Privacy Notice
Creator Likeness and Platform Agreement version 2026-10 — source dated 25 September 2026
Document HK-LEGAL-PRIVACY-20261011-V4.1, published October 11, 2026
Pylon Film Pty Ltd (ABN 14 698 990 215; ACN 698 990 215) operates HyperKnown and is the primary Australian Privacy Act entity for the marketplace. Contact privacy@hyperknown.ai. The legal notice address is Level 2, 111 Harrington Street, The Rocks NSW 2000, Australia.
Your information and choices
This notice explains our information practices. Your signed agreements determine likeness permissions; optional tracking and marketing have separate consent controls. A policy update does not retrospectively authorise a new use of your materials.
Public support assistant
When you use Ask HyperKnown, we store the questions you send and completed responses to keep the conversation available in your current browser session. Browser access expires after 24 hours and unsubmitted chat copies are deleted within seven days. When AI answering is available, we send your question, limited earlier questions and approved public guidance through OpenRouter to the configured answer provider, initially Anthropic. Cloudflare processes public guidance and redacted questions for retrieval. We remove common contact details and secret patterns before external processing, but this cannot detect every kind of personal information. Do not enter identity documents, bank details or passwords. Signed-in visitors receive the same public guidance as guests; the assistant does not look up private account information. If you contact our team, we use your contact details and submitted message to respond by email. Your conversation is included only if you choose to include it, and the selected copy becomes part of your support request. Clearing the chat does not erase a submitted support request; use our existing privacy request process for access or deletion. Chat text is excluded from session replay and general analytics and is not retained as an additional training copy. Support does not require optional analytics or marketing consent.
1. Information We Collect
We collect information you provide directly, including name, email, profile information, consent and licensing records, and identity-verification metadata. Bank-account details are transmitted to our payout provider; HyperKnown stores only the provider identifier, currency, status, and last four digits rather than the full account number. Identity documents are handled by the identity provider rather than stored in HyperKnown's application database. We also collect limited security and service telemetry such as IP address, browser type, pages viewed, and referring URLs. Creator photos, video, and voice recordings are likeness assets and may be sensitive personal information. Where authorised by the Creator Likeness and Platform Agreement version 2026-09, Pylon may create and retain AI Characters and reusable face, body, movement and voice models. These are distinct from identity-verification records. When you separately opt in to link a social or content account, Creator Materials also include the accessible images, video, audio, captions, metadata and profile information described in clause 2. Identity and moderation providers may perform sensitive or biometric processing under the relevant notice and legal basis. We also hold project approvals, electronic signatures, signing and security timestamps, referral attribution, support correspondence, transaction status and the minimum records needed to verify rights and administer payments. If you choose to connect WhatsApp or notification contacts, we process the number or address, consent and delivery records needed for that feature. Do not send identity documents in support messages or upload another person’s materials without authority. If you ask for our company pilot info sheet, we keep your name, work email, company, optional role, the page and campaign you came from, your consent and a one-way hash of your IP address, so we can email you the sheet, follow up about the pilot as you agreed, and prevent abuse. Every pilot email has an unsubscribe link. If we contact you about your work before you have contacted us, Section 13 explains what we collect about you as a business contact and where we got it.
2. How We Use Your Information
We use personal information to operate accounts and profiles, verify adulthood and authority, match and cast Creators for potential projects, prepare authorised private previews, administer approved production and licensing, record electronic agreements, process fees and payouts, prevent fraud and misuse, communicate about the service, respond to privacy requests and meet legal obligations. These activities can occur before a Creator earns or receives a project payout where the signed Creator agreement permits them. Payment is not the legal basis for every data use, and this notice is not a blanket likeness licence. Photos are processed by AI vision services for safety review. When the portrait feature is used, the chosen reference photo is sent to EvoLink’s file and image-generation services to create an AI marketplace portrait using Seedream; the Creator reviews and approves the resulting portrait before marketplace publication. The Creator agreement version 2026-09 permits Pylon to create, train, refine, retain and operate persistent AI Characters and generate image, video, audio, movement and performance Outputs. Authorised Creator Materials and opted-in Linked Account Content may be used to train, evaluate and improve Pylon’s models, systems and tooling. The agreement also includes the royalty-free HyperKnown promotional use in clause 3.1. Project use and separately opted-in Licence Programme use remain subject to the approved scope and clause 7 restrictions. Earlier accepted agreements do not acquire these permissions through this notice. Signing the agreement does not itself connect an account or opt you in to a programme. Any verification-provider biometric processing must have the required notice and legal basis. Automated checks and generated results can be wrong; contact support@hyperknown.ai to request human review of an adverse result.
