Services Agreement

A. Under this Agreement, OneCast agrees to provide the Platform and related services to the Operator, and the Operator accepts those services, on the terms set out in this Agreement.

B. The Agreement consolidates the terms of service, data processing terms, privacy notice, security commitments and subprocessor disclosures for the OneCast Studio platform into one document.

C. By creating an account, clicking “I agree”, commencing a free trial, paying Fees, executing an Order, or otherwise accessing or using the Platform, the Operator indicates acceptance of this Agreement and agrees to be legally bound by it.

1.1 Definitions. In this Agreement, unless the context indicates the contrary:

• Accounting System means any accounting, bookkeeping, invoicing, tax or financial-record system that the Operator elects to connect to the Platform, or that OneCast uses for its own accounting and tax records.
• API means an application programming interface, being a technical interface that allows software systems to communicate with one another.
• Applicable Privacy Law means the Privacy Act 1988 (Cth), including the Australian Privacy Principles and the Notifiable Data Breaches scheme, and any other Australian privacy, surveillance, spam, online-safety or data-protection law that applies to the relevant handling of Personal Information. A foreign privacy law is included only to the extent OneCast is directly subject to that law or OneCast has expressly agreed in writing to support that jurisdiction.
• Australian Consumer Law or ACL means Schedule 2 to the Competition and Consumer Act 2010 (Cth), and any other legislative provisions relating to Australian consumer law that cannot be excluded, restricted or modified.
• Business Day means a day other than a Saturday, Sunday or public holiday in South Australia.
• CDN means any content delivery network used as part of the Platform to distribute website, application or file-delivery traffic across network locations.
• Commencement Date means the date on which the Operator first accepts this Agreement, creates an account, commences a trial, pays Fees, signs an Order, or otherwise first accesses or uses the Platform, whichever occurs first.
• Confidential Information means all information provided by one party to the other in connection with this Agreement where such information is identified as confidential at the time of disclosure or ought reasonably be considered confidential based on its content, nature or the manner of its disclosure, but excludes information that enters the public domain other than through breach of this Agreement, information disclosed to a party by a third party without breach of confidence, and information independently developed by a party.
• Content means all data, files, images, video, audio, text, metadata, client records, bookings, quotes, invoices, briefs, project records, communications and other material uploaded to, generated within, transmitted through or stored on the Platform by or on behalf of the Operator, Team Members or End Clients.
• Controller Data means Personal Information that the Operator, an End Client, a Team Member or another individual acting under the Operator’s authority records, uploads, generates or transmits on the Platform.
• Data Subject means an identified or reasonably identifiable individual to whom Personal Information relates.
• End Client means a client of the Operator who is given access to a client portal, gallery, video-review page, approval link or delivery link created by the Operator within the Platform.
• Fees means the subscription fees, plan fees, seat fees, usage fees and any other charges payable for the Subscription, as specified on the Pricing Page or in an Order, as updated from time to time in accordance with this Agreement.
• Force Majeure Event means any event beyond a party’s reasonable control, including natural disaster, fire, flood, severe weather, pandemic or epidemic, government action, civil unrest, terrorism, act of war, strike or labour dispute, failure of a utility, internet, telecommunications or hosting provider, or large-scale cyber-attack.
• GST means has the meaning given in A New Tax System (Goods and Services Tax) Act 1999 (Cth).
• GDPR means Regulation (EU) 2016/679 (General Data Protection Regulation), as amended or replaced from time to time.
• Intellectual Property Rights means all intellectual property rights, including copyright, patents, trade marks, design rights, trade secrets, domain names, know-how, Moral Rights and other rights of a similar nature, whether registrable or not and whether registered or not, and any application for registration or right to make such an application.
• Legal Hold means a requirement to preserve data or records because of a law, court order, regulatory request, dispute, security investigation, insurance requirement or other legal obligation.
• Moral Rights means has the meaning given under the Copyright Act 1968 (Cth) and includes any similar rights existing in other countries.
• Operator means the person, business or other entity that subscribes to the Platform, accepts this Agreement and is the account-of-record. Where the context permits, a reference to the Operator includes Team Members and persons using the Platform under the Operator’s authority.
• Operator Instructions means the Operator’s instructions to OneCast in relation to processing Controller Data, given through the Operator’s use of Platform features, configuration settings, Orders and written support communications.
• Order means any online checkout, order form, statement of work, quote, proposal or other ordering document for a Subscription that is expressly accepted by both parties.
• Payment System means any payment processor, payment gateway, card network, issuing bank, merchant facility, billing platform or other system used to process, authorise, settle, refund, reconcile or evidence payments for a Subscription.
• Personal Information means has the meaning given in the Privacy Act 1988 (Cth) and, where the GDPR applies, includes Personal Data.
• Platform means the OneCast Studio software-as-a-service application, including its websites at onecast.studio, its administration and client-portal interfaces, APIs, related software, features, documentation and hosted services.
• Pricing Page means the page or pages on onecast.studio that set out the then-current plans, inclusions and Fees for the Platform.
• Security Incident means unauthorised access to, disclosure of, loss of, or material compromise of Content, Controller Data or other Personal Information affecting an Operator.
• Security Measures means the technical and organisational security measures described in clause 11 and Schedule 2, as updated from time to time in accordance with this Agreement.
• Subscription means a paid plan giving the Operator access to the Platform for a recurring billing period.
• Subprocessor means a third-party provider engaged by OneCast to host, process or transmit Content, Controller Data, Personal Information, metadata or operational service data in connection with providing the Platform.
• Team Member means any additional user the Operator invites to access the Operator’s account.
• User means any individual who accesses the Platform, including an Operator, Team Member or End Client.

