Privacy policy

YapSlinger (“YapSlinger”, “we”, “us”) provides a platform that lets organisations invite people to answer questions with short video, photo or written responses. This policy explains what personal information we handle, why, and the choices you have.

This policy is written to align with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, where it applies, the EU/UK GDPR.

When an organisation runs a campaign, that organisation decides what to ask, who to invite and how responses are used. They are the data controller. YapSlinger acts as a processor on their instructions for the campaign content they collect.

For our own website, accounts, billing and support, YapSlinger is the controller.

• Account data — name, work email, password hash, organisation and role, created when an administrator or reviewer signs up.
• Campaign data — campaign names, questions, invitation lists (name, email and optional role, department or location) uploaded by the organisation.
• Contributor responses — video, audio, photo and written answers, plus the name, email and details a contributor provides. Contributors do not need an account.
• Consent records — the consent statement shown, whether it was accepted, and the time it was accepted.
• Billing data — subscription tier and payment status. Card details are handled by our payment provider and never stored by us.
• Usage data — page views, device and browser type, and approximate referrer information used to keep the service reliable and understand usage.

• To deliver campaigns, collect responses and run review and approval workflows.
• To send invitations, reminders, account emails and service notices.
• To generate Story Packs and export files at the organisation’s request.
• To provide support, prevent abuse, secure the service and meet legal duties.
• To process subscriptions and payments.

Where the GDPR applies, we rely on performance of a contract, our legitimate interests in operating and securing the service, consent (for recording and publishing a contributor’s story), and compliance with legal obligations.

Contributors are shown the campaign owner’s consent statement before recording and must actively agree before any response is submitted. Contributors can decline, stop at any point, or ask the campaign owner to delete their response. Withdrawing consent does not affect uses that already occurred before withdrawal.

We do not sell personal information. We share it only with:

• The organisation running the campaign you responded to.
• Paddle.com, our Merchant of Record, for the sale of our plans, subscription management, payments, invoicing and tax compliance.
• Service providers that host our database and media storage, send our email and provide optional AI transcription and summarisation features.
• Authorities or advisers where required by law or to establish or defend legal claims.

Providers are bound to use the data only to deliver their service to us. We do not use contributor media to train public AI models.

Our database, file storage and processing run on cloud infrastructure that may be located outside your country, including in the Asia-Pacific region, the United States and the European Union. Where personal information is transferred overseas we take reasonable steps to ensure it is handled consistently with this policy and applicable law, including using standard contractual clauses where required.

Access to campaign data is restricted to the owning account through row-level database policies. Media files are held in private storage and served through short-lived signed links. Data is encrypted in transit and at rest. No system is perfectly secure, so we also limit retention and access to what is needed.

Campaign content is kept while the owning account is active, or until the organisation deletes it. Deleting a submission removes its records and stored media. Account and billing records are kept for as long as needed to run the account and to meet tax and legal obligations, then deleted or de-identified.

You can request access to, correction of, or deletion of your personal information, object to or restrict certain processing, and request a copy of data you provided. If you responded to a campaign, contact the organisation that invited you first — they control that content. You can also contact us and we will help route the request.

You may complain to your local privacy regulator, including the Office of the Australian Information Commissioner.

We use essential cookies and local storage to keep you signed in and to keep the service working. We record basic, aggregated page-view data to understand traffic. We do not run third-party advertising trackers.

YapSlinger is intended for organisational use by adults. Where a campaign involves people under 16, the organisation running it is responsible for obtaining any required parental or guardian consent before inviting them.

We may update this policy as the service changes. Material changes will be reflected in the “last updated” date above. For privacy questions or requests, send a privacy enquiry.