Doughboy is owned and operated by Cameron James Moir, ABN 52 721 553 987, of Queensland, Australia ("we", "us", "our"). Cameron is a sole trader (not an incorporated company). "Streamables" is the informal brand name for the business.
For privacy law, it matters in which capacity we handle data:
Privacy contact for any request or question: doughboy@streamables.live.
Data Protection Officer. We are not required to appoint a Data Protection Officer under Article 37 GDPR, because our core activities do not involve large-scale systematic monitoring or large-scale processing of special-category data. Privacy matters are handled directly by Cameron at the address above.
EU/UK representative. Where Article 27 GDPR or Article 27 UK GDPR requires a non-EU/UK controller offering services to data subjects there to appoint a local representative, we will appoint one and publish their contact details here. Where the Article 27(2) exemption applies (processing that is occasional, does not include large-scale special-category data, and is unlikely to result in a risk to individuals' rights and freedoms), no representative is appointed.
We do not collect special-category data under Article 9 GDPR (such as health, biometric, racial/ethnic, political, religious, or sexual-orientation data), nor government identifiers, GPS location, advertising identifiers, or marketing/analytics tracking. Please do not enter special-category data into free-text fields.
Most data we hold comes directly from you. Where you are invited by your organisation's admin, some of your account data (your name, email, and role) is provided to us by your organisation rather than by you directly - this notice satisfies our obligation under Article 14 GDPR to tell you about that. We do not buy personal data or obtain it from third-party data brokers.
As controller, we process personal data only for the purposes below, each with a lawful basis under Article 6 GDPR (and the corresponding APP basis in Australia):
| Purpose | Lawful basis (GDPR Art 6) |
|---|---|
| Creating and operating your account; authenticating you; providing the platform | Performance of a contract (Art 6(1)(b)) |
| Processing subscriptions and payments; sending service emails (invites, password resets, receipts, service notices) | Performance of a contract (Art 6(1)(b)) |
| Keeping tax, accounting, and acceptance records | Compliance with a legal obligation (Art 6(1)(c)) |
| Securing the platform, preventing fraud and abuse, keeping audit/error logs, and improving reliability | Our legitimate interests in running a safe, reliable service (Art 6(1)(f)), balanced against your rights |
| Responding to your requests and resolving disputes or support issues | Performance of a contract and/or legitimate interests (Art 6(1)(b)/(f)) |
| Any optional communications you ask for | Your consent (Art 6(1)(a)), which you can withdraw at any time |
We do not use your data to train AI models, to profile you for advertising, or to sell or rent it to anyone. Where we rely on legitimate interests, you may object as described in clause 9.
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling within the meaning of Article 22 GDPR.
We share personal data only with the service providers (processors) we rely on to run Doughboy, each bound by a data-processing agreement and permitted to use the data only to provide their service to us:
| Provider | Purpose | Location |
|---|---|---|
| Supabase (on AWS) | Database, authentication, file storage | Tokyo, Japan (ap-northeast-1) |
| Vercel | Web hosting, serverless functions, global edge delivery | Global edge; functions execute in the Tokyo (hnd1) region |
| Stripe | Payment processing and subscription billing | United States (and regional infrastructure) |
| Namecheap PrivateEmail | Transactional email (invites, resets, receipts, notices) | United States |
We also share within your organisation - your admins and teammates can see your name, email, and role according to their permissions. We will disclose data to law enforcement or regulators only on a lawful, binding request, and will tell you unless legally prohibited. We do not sell, rent, or trade personal data.
We are based in Australia and use providers in Japan and the United States, so personal data is transferred outside the EEA, the UK, and Australia. For transfers of EEA or UK personal data to a third country, we rely on a valid transfer mechanism under Chapter V GDPR / the UK GDPR:
For transfers from Australia, we take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles. You can request a copy of the relevant safeguards by emailing us.
For Customer Data we process on your organisation's behalf, retention and deletion follow your organisation's instructions under the Data Processing Addendum.
Subject to the conditions and exceptions in the GDPR, the UK GDPR, and the Australian Privacy Act, you have the right to:
To exercise any right, email doughboy@streamables.live. We will respond without undue delay and within one month (extendable by two further months for complex requests, in which case we will tell you), and we will not charge a fee unless the request is manifestly unfounded or excessive. If you are exercising a right over Customer Data your organisation controls, we will refer your request to that organisation.
We hope you'll raise any concern with us first. You also have the right to lodge a complaint with a supervisory authority:
We use only strictly necessary cookies and local storage:
We do not use advertising, analytics, or third-party tracking cookies, so no consent banner for non-essential cookies is required.
If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33 GDPR). Where the breach is likely to result in a high risk to you, we will also notify you without undue delay (Article 34 GDPR). In Australia, we will additionally comply with the Notifiable Data Breaches scheme and notify the OAIC and affected individuals where the scheme requires.
Doughboy is a workplace tool for adults and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a minor has been given an account, contact us and we will delete it.
We may update this policy. The version number and effective date above indicate the current version. For material changes (e.g. a new processor, a new purpose, or a change to how we share data) we will notify active customers by email or in-app notice before the change takes effect. Earlier versions remain available on request, and prior versions referenced in signed agreements stay accessible at their versioned URLs.