1.2 Interpretation. Unless the context requires otherwise:

• 1.2.1 a reference to a person includes a corporation, partnership, trust, association, government body or other legal entity;
• 1.2.2 the singular includes the plural and vice versa;
• 1.2.3 headings are for convenience and do not form part of this Agreement or otherwise affect interpretation;
• 1.2.4 the term “includes” or any similar term means “includes without limitation”;
• 1.2.5 a reference to any statute includes any amended, consolidated or re-enacted version of that statute and all delegated legislation or other statutory instruments made under it;
• 1.2.6 a reference to a document includes that document as varied, replaced or updated in accordance with this Agreement or the document’s own terms;
• 1.2.7 a reference to writing includes email and in-app notice unless a clause expressly requires another method; and
• 1.2.8 a reference to a party includes its successors and permitted assigns.

2.1 This Agreement begins on the Commencement Date and continues until terminated under this Agreement.

2.2 If the Operator accepts this Agreement on behalf of a business or other entity, the person accepting represents and warrants that the person has authority to bind that entity, and “Operator”, “You” and “Your” refer to that entity.

2.3 This Agreement governs the Operator’s access to and use of the Platform, including use by Team Members and End Clients invited or enabled by the Operator.

2.4 No End Client is a party to this Agreement. OneCast does not contract with, charge or owe service obligations to an End Client merely because the End Client accesses a portal, gallery, video-review page, approval link or delivery link created by the Operator. The Operator remains responsible for its own contract and relationship with each End Client.

3.1 OneCast will provide the Operator with access to the Platform during the Subscription, subject to this Agreement and any applicable Order.

3.2 The Platform is a cloud-based studio-management platform for photography, videography and related studio businesses. It includes tools for quote and proposal creation, invoice generation, booking and calendar management, client portals, project and shoot tracking, briefs and production timelines, frame-accurate video review and approval, password-protected galleries, file-delivery links, and related communication and notification tools.

3.3 The Platform is software only. OneCast does not provide photography, videography, editing, production, legal, accounting, tax or insurance services, and is not a party to any contract, quote or engagement between the Operator and an End Client.

3.4 OneCast may add, modify or discontinue Platform features from time to time to improve, secure or maintain the Platform. OneCast will not materially remove core paid functionality during a paid billing period unless reasonably necessary for security, legal compliance or reliable operation. Where a planned change materially reduces the core functionality of a paid plan, OneCast will give the Operator at least 30 days notice and the Operator may cancel before the change takes effect.

4.1 The Operator must register for the Platform using accurate, current and complete information and must keep that information up to date.

4.2 The Operator must be at least 18 years of age and must use the Platform in the course of a business or with authority to bind a business.

4.3 Each Subscription is for one studio business unless OneCast agrees otherwise in writing. Operating multiple distinct studio businesses requires separate Subscriptions.

4.4 The Operator is responsible for keeping account credentials confidential and for all activity under its account. The Operator must use strong, unique passwords, enable two-factor authentication where available, control Team Member access, and notify OneCast immediately at [email protected] if the account may have been accessed without authorisation.

4.5 Team Members act under the Operator’s authority. The Operator must ensure that Team Members comply with this Agreement and is responsible for their use as if it were the Operator’s own use.

4.6 End Clients access only the portals, galleries, review pages, delivery links or other surfaces made available by the Operator. The Operator is responsible for the permissions, invitations, portal settings, PIN settings and content made available to End Clients.

5.1 The Fees for each plan are those set out on the Pricing Page or in an Order. Fees are quoted in Australian dollars unless stated otherwise. The Pricing Page is a website page and may be updated from time to time in accordance with this Agreement.

5.2 New Operators may be offered a free trial if stated on the Pricing Page or in an Order. Unless OneCast expressly states otherwise, a trial ends automatically at the end of the trial period and no paid Subscription begins until the Operator chooses to start a paid Subscription.

5.3 Paid Subscriptions are billed in advance for the billing period stated on the Pricing Page or in the Order. By providing or authorising a payment method, the Operator authorises OneCast and the relevant Payment System to process recurring charges for the Subscription until it is cancelled in accordance with this Agreement.

5.4 OneCast does not collect or store full card numbers. Payment credentials and payment details are handled by the relevant Payment System. OneCast may receive limited billing metadata, such as payment status, transaction identifiers, the payment method type, last-four digits, issuing bank or similar payment information needed for billing display, reconciliation, fraud prevention and support.

5.5 Prices shown on the Pricing Page are inclusive of Australian GST where GST applies. A tax invoice or receipt for each payment will be made available through the Platform or by the relevant Payment System.

5.6 OneCast may change Fees for a plan by giving the Operator at least 30 days written notice by email or in-app notice. The changed Fees apply from the first billing period beginning after the notice period. If the Operator does not accept a Fee increase, the Operator may cancel before the increase takes effect.

5.7 Subject to non-excludable rights under the ACL, Subscription Fees are charged in advance for each billing period and cover that period as a whole. If the Operator cancels mid-period, the Subscription remains active until the end of the paid period and there is no pro-rata refund for unused days, unless this Agreement or the ACL requires otherwise.

