Privacy Policy

Version: 2026-10-06 Last reviewed: 6 October 2026

Pevan & Sarah Pty. Ltd. (ABN 93 666 885 436) operates pevanandsarah.com. In this policy, "we", "us" and "our" mean Pevan & Sarah. This policy explains how we collect, use, store and share personal information when you use our website and services (the "Services"). Personal information is information about an identified or identifiable person.

Our Terms of Service separately govern your use of the Services.

Our Approach to Privacy

Pevan & Sarah provides educational videos and resources for classrooms and families. Accounts are for adult educators, school administrators, parents and guardians. Users do not upload or create content on the Services.

We use the Australian Privacy Principles as our privacy benchmark and follow the Privacy Act 1988 (Cth), including the Notifiable Data Breaches scheme, where applicable or required by a school agreement. Our Director is our Privacy Officer and the contact for privacy enquiries and complaints.

Information We Collect

Account and billing information

We collect information you provide when you register or manage an account, including your name, email address, sign-in details, educational role and the year levels you teach or support. Depending on the account type, we also collect a phone number, school or organisation name and address, billing contact details and school invoicing information, such as an ABN or purchase order number. Some details are optional for individual accounts and required for school accounts.

We keep records of your subscription, account users, communication preferences and signup acknowledgements. We may also receive account details from your school's account administrator and payment or subscription information from Stripe. Stripe processes subscription card payments; we do not store full payment card details.

If you do not provide required information, we may be unable to create an account, process a payment or provide some of the Services.

Information about use of the Services

We collect technical and usage information, including IP addresses, browser and device details, pages visited, videos watched, downloads, sign-in activity and approximate location. Some information is linked to your account and is used to provide features, understand use of the Services and protect account security. Cookies and similar technologies support sign-in, analytics and marketing measurement, as explained below.

Enquiries and communications

We collect the information you provide when you contact us, submit feedback or subscribe to a newsletter. We use it to respond to you and manage your communication preferences.

Children

Children can view our content with adults without creating individual student accounts. We do not request student names, student email addresses or individual student profiles, or knowingly request personal information directly from children. Technical and usage information may still be collected from the device used to view the Services.

Please do not include student personal information in support requests. If you believe a child has submitted personal information to us, contact our Privacy Officer so we can investigate and arrange removal where appropriate.

Merchandise and other purchases

Our website links to external merchandise stores, including Bright Star Kids and our apparel store, and to ticketing or other services. Those providers collect the information needed to fulfil purchases under their own privacy policies. If you contact us about a purchase, we use the information you provide to respond and, where necessary, help resolve the enquiry with the relevant provider.

Cookies, Analytics and Marketing

We use cookies and similar technologies to support website features and understand how the Services are used. Google Analytics collects information such as page visits, device and browser details and approximate location.

We use the Meta (Facebook) Pixel for marketing measurement. It sends website visit information and technical identifiers to Meta, which may link that information to your use of its services and use it for advertising and measurement under its own privacy policy. Flodesk provides newsletter signup forms and measures email engagement, such as opens and clicks.

You can manage cookies through your browser and use the privacy controls offered by Google and Meta. Blocking cookies may affect website features. See our Cookie Notification, Google privacy information and Meta privacy information.

We send newsletter marketing to people who have opted in. You can unsubscribe using the link in a marketing email or by contacting us at info@pevanandsarah.com. Unsubscribing does not stop essential account, billing or security communications, or reminders relating to a signup you started. We do not send marketing messages to children.

How We Use Your Information

We use personal information to:

• Create and manage accounts, subscriptions and payments.
• Provide educational content, account features and customer support.
• Send service communications and marketing you have opted in to receive.
• Understand and improve the Services and personalise your experience.
• Use aggregated subscribing-school location information to plan where to tour our live shows.
• Protect accounts, investigate fraud or misuse, and enforce our terms.
• Meet legal obligations and respond to lawful requests.

We ask for consent where required. You can withdraw consent by contacting us; this does not affect the lawfulness of earlier processing. Where the EU General Data Protection Regulation (GDPR) applies, we act as a data controller for account information and rely on consent, performance of a contract, legal obligations or legitimate interests, as appropriate. Our legitimate interests include providing and improving the Services, responding to enquiries and protecting the service and its users.

Information Shared with Third-Party Service Providers

We use service providers to operate the Services. They handle personal information relevant to their role, as summarised below. Some also handle information under their own privacy terms.

ProviderServicePersonal information handledFly.io and VercelHosting and operating the websiteAccount information and technical information needed to provide and protect the ServicesAmazon Web ServicesFile delivery and backupsTechnical request information and backup copies of account and activity informationStripePayments and subscription billingContact, billing and payment informationMuxVideo delivery and viewing analyticsTechnical information, viewing activity and account identifiersPostmarkService emailsRecipient details, email content and delivery informationFlodeskNewsletters, signup reminders and subscription-related emailsContact details, relevant subscription information and email engagementSentryIdentifying and resolving website errorsError reports, technical information and relevant account identifiersGoogle AnalyticsWebsite analyticsWebsite activity, technical identifiers and approximate locationGoogle reCAPTCHABot and abuse protectionDevice, connection and interaction informationGoogle PlacesAddress lookupAddress search text and technical request informationMeta (Facebook)Marketing measurementWebsite visit information and technical identifiersCloudflareWebsite securityConnection, request and security-event information

Our Service Provider Disclosure gives provider website/contact details, processing locations and applicable processing bases. For more about overseas handling, see "Overseas Processing" below.

