SurfgraphixSURFGRAPHIX

SURFGRAPHIX PRIVACY POLICY

Last updated: 3 August 2026

1. Who We Are

Surfgraphix ("Surfgraphix", "we", "our", "us") is operated by Rafael Franzese, sole trader trading as Surfgraphix, ABN 42 521 911 385, based in Gold Coast, Queensland, Australia.

Surfgraphix is an online marketplace where surf filmers upload footage of surf sessions and surfers can discover and purchase clips featuring themselves, including through optional surfer tagging, beach notifications, and facial recognition services.

Although Surfgraphix may qualify as a small business under the Privacy Act 1988 (Cth), we voluntarily apply the Australian Privacy Principles (APPs) and the guidance of the Office of the Australian Information Commissioner (OAIC), particularly regarding biometric information.

Contact for all privacy matters: contact@surfgraphix.com

2. Scope

This Privacy Policy applies to the Surfgraphix website (surfgraphix.com), marketplace, dashboards, notification services, facial recognition services, and all related communication channels, including our social media accounts and email notifications.

By using the Platform you acknowledge this Privacy Policy. Facial recognition is never activated by acknowledgement alone; it requires your separate, explicit opt-in consent as described in Section 5.

3. What Information We Collect

a) Surfers and buyers

  • Full name, email address, password (stored as a hash), country and region
  • Preferred beaches for session notifications
  • Purchase history, order details, and delivery records
  • Tagging information: a filmer may tag you in a specific clip, linking your account or your name to that clip (see Section 5A)
  • Optional: facial recognition enrollment data (see Section 5)

b) Filmers

  • Full name, email address, and business or brand name (if applicable)
  • Session details submitted through the session creation form (name, email, beach, date, time)
  • Plan type, commission rate, and pricing settings
  • Payout destination: your PayPal email address, and the bank account you connect through Stripe. Bank account numbers are held by Stripe, not by Surfgraphix
  • Portfolio information and social media handles (optional)

b1) Filmer tax and identity details

Before we release a payout, we collect:

  • Your legal full name
  • Your date of birth, used to confirm you are 18 or over
  • Your residential or business address
  • Your Australian Business Number (ABN), if you have one. If you do not, you tell us instead that you are not carrying on a business

We collect this because Australian law requires online marketplaces to identify the sellers who earn money through them and to report that income to the Australian Taxation Office, and because selling on Surfgraphix is restricted to adults.

These details are held separately from your public filmer profile. They are never shown on your profile, in the filmer directory, on session pages, or to surfers. We keep them for five years after your last transaction, which is the record-keeping period the ATO requires, and then delete them.

c) People appearing in footage (including non-users)

Filmers record surf sessions at public beaches. Uploaded footage may show people who do not have a Surfgraphix account. We host and display this footage on behalf of filmers. A filmer may also tag a clip with the name of a person who does not have an account, so that person can be identified and notified if they later register. If you appear in footage or have been tagged and want the footage or tag removed, see Section 9 (Content Removal).

d) Technical information

  • IP address, device and browser information, and log data
  • Cookies and similar technologies (see Section 8)
  • Website usage and behaviour analytics (for example, heatmaps and session recordings via Microsoft Clarity)
  • Approximate location data, only with your permission

e) Payment information

Payments are processed by third-party payment processors (currently Stripe and PayPal and, for legacy purchases, Shopify Payments). We do not receive or store full card numbers or PayPal credentials.

4. How We Use Your Information

We use personal information to:

  • Create and manage accounts and verify email addresses
  • Operate the marketplace: list sessions, display previews, process purchases, and deliver purchased media
  • Send session notifications for your selected preferred beaches
  • Run the optional facial recognition matching service for enrolled surfers (Section 5)
  • Process filmer payouts and subscription billing
  • Confirm filmer identity and age, and meet our reporting obligations to the Australian Taxation Office
  • Send transactional emails (purchase confirmations, download links, match notifications, account notices)
  • Send marketing communications where you have opted in; you can unsubscribe at any time
  • Promote the Platform, including short preview excerpts of session footage on our website and social media (see Section 6)
  • Analyse and improve Platform performance, prevent fraud and abuse, and keep the Platform secure
  • Comply with legal obligations

We do not sell personal information. We do not use personal information for automated decision-making that produces legal or similarly significant effects.

5. Facial Recognition and Biometric Information

Facial recognition involves biometric information, which is sensitive information under the Privacy Act. We treat it with the highest level of care and it is governed by the following rules.