5.8 If a renewal payment fails, the Subscription may enter a grace period during which the Payment System may re-attempt the charge. If payment is not successfully recovered by the end of the grace period, OneCast may suspend or terminate access.

5.9 Where Fees remain unpaid after the grace period and OneCast is required to take recovery steps, OneCast may add interest at the statutory rate prescribed for pre-judgment interest in the Supreme Court of South Australia, calculated daily on simple-interest terms, and reasonable, actual and documented recovery costs.

6.1 Where the in-app cancellation control is available, the Operator may lodge cancellation through that control. The request is lodged immediately on submission, but cancellation takes effect at the end of the then-current paid billing period unless the Operator is exercising a non-excludable right to an earlier remedy.

6.2 If the in-app cancellation control is unavailable, the Operator may cancel by emailing [email protected] from the account-of-record email address. A cancellation request received outside Adelaide business hours, on a weekend, or on a South Australian public holiday is treated as received on the next Business Day.

6.3 OneCast may suspend or terminate an account if the Operator materially breaches this Agreement, Fees remain unpaid after the failed-payment grace period, OneCast is required by law to do so, or suspension is reasonably required to protect other users, the Platform, OneCast infrastructure or any person. Where the breach is capable of remedy, OneCast will give written notice and a reasonable opportunity to remedy before terminating, except where immediate action is reasonably required.

6.4 When a Subscription ends because the Operator cancels or payment lapses, and the Operator has not separately requested permanent deletion, the account becomes inactive and the Operator no longer has ordinary administrative access. OneCast will retain Content for up to 12 months after the end of the paid period so the Operator can export the data or resume the account. During that period End Client portals may remain read-only for a reasonable transition period unless disabled or deletion is requested.

6.5 Before scheduled deletion after subscription lapse, OneCast will use reasonable efforts to give the Operator notice and a final export opportunity. After the retention period, OneCast will delete or de-identify Content from active systems unless retention is required for tax, legal, fraud-prevention, security, dispute-resolution, regulatory or Legal Hold reasons.

6.6 The Operator may request permanent deletion of its account using the Platform deletion function, where available. A deletion request starts a 7-day grace period during which sign-in is disabled and End Client portals become read-only, but the account remains recoverable by emailing [email protected]. At the end of the 7th day, OneCast permanently deletes the studio row and linked Content from active systems via cascading deletion. After hard deletion no further restore is possible.

6.7 Backup copies of deleted Content expire on the ordinary rolling backup cycle. Unless a longer period is required for Legal Hold, security investigation or disaster recovery, deleted Content must age out of backups no later than 35 days after deletion from active systems.

6.8 Clauses that by their nature are intended to survive termination continue after this Agreement ends, including clauses dealing with payment of accrued Fees, privacy and data processing for retained data, confidentiality, Intellectual Property Rights, liability, indemnities, dispute resolution, governing law and general provisions.

The Operator must not, and must not permit any Team Member or End Client to, use the Platform to:

• 7.1 breach any applicable Australian or other law;
• 7.2 upload, store, transmit or generate any virus, malware or other malicious or harmful code;
• 7.3 infringe copyright, trade mark, privacy, Moral Rights or other rights of any person;
• 7.4 harass, threaten, defame, abuse, impersonate or mislead any person;
• 7.5 attempt to gain unauthorised access to the Platform, another account, or any connected system or network;
• 7.6 resell, sub-license, rent or lease access to the Platform itself, except by giving Team Members and End Clients access as contemplated by this Agreement;
• 7.7 copy, decompile, reverse engineer or attempt to derive the source code of the Platform, except to the extent this restriction is prohibited by law;
• 7.8 circumvent, disable or interfere with rate limits, security features or usage restrictions;
• 7.9 place an unreasonable or disproportionate load on the Platform or OneCast infrastructure;
• 7.10 use transactional email templates to send marketing, promotional, advertising or solicitation content; or
• 7.11 use the Platform for any purpose other than legitimate management of a studio business.

7.12 The Operator must not, and must not permit any Team Member or End Client to, upload to, store on, transmit through, generate using or distribute from the Platform any unlawful, nefarious, sensitive or illegal material, including:

• 7.13 child sexual abuse material, or any sexualised depiction of a person under 18, whether real, simulated, drawn or AI-generated;
• 7.14 non-consensual intimate imagery, including AI-generated or synthetic likenesses of an identifiable person;
• 7.15 pornographic, sexually explicit or adult entertainment material, whether or not consensual;
• 7.16 material depicting real-world violence, serious injury, death, torture, terrorism or other gravely harmful conduct, except where lawfully held by a journalist, investigator or other professional with a clear and documented lawful purpose;
• 7.17 material used to facilitate fraud, extortion, identity theft, cyber abuse, harassment, exploitation, intimidation or other unlawful conduct;
• 7.18 material containing unlawfully obtained Personal Information, confidential information, credentials, identification documents or payment details;
• 7.19 material that infringes Intellectual Property Rights or Moral Rights of a third party; and
• 7.20 material that OneCast reasonably considers creates a serious risk to any person, OneCast infrastructure, other Operators or End Clients.

7.21 If OneCast discovers or reasonably suspects prohibited material or misuse, OneCast may immediately suspend access to the relevant account, portal, file, link or feature, remove or disable access to the material, preserve evidence, notify affected persons where appropriate, and report the matter to police, eSafety, a regulator, a Payment System, hosting provider or other authority where OneCast reasonably considers reporting necessary or legally required.