Other Disclosures and External Websites

We may disclose information where required by law or a court order, or with your consent. If the business is reorganised, merged or sold, personal information may be transferred as part of that change and remains subject to applicable privacy protections.

Our website links to external stores, ticketing services and social networks. Their privacy policies apply when you use those services.

Security

We store personal information electronically with our hosting providers and use reasonable technical and organisational safeguards to protect it from loss, misuse and unauthorised access. Protected account features require authentication.

Nonetheless, it is common knowledge that transmission of information via the internet is not wholly secure, and we cannot guarantee the security of your personal information transmitted to or through any of our Services. Any transmission of personal information is at your own risk. By using our Services, you acknowledge and accept these risks. As a result, we cannot guarantee or warrant the security of any information you disclose or transmit to us or that are otherwise provided to us and we cannot be responsible for the theft, destruction, or inadvertent disclosure of information. It is your responsibility to safeguard any passwords, ID numbers, or other special access features associated with your use of the Services. Any transmission of information is at your own risk. By using our Services, you acknowledge and accept these risks.

You are responsible for maintaining the confidentiality of your user name and password, as well as the credentials of any other users operating under your Account. If you become aware of or suspect any unauthorized use of an Account or loss of your or your users' Account credentials or suspect any other security incident related to Pevan & Sarah, notify us immediately at admin@pevanandsarah.com.

Retention and Account Deletion

We retain personal information while it is needed to provide the Services, manage your account or meet legal obligations.

An account is considered dormant if it has no active subscription and none of its linked users has signed in for 12 consecutive months. We review dormant accounts quarterly and give at least 30 days' notice before deleting them. Signing in or resubscribing prevents deletion. We send written confirmation when an account is deleted.

You can request deletion by emailing info@pevanandsarah.com. After verifying that the request is authorised, we act on it within 30 days, remove associated personal information from active records and relevant service providers where applicable, and send written confirmation.

Some information may remain after account deletion:

• Security records are kept for 12 months to investigate security events.
• Copies in backups may remain for up to 90 days before they expire.
• Financial and tax records, or information needed for a dispute or other legal obligation, are kept for the required period.

Our deletion confirmation explains any information retained and the relevant retention periods. We may keep aggregated statistics that no longer identify you.

Overseas Processing

We use Australian hosting and storage for our core service. Some providers process personal information overseas, including in the United States. These include payment, video, email, analytics, marketing and error-monitoring services. Cloudflare may also process technical information in the European Union. Providers may use infrastructure, support teams and service providers in other countries.

We take reasonable steps to protect personal information handled by providers, including through applicable agreements and data-protection terms. Where applicable law requires international transfer safeguards, we use the required arrangements. Privacy laws overseas may differ from Australian laws. Contact our Privacy Officer if you have questions.

Access, Correction and Export

You can ask to access or correct personal information we hold about you by contacting our Privacy Officer at info@pevanandsarah.com. You can also request a free copy of your information in a reusable, machine-readable format.

We verify that the request is authorised and action access, correction and export requests at no cost within 30 days, in accordance with applicable requirements. If we cannot provide access or make a correction, we explain why. Account deletion is described above.

Privacy Complaints

If you believe we have mishandled your personal information or breached your privacy, you may make a complaint to our Privacy Officer at info@pevanandsarah.com. Please describe the issue and how you would like it resolved. We will acknowledge your complaint, investigate it, and respond within a reasonable period, in accordance with applicable requirements. If you are not satisfied with our response, you may escalate the matter, including, where applicable, to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

EU Residents: Your Data Rights

Where the GDPR applies, you may also have rights to access and correct personal information, request its deletion or restrict its processing, receive a portable copy, and object to processing. These rights are subject to applicable conditions and exceptions. You can object to direct marketing at any time and withdraw consent where processing relies on it; withdrawal does not affect the lawfulness of earlier processing.

Contact our Privacy Officer to exercise these rights. If we process information on behalf of another organisation, we will help direct your request to that organisation where appropriate. We respect additional rights provided by applicable law.

Changes to This Privacy Policy

We review this policy at least annually and update it when our information-handling practices or applicable requirements change. We notify account holders of material changes through the email address associated with their account or another appropriate notice. We obtain consent where required by applicable law. The revised policy is made available on our website.

Contact Us

If you have any questions, comments, requests, or complaints about our Privacy Policy or the personal information we hold about you, please contact our Privacy Officer:

By email: info@pevanandsarah.com