Privacy Policy

1. Introduction

Held in Print (“we”, “us”, “our”) operates the Held in Print mobile application and related services. Held in Print is a family newspaper service that connects Australian families across generations through printed and digital editions.

This Privacy Policy explains how we collect, use, store, and disclose your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies to all users of the Held in Print mobile application, website, and related services.

2. Information We Collect

We collect the following types of information:

• Account information: your name, email address, and authentication details when you sign up via Apple, Google, or magic link.
• Content you provide: photos, text contributions, voice recordings, and other materials you submit for inclusion in your family’s newspaper.
• Delivery information: postal addresses for print edition recipients.
• Payment information: billing details processed securely through Stripe. We do not store full card numbers on our servers.
• Usage data: information about how you interact with the app, including device type, operating system, and feature usage, to improve our service.

3. How We Use Your Information

We use your personal information to:

• Compile your family’s newspaper from the memories you share.
• Print and deliver physical newspaper editions to designated recipients.
• Provide digital editions through the Held in Print app.
• Manage your account, subscriptions, and payment processing.
• Transcribe voice recordings into text so they can be printed.
• Send transactional emails (e.g., delivery confirmations, account notifications).
• Improve and maintain our services, including bug fixes and feature development.
• Comply with legal obligations.

4. Data Storage & Security

Your data is stored on Supabase infrastructure in the Sydney, Australia region (ap-southeast-2), ensuring Australian data sovereignty for your primary data at rest.

We protect your information through:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Row-level security policies that restrict data access to authorised group members.
• Secure authentication via industry-standard OAuth 2.0 and magic link flows.
• Regular security reviews and monitoring.

5. Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

• Service providers: with trusted third-party providers who assist us in operating Held in Print (see Section 6 for overseas providers).
• Legal obligations: when required by law, regulation, or legal process.
• Safety: to protect the rights, safety, or property of Held in Print, our users, or the public.
• With your consent: when you have given explicit permission to share specific information.

6. Overseas Disclosure (APP 8)

In accordance with Australian Privacy Principle 8, we disclose that your personal information may be processed by the following overseas service providers:

Each provider is contractually bound to handle your information in accordance with applicable privacy standards. We take reasonable steps to ensure overseas recipients comply with the APPs.

7. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: retained while your account is active. Deleted within 30 days of account deletion request.
• Content (photos, text, voice): retained while your group subscription is active. Removed within 30 days of group cancellation or member departure, unless required by law.
• Published editions: archived newspaper editions are retained for 12 months after publication to allow members to access past editions.
• Payment records: retained for 7 years as required by Australian taxation law.
• Usage data: anonymised and aggregated after 90 days. Raw usage data is not retained beyond this period.

8. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate or out-of-date information.
• Request deletion of your personal information, subject to any legal obligations we may have to retain certain records.
• Lodge a complaint if you believe your privacy has been breached (see complaint process below).

To exercise any of these rights, contact us at the details below. We will respond to access and correction requests within 30 days.

Complaint Process

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint by emailing privacy@heldinprint.au with the subject line “Privacy Complaint”. Please include a description of the issue and any relevant details.

We will acknowledge your complaint within 7 days and investigate promptly. We aim to resolve all complaints within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

9. Our Data Promise

10. Contact

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

Email: privacy@heldinprint.au

We aim to respond to all privacy enquiries within 30 days.