8.1 The Operator is entirely responsible for Content, including the content of projects, briefs, images, video, audio, invoices, quotes, client communications and material shared with End Clients.

8.2 The Operator must ensure that it has all rights, licences, consents, releases, notices and lawful bases required to upload, store, process, display, deliver and otherwise use Content on the Platform.

8.3 The Operator must ensure that Content does not contain viruses or other code that may disrupt or corrupt the data or systems of any person and does not breach any law or regulation.

8.4 The Operator indemnifies OneCast against reasonable defence costs and amounts paid in settlement or finally awarded by a court in respect of a third-party claim brought against OneCast to the extent the claim arises from the Operator’s Content, the Operator’s breach of this Agreement, the Operator’s relationship with an End Client, or any allegation that Content infringes rights or breaches law, subject to the exclusions and caps in this Agreement.

9.1 In respect of Controller Data that the Operator places on the Platform to run its studio business, the Operator gives the primary instructions and OneCast processes that data on the Operator’s behalf. That controller/processor language is used for contractual allocation and GDPR-style analysis where relevant. It does not limit any direct obligation OneCast has under Australian privacy law.

9.2 OneCast is independently responsible for Personal Information it collects or uses for its own purposes, including account administration, billing metadata, authentication, security logs, portal access records, support communications, analytics choices, fraud prevention, abuse investigations, legal compliance and service improvement using de-identified or aggregated data.

9.3 OneCast will process Controller Data for the purpose of providing and operating the Platform in accordance with this Agreement and the Operator Instructions. OneCast will not sell Controller Data, use Controller Data for third-party advertising, or use Controller Data to train a general AI model unless the Operator has expressly agreed and the relevant provider and data flow have been disclosed.

9.4 The Operator warrants that the Operator Instructions, and the processing of Controller Data they direct, comply with Applicable Privacy Law and that the Operator has all lawful bases, notices, consents and authorities required to enable OneCast to carry out the processing described in this Agreement.

9.5 If OneCast forms the reasonable view that an Operator Instruction would cause OneCast to breach Applicable Privacy Law, OneCast may decline to act on that instruction and will inform the Operator of the position.

9.6 Controller Data typically includes End Client names, contact details, project notes, briefs, communications, images, video, audio, booking information, portal access logs and activity records. The relevant Data Subjects typically include End Clients, their representatives, talent, models, employees, customers, audience members, members of the public depicted in Content, and Team Members whose information is incidentally recorded.

9.7 The Platform is not designed as a primary repository for sensitive information or special-category data. Sensitive information may nevertheless be incidentally captured in ordinary production work. The Operator must not intentionally use the Platform as a structured store for sensitive information unless OneCast has expressly agreed in writing and appropriate controls are in place.

9.8 The Operator is responsible for giving End Clients and other relevant individuals appropriate privacy notices and collection notices, and for maintaining its own privacy policy or collection statement where required by Applicable Privacy Law.

9.9 If OneCast receives a Data Subject request in respect of Controller Data, OneCast will, where the requestor is identifiable as relating to the Operator’s account, refer the request to the Operator. The Operator is responsible for responding to the requestor unless OneCast is required by law to respond in its own right.

9.10 OneCast provides self-service tooling that the Operator can use to view, edit, delete and export records. Taking into account the nature of processing and the information available to OneCast, OneCast will provide reasonable assistance on request where the self-service tooling is insufficient. OneCast may charge a reasonable cost-recovery fee for assistance that goes materially beyond ordinary support.

9.11 OneCast may generate and use aggregated, anonymised or de-identified information derived from operation of the Platform for the purpose of operating, securing, improving and reporting on the Platform. Such information ceases to be Controller Data once it has been irreversibly de-identified.

9.12 The privacy notice details in clause 25 describe how OneCast collects, uses, discloses, stores and protects Personal Information for its own purposes.

10.1 OneCast will take reasonable steps to protect Content, Controller Data and Personal Information from misuse, interference, loss, unauthorised access, modification and disclosure, having regard to the nature and volume of data on the Platform and the state of the art.

10.2 The current Security Measures include encryption in transit, infrastructure encryption at rest, database row-level security, role-based access controls, authentication controls including two-factor authentication where enabled, secure cookies, administrative access restrictions, backup and disaster-recovery controls, vulnerability reporting and incident-response procedures, as further described in clause 24.

10.3 No system or method of transmission or storage is completely secure. OneCast does not warrant that the Platform is impervious to attack. The Operator must also take reasonable steps to protect its account and promptly report suspected security issues to [email protected].

10.4 Where OneCast becomes aware of a Security Incident affecting the Operator, OneCast will notify the Operator without undue delay and, where practicable, within 72 hours after confirming that the Security Incident affects the Operator. Notice may be given by email to the account address or by in-app notice.

10.5 The notice will, to the extent known and lawfully disclosable, describe the nature of the Security Incident, the categories of data and approximate number of Data Subjects and records concerned, likely consequences, measures taken or proposed to address the incident and mitigate possible adverse effects, and a point of contact. OneCast may provide this information in stages as its investigation progresses.

10.6 If OneCast assesses a Security Incident as an eligible data breach under Part IIIC of the Privacy Act 1988 (Cth), OneCast will make any notifications it is required to make in its own right and will provide reasonable assistance to enable the Operator to meet the Operator’s own obligations.

