonably necessary for security and Platform improvement

12. Your Rights

You may at any time:

Ask for access to the personal information we hold about you
Correct inaccurate information
Turn off facial recognition and delete your face data (Section 5.7)
Delete your account and associated data (completed within 48 hours, except records we must legally keep)
Opt out of marketing emails
Ask a person to review an automated outcome (Section 5A)
Complain about how we handle your information

To exercise any right, email contact@surfgraphix.com. We may ask for reasonable proof of identity. We respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

13. Children

The Platform is not directed at children under 16 and we do not knowingly collect their personal information without a parent's or guardian's consent. Facial recognition is 18+ only (Section 5.9).

14. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always on this page. For material changes, including any change to how biometric information is handled, we will notify registered users by email. A new use of your face data will not apply to you without your renewed consent.

15. Contact

Surfgraphix Rafael Franzese trading as Surfgraphix, ABN 42 521 911 385 Gold Coast, Queensland, Australia Email: contact@surfgraphix.com Website: https://surfgraphix.com