3. Information Sharing
We disclose only information needed for the relevant function. Brands see permitted profile and portfolio fields and relevant project information; parties and authorised representatives receive the identity, scope, commercial and signature information needed for their agreements. Publicly visible profile information may be copied or indexed by others. We use Cloudflare for hosting, storage and delivery; Stripe and Stripe Identity for payment and identity services; Airwallex for supported international payouts; SignatureAPI for electronic signing; Resend for email; PostHog for consent-gated product analytics and browser error capture; Sentry for server error monitoring; our malware-scanning service for uploaded files; OpenRouter and Anthropic for AI image moderation; Google Workspace (Gmail) for sending and storing business email; treg and the email-finding and email-verification providers it routes to, such as Hunter and Tomba, for finding and checking business contact details; and OpenRouter, and the AI model provider it routes to, for drafting outreach emails. Moderation requests send the image for safety assessment without adding the Creator’s name or contact details. EvoLink (EVO GLOBAL TECHNOLOGIES LIMITED, Hong Kong) and its image-model service process the selected reference image, production prompt and generated portrait for the portrait feature. Google provides optional account sign-in and consent-gated advertising measurement. Meta provides optional WhatsApp messaging and consent-gated advertising measurement; X receives consent-gated advertising measurement. These providers may also process data under their own notices for legally required verification, fraud prevention or service administration. The provider’s role and feature determine the data involved; listing a provider here does not authorise unrelated use. Contact privacy@hyperknown.ai for provider and transfer details. If you join through a referral link, the referrer can see your display or first name and limited milestones: signup, identity verification, consent, onboarding qualification and whether your first project payment has settled, plus their own reward amount and status. They do not receive your email, identity documents, bank details, IP address, device data, verification-provider records, briefs or contracts. We may disclose relevant records for legal compliance, a rights dispute, safety response or a business transfer subject to applicable protections. Commercial licensing of AI Characters and Outputs is governed by the signed Creator agreement and the relevant project or programme permissions. It does not permit resale of raw Creator Materials as standalone assets or licensing raw identity documents to Brands. Optional advertising disclosures and applicable sale/sharing choices are explained in Sections 6 and 9.
4. Data Retention
We retain personal information only while it is needed for the service, security, dispute handling, or a documented legal, tax, accounting, fraud-prevention, or legal-claims obligation. A deletion request begins an audited workflow across application data, object storage, and relevant providers. Data that can be deleted is removed or de-identified; retained records are restricted and recorded with their legal basis and review date. Provider-side identity, biometric and AI-processing data follow the applicable provider terms, contractual controls and law. Expiry of a file-sharing URL does not by itself prove deletion of every provider copy or log. Our retention policy keeps signed agreements and associated transaction and accounting evidence for seven years, subject to a longer specific legal hold or a different period required by law. This does not mean every photo, identity record or marketing identifier is kept for seven years. Encrypted backups are not selectively rewritten: data removed from live systems may persist in access-restricted backups until those backups are replaced under the backup retention schedule. Creator Materials, Linked Account Content and AI Characters follow the retention schedule subject to active licences and Licence Programme uses, accounting and dispute records, backups and legal holds. Retained material is restricted from unrelated use. Account deletion or a linked-account disconnection does not itself terminate an existing licence, erase all lawfully retained material or undo training already performed.
5. Your Rights
Depending on your jurisdiction, you may have the right to access personal information, request correction or deletion, object to or restrict processing, receive portable data, and withdraw consent. An authenticated user can submit and track access, correction, erasure, restriction, or withdrawal requests in account Settings; you can also contact privacy@hyperknown.ai. We verify the requester, record the request, and respond within the period required by the law that applies to that request. Withdrawal stops new uses that rely on consent but may not invalidate a completed lawful transaction or erase records that must be retained. Unpublishing a profile stops future marketplace presentation, subject to technical processing and any active project obligations. We assess an active licence and any statutory privacy withdrawal separately; retained evidence is restricted to its lawful purpose. We may need to verify your identity or authority before fulfilling a request and explain any lawful limitation. If you withhold information necessary for identity checks, contracting or payments, the corresponding feature may be unavailable. Clause 2 permits disconnection of a Linked Account, stopping further collection after a reasonable technical period. Clause 6 permits programme opt-out, stopping new programme licensing after a reasonable technical period while existing licensed, commissioned or in-production commitments and their fees continue. Clause 10 preserves active project and programme commitments after account closure. These contractual provisions do not remove a statutory privacy right. Contact privacy@hyperknown.ai for assistance with a choice or control that is not yet available in your account.