11.1 The Operator authorises OneCast to engage the core Subprocessors and other third-party providers listed in clause 26 for the purposes of providing, securing, supporting, billing for and improving the Platform.

11.2 For each core Subprocessor selected by OneCast, OneCast will impose written obligations appropriate to the provider’s role and substantially equivalent to the relevant data-processing obligations in this Agreement where the provider processes Controller Data on OneCast’s behalf, including confidentiality, security, limited-use and breach-assistance obligations.

11.3 Some providers may be optional integrations chosen by the Operator, Payment Systems, Accounting Systems, DNS providers, analytics providers or mixed-role providers. Where a provider acts as an independent controller or under the Operator’s separate account, OneCast will not describe that provider as if it were solely OneCast’s processor.

11.4 OneCast may add or replace a Subprocessor as the Platform evolves. Where a change would materially affect how Content or Personal Information is hosted, processed or transferred overseas, OneCast will give the Operator at least 30 days notice by email or in-app notice before the change takes effect, except where urgent replacement is reasonably required for security, service continuity or legal compliance.

11.5 If the Operator objects on reasonable privacy, security or regulatory grounds to a new Subprocessor, the Operator may give written notice within the notice period. The parties will discuss the objection in good faith. If they cannot agree a resolution, the Operator may cancel its Subscription and export its data before the change applies.

11.6 OneCast remains responsible to the Operator for the performance of each core Subprocessor of obligations relevant to this Agreement, in the same way OneCast is responsible for its own performance, except to the extent the provider acts as an independent controller, optional integration under the Operator’s account, Payment System or Accounting System acting under its own legal obligations.

12.1 Primary database and file storage for Controller Data is in Australia on infrastructure operated by Supabase on Amazon Web Services in the ap-southeast-2 (Sydney) region, except to the extent data is incidentally transmitted in the ordinary course of Platform operation.

12.2 Some Personal Information, metadata, communications or optional integration data may be processed outside Australia by providers listed in clause 26, including providers in the United States and other global processing locations.

12.3 Before disclosing Controller Data to an overseas core Subprocessor, OneCast will take reasonable steps appropriate to the provider’s role for Australian Privacy Principle 8, including due diligence, contractual confidentiality and security obligations, limited-use obligations, breach-assistance obligations and review of the provider’s published data-processing terms.

12.4 This Agreement is prepared primarily for Australian Operators. OneCast will not rely on this clause alone as a completed data-transfer mechanism for the European Union, United Kingdom, United States or any other overseas jurisdiction. If an Operator is established in the European Economic Area, United Kingdom, United States of America or another jurisdiction outside Australia, or OneCast otherwise agrees to support processing that requires jurisdiction-specific data-transfer terms, the parties must enter a separate data-transfer addendum with the required mechanism and annexes completed.

13.1 OneCast aims to keep the Platform available and reliable, with an operational target of 99.0% monthly uptime measured at the public application endpoint, excluding scheduled maintenance, emergency maintenance and matters outside OneCast’s reasonable control.

13.2 OneCast may perform planned maintenance from time to time and will schedule and announce it in advance where reasonably practicable. OneCast may perform emergency maintenance without notice where reasonably required to protect security, integrity or service continuity.

13.3 Where, in any calendar month, measured availability of the Platform falls below the target, the Operator may claim a service credit against Subscription Fees for that month if the Operator notifies OneCast within 30 days after the relevant month and provides reasonable details of the outage. This does not limit non-excludable ACL rights.

13.4 Subject to non-excludable rights, OneCast is not liable for unavailability or degradation caused by a Force Majeure Event, internet or telecommunications outages, use contrary to this Agreement, or a third-party provider failure outside OneCast’s reasonable control. A core Subprocessor failure is outside OneCast’s reasonable control only to the extent not caused or materially contributed to by OneCast’s failure to use reasonable care in selecting, contracting with, configuring or managing that Subprocessor.

14.1 The Platform may offer optional integrations with third-party services, including authentication, calendar, Payment System and Accounting System integrations. If the Operator chooses to connect an integration, the Operator’s use of that third-party service is governed by that third party’s own terms and privacy policy, and the Operator is responsible for reviewing and complying with them.

14.2 For optional integrations chosen by the Operator, OneCast is not responsible for that provider’s availability, accuracy, performance, security, changes, withdrawal or terms, except to the extent OneCast’s own act or omission caused the issue.

14.3 OneCast may make features available that are labelled beta, preview, early access or similar. Beta features are provided on an “as is” basis for evaluation, may be incomplete or unstable, and may be changed or removed at any time. The Operator must not rely on a beta feature for any business-critical purpose.

14.4 OneCast must not send Controller Data, prompts, uploaded material or outputs containing Personal Information to a third-party AI model provider unless that provider is identified in clause 26 or an updated Subprocessor notice, the relevant data categories, processing location, retention period and training-use position are disclosed, and appropriate contractual controls are in place. As at the date of this Agreement, the only disclosed third-party AI model provider connection is a back-end OpenAI API connection used for video transcription: audio or extracted audio may be sent for transcription and the transcript is returned to the relevant user. Other AI-labelled elements are handled within the Platform software and do not involve sending Controller Data to a third-party AI model provider unless later disclosed in accordance with this clause.

