Privacy policy.

Who we are

Stuntman is operated by STUDIO SLATE PTY LTD (ABN 60 695 372 993). Our address is J36, 161 Arthur Street, Homebush West NSW 2140, Australia. For anything about your privacy, email chris@studioslate.com.au.

This policy covers the website at meetstuntman.com and the Stuntman product on the web, on iOS, through its API and through tools that connect to it (such as Claude or ChatGPT). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect

The website collects nothing. It sets no cookies, runs no analytics, and the box on the home page opens an email on your device without sending us anything.

When you use the Stuntman product, we store:

• Account: your sign-in identifier from Clerk, your workspace and the projects in it. Clerk holds your email address and name for sign-in; our own database stores only the identifier.
• What you make: prompts, reference photos and videos you upload, files you choose to import from ChatGPT, phone footage and its transcript, the takes and edits you choose, generated images and video, and each creation's status.
• Business material: the brief about your business, test plans, brand references, video ad variants, landing pages, and leads that people submit on landing pages you publish (their name, email, message and marketing consent).
• Connected accounts: for each social or advertising account you connect, the platform, the account's name and identifier, the connection status, and the permissions you granted. For a managed connection the access token is held by Zernio, the connection service. For a direct connection Stuntman holds the token itself.
• Reviews and approvals: the exact content of every post or advertising change you review (creative, caption, destination, audience, budget, schedule), the confirmations you gave, who approved it and when, and what the platform reported back.
• Advertising data: campaigns, ad groups, ads and performance figures read from the ad accounts you connect.
• Billing: credit purchases, reservations, charges and refunds. Card details go to Stripe or Apple and never reach us.
• Developer access: API keys (stored as a hash, never in plain text), their scopes and spend limits, and webhook endpoints.
• Usage events: which screens you reached and steps you took (for example a quote created or a checkout started), with the traffic source. These events do not contain your prompts, media or IP address, are deleted after 30 days, and are not recorded when your browser sends Do Not Track or Global Privacy Control.
• Support: emails you send us.

Why we use it

• To provide the product: make what you asked for, show you an exact review, carry out what you approved, and report the result.
• To charge you correctly and keep the records the law requires.
• To secure accounts, enforce approvals, and prevent an approval from being reused.
• To see where people get stuck in the product, using the usage events above.
• To answer you when you contact us.

We do not sell personal information. We do not use your prompts, media or connected-account data to train AI models.

Connected accounts

Stuntman connects to a social or advertising account in one of two ways. The connection screen tells you which one applies to the platform you are connecting.

Managed connections (how every connection works today)

Instagram, Facebook, TikTok, YouTube, Meta Ads and Google Ads are connected through Zernio, a connection service. You sign in on the platform's own permission screen. Zernio holds the platform's access token and carries out each approved action on Stuntman's instructions. Stuntman never sees your platform password and does not hold the token.

Direct connections (being built, not yet available)

Stuntman is building its own connections to Meta, TikTok, Google and YouTube, and X, using Stuntman's own developer apps. With a direct connection you still sign in on the platform's own screen, and the platform issues an access token to Stuntman rather than to Zernio. Stuntman will store that token, use it only for the permissions you granted and the actions you approved, delete it when you disconnect or when the platform tells us you revoked access, and never share it with anyone else. When a direct connection becomes available for a platform, this policy will say so and name the permissions it asks for.

Whichever way an account is connected, we read from it to show you what is there (your pages, channels, campaigns and their performance). We write to it only to carry out an action the workspace owner approved after an exact review: publishing a post, or a specific change to a campaign, ad group or ad. Reading never changes anything. Preparing a draft never publishes it.

Content you publish and campaigns you change live on the platform under its own terms and privacy policy. Disconnecting or deleting your Stuntman account does not remove them from the platform.

Google and YouTube

When you connect a YouTube channel, Stuntman uses YouTube API Services to read the channel and publish the videos you approve, with the visibility you chose. By using that connection you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

You can revoke Stuntman's access to your Google account at any time from the Google security settings page, as well as by disconnecting inside Stuntman.

Stuntman's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you turned on, we do not sell it, and we do not use it for advertising or to train AI models.

Who processes it

These companies process data on our behalf. Each sees only what its job needs.

When you approve a creation in Studio, the quote names the model and its provider before you confirm, and your prompt and selected references go to that provider through Sume. The current models include ones made by OpenAI, Google, ByteDance, Kling, MiniMax, xAI, Ideogram, Recraft and Black Forest Labs. Each creation asks you to confirm you have the rights to the media you supply.

The platforms you connect (Meta, Google, TikTok) receive the content and instructions of each action you approve, and handle them under their own policies.

Where it is processed

We operate from Australia. Our processors store and process data outside Australia, including in the United States. By using Stuntman you agree to that transfer. We choose processors that publish their own privacy commitments and we send each one only what its job needs.

How long we keep it

We keep your data while your account is open so your library, projects and records keep working. When you delete something, this is what happens:

• Leads submitted on a published landing page are deleted after 90 days, and leads on a preview page after 7 days. Usage events are deleted after 30 days.
• Media you delete from your library is marked deleted straight away and removed from storage. Links to it that were already issued keep working until they expire, which is within an hour.
• Account deletion is described below. Credit purchase and charge records are kept for accounting, with a minimal deletion record so the same account cannot be recreated by accident.
• Content already published to a platform stays there under the platform's own retention.
• AI providers and the platforms you connect keep data under their own policies; our deletion does not reach copies they hold.

Deleting and revoking

You can disconnect any connected account inside Stuntman, revoke Stuntman's access from the platform's own settings, delete individual media, or delete your whole account from the account menu. The data deletion page gives the exact steps, what happens, and how to ask by email instead.

Security

Traffic to Stuntman is encrypted with HTTPS. Sign-in is handled by Clerk. We never ask for, store or see your social-platform passwords. Platform access tokens for managed connections are held by Zernio; tokens for direct connections, once available, are held by Stuntman and deleted when you disconnect. API keys are stored as a hash and can be scoped and given a spend limit. Only the workspace owner can connect accounts, approve a post, approve ad spend or delete the account, and each approval is tied to the exact content reviewed and expires if unused. We do not hold a security certification and do not claim one.

Cookies and analytics

The website at meetstuntman.com sets no cookies and loads no analytics or advertising scripts. The Stuntman product uses cookies set by Clerk to keep you signed in, and your browser's session and local storage to remember settings and drafts on your device. It records the first-party usage events described above. It loads no third-party analytics or advertising trackers.

Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email chris@studioslate.com.au from the address you signed in with. We will confirm the request with that address before acting on it.

If you are unhappy with how we handled your information or a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Stuntman is for businesses and the people who run them. We do not knowingly collect information from children.

Changes and contact

When this policy changes we update the date at the top. Changes that reduce your rights or widen what we collect will be announced in the product before they take effect. Questions go to chris@studioslate.com.au.