5.1 Strictly opt-in. Facial recognition is voluntary and disabled by default. It only applies to surfers who complete enrollment and give explicit consent by ticking a dedicated consent checkbox. You can use every other Platform feature without enrolling.

5.2 What we collect at enrollment. A clear front-facing portrait photo of yourself (required) and optional left and right angle photos. From these photos, AWS Rekognition generates a mathematical facial template linked to your account. Photos are stored in AWS S3 and templates in an AWS Rekognition collection containing only enrolled Surfgraphix surfers, both in the Sydney, Australia region (ap-southeast-2).

5.2A Enrollment at checkout ("Find my waves"). When you buy a clip, you may tick a separate, optional, unticked checkbox stating that you are the surfer in that clip and asking us to find your waves in other sessions filmed at the same beach. This checkbox is never required to complete a purchase. If you tick it: we create or use your surfer profile under the email you bought with; we use the frames of the clip you purchased to generate your facial template (instead of a portrait photo); we compare that template against sessions filmed at the beach where your purchased clip was filmed; your claim to the purchased clip and any candidate matches found are reviewed by a human before anything is confirmed; and confirmed results are emailed to you. Everything else in this Section 5 (verification, retention, deletion, your rights) applies identically to checkout enrollment. If you later complete the guided portrait enrollment, those reference photos replace the clip frames.

5.3 How matching works. When a filmer uploads a new session, still frames from each clip are compared against the templates of enrolled surfers. If you use the "Find my clips" feature, the same comparison also runs against existing clips on the Platform that have not yet been matched to anyone. Candidate matches above our confidence threshold are then verified before confirmation (Section 5.4), and a confirmed match triggers an email notification to you with a watermarked preview.

5.4 AI verification of candidate matches. To reduce false positives, a candidate match may be verified by third-party AI vision services (currently OpenAI and Google) before it is confirmed. These services transiently receive your enrollment photo alongside the matched video frame and answer only whether the two show the same person. They are used solely for this verification, and we configure them not to retain or train on the images where the provider offers that control. These providers may process the images outside Australia. Your facial template itself never leaves the Sydney region.

5.5 People who are not enrolled. Faces detected in uploaded footage that do not belong to enrolled surfers are processed transiently during the automated comparison and are not indexed, stored as templates, identified, or linked to any individual. We do not build any database of faces of non-enrolled people, and no one can search our platform using a photo of another person.

5.6 What we never do. We do not permit selfie-based searching of other people, surveillance, tracking, or law enforcement use. Enrolling photos of another person is prohibited and results in account termination and deletion of the data.

5.7 Retention and deletion. Enrollment photos and facial templates are kept only while your enrollment is active. You may opt out at any time in account settings or by emailing contact@surfgraphix.com with the subject "Facial Recognition Request". All enrollment photos and biometric templates are permanently deleted within 48 hours of your request or account deletion.

5.8 Accuracy. Facial recognition is not 100% accurate. False positives and false negatives can occur. Matching is used only to notify you of potential appearances; it never blocks, penalises, or makes decisions about you.

5.9 18+ only. Facial recognition is available only to people aged 18 or older. Every enrollment path (guided video, photo upload, and the checkout opt-in) requires you to confirm you are 18 or older, and we do not offer a facial recognition option for minors. If we discover that someone under 18 has enrolled, we delete their biometric data immediately. Minors can still be manually tagged by a filmer and can buy their own clips; those features do not use biometric data.

5.10 Governance. We have completed a Privacy Impact Assessment for this feature and review it whenever the system materially changes.

5A. Filmer Tagging

Separately from facial recognition, a filmer can manually tag a specific clip with the surfer in it. Tagging does not use biometric data.

  • If you have an account, the tag links the clip to your account and you receive an email notification.
  • If you do not have an account, the filmer may record your name against the clip so you can be identified and notified if you later register. We hold that name only for this purpose.
  • Where a clip has both a manual tag and a facial recognition match, the human-verified tag is treated as the stronger signal.
  • You may ask us to remove a tag or the associated name at any time under Section 9.

6. Previews, Watermarks, and Promotional Use

Publicly visible previews (cover frames and watermarked low-resolution animations) are displayed on the Platform so surfers can find their clips. Full-resolution media is only delivered after purchase.