15.1 Nothing in this Agreement transfers any Intellectual Property Rights.

15.2 The Platform, including its software, source code, design, user interface, branding, the “OneCast Studio” name and logos, documentation (including legal documentation) and website materials, is owned by OneCast or its licensors and is protected by Australian and international intellectual-property laws.

15.3 Subject to payment of Fees and compliance with this Agreement, OneCast grants the Operator a non-exclusive, non-transferable, revocable right to access and use the Platform during the Subscription for the Operator’s internal studio business purposes.

15.4 The Operator retains ownership of Content. The Operator grants OneCast a non-exclusive, worldwide, royalty-free licence to host, store, copy, transmit, display, process, back up, secure and otherwise use Content to provide, support, secure and improve the Platform, comply with law and exercise OneCast’s rights under this Agreement.

15.5 If the Operator gives OneCast feedback, suggestions or ideas about the Platform, the Operator grants OneCast a perpetual, irrevocable, worldwide, non-exclusive, royalty-free licence to use that feedback to operate and improve the Platform without any obligation to the Operator.

15.6 The Operator may factually state that it uses the Platform, provided it does so accurately. The Operator must not use OneCast’s name, logos or branding in a way that suggests OneCast endorses, is responsible for, or is a party to the Operator’s services, or otherwise misrepresents the relationship between the parties.

16.1 Each party must keep the other party’s Confidential Information confidential and must not use or disclose it except as required to perform or enforce this Agreement, with the other party’s consent, to professional advisers bound by confidentiality, as required by law or permitted under clause 16.4.

16.2 A party receiving Confidential Information must protect it using at least reasonable care and no less than the care it uses to protect its own confidential information of a similar nature.

16.3 OneCast personnel and contractors who access Controller Data or Confidential Information must be subject to written confidentiality obligations and access information only on a need-to-know basis.

16.4 The confidentiality obligations in this clause do not prevent a party from disclosing Confidential Information where disclosure is required by law, by a regulator, government agency or law enforcement authority, or under a mandatory statutory request, court order, subpoena, warrant or similar compulsory process, including in connection with criminal, terrorism-related or other illegal activities. To the extent lawful and reasonably practicable, the disclosing party must give the other party prompt notice of the requirement and disclose only the information required.

17.1 Nothing in this Agreement excludes, restricts or modifies any consumer guarantee, right or remedy that applies under the ACL or any other law and that cannot lawfully be excluded, restricted or modified.

17.2 Subject to the ACL preservation clause and the carve-outs below, neither party is liable to the other for indirect, incidental, special or consequential loss, or loss of profit, revenue, business, goodwill or anticipated savings, arising out of or in connection with this Agreement or the Platform. Loss or corruption of data is not treated as automatically indirect or consequential.

17.3 Subject to the ACL preservation clause and the carve-outs below, OneCast’s total aggregate liability to the Operator in connection with this Agreement and the Platform is limited, for all claims in aggregate, to the greater of the total Fees paid by the Operator to OneCast in the 12-month period immediately before the event giving rise to liability, and $10,000. For claims arising from OneCast’s breach of confidentiality, privacy, data-processing or data-security obligations, the cap is the greater of the Fees paid in the 24-month period immediately before the event giving rise to liability, and $50,000.

17.4 The exclusion of indirect loss and liability caps do not apply to liability that cannot be limited under Australian law, or to liability arising from a party’s fraud, gross negligence or wilful misconduct.

17.5 To the extent permitted by law, where a consumer guarantee under the ACL applies to the Platform and the guarantee is not of a kind that cannot be limited under section 64A of the ACL, OneCast’s liability for breach of that guarantee is limited, at OneCast’s election, to supplying the relevant services again or paying the cost of having them supplied again.

18.1 Subject to the limitations and exclusions in this Agreement, the Operator indemnifies OneCast and its directors, employees and contractors against reasonable defence costs, reasonable legal costs and amounts paid in settlement or finally awarded by a court of competent jurisdiction in respect of a third-party claim brought against OneCast to the extent the claim arises from or relates to the Operator’s Content, the Operator’s breach of this Agreement, the Operator’s relationship with an End Client, or the Operator’s breach of law.

18.2 The Operator’s indemnity does not apply to loss, damage, liability or cost to the extent caused or contributed to by OneCast’s gross negligence, wilful misconduct, fraud, material breach of this Agreement or breach of applicable law.

18.3 OneCast indemnifies the Operator against reasonable defence costs and amounts paid in settlement or finally awarded against the Operator in respect of a third-party claim alleging that the OneCast-supplied software code of the Platform itself, as supplied by OneCast and used by the Operator in accordance with this Agreement, infringes copyright, patent, trade mark or registered design enforceable in Australia.

18.4 The Platform IP indemnity does not apply to claims arising from Content, third-party integrations, Operator modifications, use contrary to this Agreement, continued use after OneCast provides a non-infringing alternative, or combination with items not supplied by OneCast.

19.1 Neither party is liable for any failure or delay in performing its obligations, other than an obligation to pay money already due, to the extent the failure or delay is caused by a Force Majeure Event.

19.2 The affected party must use reasonable efforts to mitigate the impact of the Force Majeure Event and resume performance as soon as practicable.

20.1 If a dispute arises in connection with this Agreement or the Platform, the parties will first try in good faith to resolve it by discussion. If it is not resolved within 21 days of one party notifying the other in writing, either party may refer the dispute to mediation before commencing court proceedings, except for urgent injunctive or interlocutory relief.

20.2 This Agreement is governed by and construed in accordance with the laws of South Australia. Each party irrevocably submits to the non-exclusive jurisdiction of the courts of South Australia and the courts competent to hear appeals from those courts.

21.1 OneCast may update this Agreement from time to time. For changes that materially affect the Operator’s rights or obligations, including material changes to data-processing arrangements, Subprocessors, liability allocation or paid functionality, OneCast will give at least 30 days notice by email to the account-of-record or by in-app notice before the change takes effect.

21.2 Continued use of the Platform after the notice period ends constitutes acceptance of the updated Agreement. If the Operator does not accept a material change, the Operator may cancel before the change takes effect and may request a fair pro-rata refund or credit for the unused part of the then-current billing period where the change materially reduces the service already paid for.

21.3 Minor changes that are cosmetic, clarifying, required to reflect a change in law, or that do not materially affect the Operator’s rights or obligations, take effect when published.

22.1 This Agreement, any Order, the Pricing Page to the extent it specifies plan details and Fees, and any schedules to this Agreement constitute the entire agreement between the parties in relation to the Platform and supersede all prior representations, statements, proposals, negotiations, discussions and understandings in relation to the same subject matter.

22.2 If any provision is held to be invalid, illegal or unenforceable, that provision is read down to the extent necessary to make it valid or, if it cannot be read down, is severed, and the remaining provisions continue in full force and effect.

22.3 A failure or delay by either party to exercise a right under this Agreement is not a waiver of that right.

22.4 The Operator may not assign, transfer or otherwise deal with its rights or obligations under this Agreement without OneCast’s prior written consent, which must not be unreasonably withheld. Either party may assign or transfer its rights and obligations in connection with a merger, acquisition, corporate reorganisation or sale of substantially all of the relevant business or assets, provided the assignee agrees to be bound by this Agreement and the assignment does not materially prejudice the other party.

22.5 Notices to OneCast must be given by email to [email protected]. Notices to the Operator may be given by email to the account-of-record email address or by in-app notice. It is the Operator’s responsibility to keep its account email address current.

Subject matter and duration

23.1 OneCast processes Controller Data on the Operator’s behalf for the purpose of providing and operating the Platform. The processing begins on the Commencement Date and continues for as long as OneCast holds Controller Data on the Operator’s behalf, including any return, deletion, backup-retention or Legal Hold period.

Nature and purpose of processing

23.2 Processing includes collection and storage of Content, retrieval and display of Content to authorised users, transmission of Content between Platform features, sending transactional communications, generating usage records, running backups, securing the Platform, support, deletion and export.

Categories of data

23.3 Categories of data include:

• 23.3.1 names, business names, email addresses, phone numbers and addresses of End Clients and other individuals;
• 23.3.2 project briefs, notes, quotes, contracts, invoices and communications;
• 23.3.3 photographs, video, audio and other audio-visual material;
• 23.3.4 booking, scheduling and calendar information;
• 23.3.5 portal access logs, activity records and authentication metadata;
• 23.3.6 billing metadata, support communications, analytics choices, fraud-prevention records and security logs.

Data Subject categories

23.4 Categories of data include:

• 23.4.1 End Clients and their authorised representatives;
• 23.4.2 talent, models, employees, customers, audience members and members of the public depicted in or named in Content;
• 23.4.3 the Operator’s Team Members;
• 23.4.4 users who access OneCast websites, portals or support channels.

Return and deletion

23.4.5 The Operator can export its studio data set during the Subscription and during any retention period following cancellation or lapse. OneCast will delete or de-identify Controller Data as described in clauses 6 and 9, subject to backups, Legal Hold, tax, legal, fraud-prevention, security, dispute-resolution and regulatory retention.

Hosting and data residency

24.1 The Platform’s primary database, file storage and authentication infrastructure is operated by Supabase on Amazon Web Services in the ap-southeast-2 (Sydney) region. Primary studio data, project records and uploads are stored within Australia. Other operational metadata and service data may be processed overseas by the providers listed in clause 26.

Encryption

24.2 All traffic between Operator browsers, End Client browsers and the Platform is served over HTTPS, with TLS 1.2 or higher. HTTP Strict Transport Security is set so compliant browsers refuse to fall back to plaintext. Encryption at rest for the database, file storage and backups is provided by the underlying infrastructure.

Multi-tenant isolation

24.3 The Platform is multi-tenant. Tenant isolation is enforced by PostgreSQL row-level security at the database layer. Tables containing Operator data, End Client records, project content and integration state have row-level security enabled with a default-deny posture for browser-accessible roles.

Authentication and account access

24.4 Operators and Team Members authenticate using supported credentials, including Google OAuth or email-and-password credentials. The Platform supports two-factor authentication for Operator accounts, allowing users to use supported two-factor authentication methods to help protect account access. Passwords are hashed using scrypt with a random salt. Sessions are carried in secure, HTTP-only cookies. End Client portals use long, unguessable portal tokens and PIN codes where enabled. PIN codes are stored as hashes.

Administrative access

24.5 Production access is restricted to authorised personnel under written confidentiality obligations, on a need-to-know basis, and only as needed to operate, support, secure or improve the Platform. OneCast does not routinely browse production Operator data.

Application security controls

24.6 The Platform applies baseline web-application controls including security headers, webhook-signature verification, server-side authorisation checks, secure cookie settings, PIN-code hashing, and analytics controls that respect the cookie-banner choice where third-party analytics is used.