We may publish short excerpts of session footage (for example, brief highlight compilations) on the Surfgraphix website and social media accounts to document surf conditions and promote the Platform. We do not caption this content to suggest that any identifiable person endorses Surfgraphix, and we do not name or tag identifiable people without their permission. Filmers may opt out of promotional use of their content. Anyone appearing in promotional content may request its removal under Section 9, and we will action valid requests promptly.

7. Who We Share Information With

We share personal information only as needed to operate the Platform:

  • Payments and payouts: Stripe; PayPal; Shopify Payments (legacy purchases)
  • Hosting and infrastructure: Vercel, Supabase (Sydney region), Amazon Web Services (S3, CloudFront, Rekognition; Sydney region), Google (Drive, Forms, Sheets, Apps Script), Framer
  • Media processing: Cloudinary (legacy), AWS Lambda
  • Workflow automation: Make.com
  • Database and operations: Airtable
  • AI match verification: OpenAI, Google (facial recognition only, as described in Section 5.4)
  • Email delivery: Brevo; Gmail (fallback)
  • Analytics: Microsoft Clarity, Google Search Console
  • Australian Taxation Office: filmer identity details and earnings, where reporting is required of online marketplaces
  • Authorities or courts where we are legally required to disclose

Some providers process data outside Australia (including in the United States and the European Union). Where personal information leaves Australia we take reasonable steps consistent with APP 8 to ensure it remains protected, including selecting providers with recognised security certifications and, wherever available, Australian-region hosting. Biometric enrollment photos and facial templates are stored exclusively in the Sydney, Australia region; the only overseas processing of facial images is the transient AI match verification described in Section 5.4.

8. Cookies and Analytics

We use cookies and similar technologies for login sessions, preferences, security, and analytics. Analytics tools help us understand how the Platform is used so we can improve it. You can disable cookies in your browser, although some features may stop working.

9. Content Removal (Your Image in Footage)

You do not need an account to ask us to remove footage showing you, or a tag or name linked to you. Email contact@surfgraphix.com with the subject "Content Removal Request" and include the beach, date, and approximate time of the session. Upon receiving a valid request we will promptly remove or block access to the media featuring you and delete any associated tag.

9A. Children in Footage

Filmers record surf sessions in public places, and footage can include people who are minors. We take specific care here:

  • Facial recognition is never applied to minors. It is an 18+ feature (Section 5.9). We do not build face templates for people under 18, and no one can search the Platform using a photo of another person (Section 5.6), so the Platform cannot be used to find or track a specific child.
  • Parents and guardians can have a child's footage removed, fast. A parent or guardian may request removal of any clip, tag, or name relating to their child using the Content Removal process in Section 9 (no account needed). We treat requests concerning minors as a priority and act promptly.
  • No identity is exposed before a sale. Buyers browse anonymised clips, not named people, so a clip cannot be shopped for by a child's identity.
  • Report a concern. If you believe footage of a minor is being used inappropriately, email contact@surfgraphix.com with the subject "Child Safety" and we will review it urgently.

10. Data Security

We protect personal information with measures including encryption in transit, access controls and least-privilege permissions, secrets management, Australian-region storage for sensitive data, and monitoring. No system is completely secure, but we follow industry best practices and review our safeguards regularly.

Data breaches. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC in accordance with the Notifiable Data Breaches scheme.

11. Retention

  • Account data: until account deletion
  • Facial recognition data: until opt-out or account deletion, then permanently deleted within 48 hours
  • Order and transaction records: retained as required for tax, accounting, and legal purposes (generally 7 years) even after account deletion
  • Log and analytics data: for the period reasonably necessary for security and Platform improvement

12. Your Rights

You may at any time:

  • Access the personal information we hold about you
  • Correct inaccurate information
  • Delete your account and associated data (completed within 48 hours, except records we must legally retain)
  • Withdraw facial recognition consent (Section 5.6)
  • Opt out of marketing communications
  • Complain about our handling of your information

To exercise any right, email contact@surfgraphix.com. We may ask for reasonable proof of identity. We respond within 30 days. If you are unsatisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

13. Children

The Platform is not directed at children under 16 and we do not knowingly collect their personal information without parental consent. Facial recognition is 18+ only (Section 5.9) and is never offered to minors.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available on this page. For material changes, including any change to how biometric information is handled, we will notify registered users by email. Changes to biometric processing will never apply to you without renewed consent.

15. Contact

Surfgraphix Rafael Franzese trading as Surfgraphix, ABN 42 521 911 385 Gold Coast, Queensland, Australia Email: contact@surfgraphix.com Website: https://surfgraphix.com