Backups and disaster recovery

24.7 The Platform’s database is backed up automatically on a rolling basis. Backups are encrypted at rest by the underlying infrastructure and are used for disaster recovery, not ordinary restoration of deleted Operator data. Deleted data must age out of backups within the period stated in clause 6 unless a longer period is required for Legal Hold, security investigation or disaster recovery. The Operator remains responsible for maintaining its own secure backups and copies of Content, including completed and RAW content, and the Platform is not intended to operate as the Operator’s backup or archive system. OneCast is not responsible for loss of Content resulting from the Operator’s deletion of Content or failure to maintain independent backups, except to the extent caused by OneCast’s breach of this Agreement.

Vulnerability reporting

24.8 Security issues should be reported to [email protected] with enough detail to reproduce the issue. OneCast will acknowledge receipt within 5 Business Days and will triage, contain, preserve evidence, assess notification obligations, remediate and conduct post-incident review as appropriate.

Known security limitations

24.9 As at the date of this draft, OneCast does not represent that it has a formal external penetration test, SOC 2, ISO 27001 or comparable certification, or response-layer Content Security Policy. The Platform supports two-factor authentication for Operator accounts, and Operators remain responsible for enabling and maintaining account-level security controls made available to them, including two-factor authentication and any third-party sign-in controls.

25.1 OneCast collects Personal Information when an Operator creates an account, completes onboarding, uses the Platform, invites Team Members or End Clients, connects integrations, uses support channels, visits OneCast websites, pays Fees or otherwise communicates with OneCast.

25.2 Information collected may include name, email address, business name, ABN, phone number, business address, social media handles, billing metadata, studio settings, preferences, configuration, account creation and terms-acceptance records, client information entered by Operators, usage and technical information, log data, IP addresses, browser type, page visits, features used, cookie preferences, support communications and security records.

25.3 OneCast uses Personal Information to provide and operate the Platform, manage accounts, process billing, provide support, secure the Platform, investigate misuse, comply with law, communicate about the service, manage disputes, improve the Platform using de-identified or aggregated data, and perform other activities described in this Agreement.

25.4 OneCast may disclose Personal Information to Subprocessors, Payment Systems, Accounting Systems, optional integrations chosen by the Operator, professional advisers, insurers, regulators, law enforcement, courts, dispute-resolution bodies and other persons where required or permitted by law.

25.5 OneCast stores Personal Information as described in this Agreement. Primary Controller Data is stored in Australia, while some metadata, communications, analytics, billing, authentication or optional integration data may be processed overseas by providers listed in clause 26.

25.6 Individuals may request access to or correction of their Personal Information. Operators are responsible for responding to End Client requests relating to Controller Data held for the Operator, while OneCast responds to requests relating to information OneCast holds for its own purposes.

25.7 Privacy complaints may be sent to [email protected]. OneCast will consider the complaint and respond within a reasonable time. Individuals may also contact the Office of the Australian Information Commissioner where Australian privacy law gives them that right.

26.1 This clause lists the current third-party providers used to host, process or transmit studio data, Personal Information, metadata or operational service data. It may be updated in accordance with clause 12.

Supabase

26.2 Supabase, Inc. operating on AWS infrastructure. Region: Australia (AWS ap-southeast-2, Sydney). Purpose: primary database, file storage, authentication and content delivery for the Platform.

Vercel

26.3 Vercel Inc. Region: United States with edge delivery worldwide. Purpose: application hosting, edge delivery and cookieless first-party web-performance telemetry.

Payment System

26.4 Current payment provider: Stripe Payments Australia Pty Ltd. Region: United States primary processing and Australia for the Australian entity. Purpose: Subscription billing and payment processing. Card numbers are handled by the Payment System and not stored by OneCast.

Resend

26.5 Resend, Inc. Region: United States. Purpose: transactional email, including portal welcome emails, booking confirmations, billing notifications and account communications.

Accounting System

26.6 Current accounting provider: Xero Limited. Region: Australia/New Zealand with global processing infrastructure. Purpose: optional accounting synchronisation and OneCast’s own accounting records.

Google

26.7 Google LLC. Region: United States and global. Purpose: optional Google OAuth sign-in and Google Calendar API synchronisation where enabled by the Operator.

Cloudflare

26.8 Cloudflare, Inc. Region: United States and global edge network. Purpose: authoritative DNS for onecast.studio. Cloudflare is listed for transparency as a DNS and global network provider and is not currently engaged as an application-layer proxy for Platform Content.

PostHog

26.9 PostHog Inc. Region: United States. Purpose: opt-in product analytics loaded only after a Studio user accepts analytics; must not receive uploaded Content or sensitive End Client information unless the privacy and data-processing terms are updated first.

AI model provider

26.10 Current AI model provider: OpenAI API. Region: overseas processing locations disclosed by OpenAI from time to time. Purpose: back-end video transcription only. Data processed: audio files or extracted audio sent for transcription, and transcript text returned to the user. Training-use position: OneCast does not use Controller Data to train a general AI model, and the OpenAI API connection must be configured and used consistently with that position. No other AI model provider connection is currently identified.

Executed as an agreement.

Signed for ONECAST STUDIO PTY LTD:

• Name: —
• Title: —
• Date: —

Signed by or for the Operator:

• Name: —
• Title: —
• Date: —