6. Cookies and Tracking
We use essential cookies to operate the platform. Optional cookies and similar technologies — functional preferences, analytics, error capture and session replay (PostHog; replay masks everything you type and never records identity, video or bank steps), and marketing/advertising measurement — run only after you allow them through the consent banner, wherever you are in the world. Separately, our servers keep anonymous counts of sign-up and onboarding steps (for example, "profile completed") with a random identifier and the advertising campaign name only; these counts contain no name, email address, IP address or device identifier and cannot be linked back to you. You can change or withdraw your choice at any time via the banner's Choose what to allow section, and record a sale/sharing opt-out at the "Do Not Sell/Share" link in our footer. Where you allow marketing cookies, we and our advertising partners (Google, Meta, X) process ad-click and conversion identifiers (such as gclid and Meta's fbp/fbc cookies) and, for Google enhanced conversions, a hashed form of your email address; analytics and measurement include your IP address, which is used for approximate geolocation. Essential cookies cannot be disabled as they are necessary for the platform to function. We honor Global Privacy Control and Do Not Track browser signals, which override any stored consent.
7. International Data Transfers
HyperKnown is operated from Australia and uses international infrastructure and providers. Overseas recipients may include providers or support operations in the United States, Hong Kong, Singapore, the United Kingdom and countries in the European Union, depending on the service and its subprocessors. EvoLink identifies its operating entity in Hong Kong; that address is not a guarantee that all model processing occurs there. Provider networks may process data in additional locations. Contact privacy@hyperknown.ai for the locations and safeguards applicable to a particular feature. We take the steps required by applicable law for overseas disclosures, including contractual safeguards and, where required, recognised transfer mechanisms such as Standard Contractual Clauses. A public profile or acceptance of this notice does not waive our obligations for overseas handling. Clauses 3.5 and 15.1 permit the specified international operations, affiliates, transfers and processing, subject to this notice and applicable law; they do not waive privacy or security obligations.
8. GDPR (European Economic Area) and UK GDPR
Where the GDPR applies, we process ordinary personal information to perform the requested contract, comply with legal obligations, pursue legitimate interests such as fraud prevention and service security where those interests are not overridden, or act on consent for optional purposes. Sensitive or special-category data require an additional applicable condition, including explicit consent where required; a general reference to contract performance does not replace it. You may request access, correction, erasure, restriction or portability where applicable, object to relevant processing, withdraw consent prospectively and complain to your supervisory authority. Optional marketing can be declined without declining necessary account services. You have an absolute right to object to direct marketing at any time, and we will stop; Section 13 explains how this works for business contacts we approach.
9. CCPA (California Residents)
California residents have the right to: know what personal information is collected, used, shared, or sold; delete personal information held by businesses; opt out of the sale or sharing of personal information; and non-discrimination for exercising these rights. Creator-authorised commercial AI Character and Output licensing is described in clauses 3, 5 and 6 of the Creator agreement; raw Creator Materials are not for standalone resale and identity documents are not licensed. Applicable privacy rights are assessed separately from contractual likeness permissions. The consent-gated advertising measurement described in Section 6 may constitute "sharing" for cross-context behavioural advertising under the CPRA; you can opt out at any time via the "Do Not Sell/Share" page linked in our footer, and Global Privacy Control signals are honored automatically. For any other request, contact privacy@hyperknown.ai.
10. Updates to This Policy
We may update this Privacy Policy from time to time. We will identify the effective date and provide the notice required by applicable law before a material change. Where a change needs new consent, continued use alone will not substitute for that consent. Changes in version 4.1 (11 October 2026): we added Section 13 on business contacts we approach, named Google Workspace (Gmail), treg and its finding and verification providers, and OpenRouter for drafting outreach emails in Section 3, and covered the UK GDPR and the right to object to direct marketing in Section 8.
11. Contact Us
For access, correction, deletion, withdrawal, provider questions or a privacy complaint, write to privacy@hyperknown.ai or Pylon Film Pty Ltd, Level 2, 111 Harrington Street, The Rocks NSW 2000, Australia. Describe the issue and any relevant account or transaction; do not include unnecessary identity documents. We assess the complaint, investigate, and respond with the outcome and available next steps within the applicable legal period; we aim to respond to Australian privacy complaints within 30 days. If you remain dissatisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or the relevant authority where you live. Legal notices may also be sent to legal@hyperknown.ai.
12. Campaign records and safety reports
We record final campaign asset links, the submitting team member’s confirmation that the asset features the named Creator and follows the signed brief, notices to end at the paid term, campaign and project membership, team invitations, final files and their verification references, scripts, claims, creator decisions, reported advertising placements, planned end dates and removal evidence. These records help participants administer the signed licence, prevent unauthorised use and resolve disputes. Campaign owners can invite staff to view or maintain records; invited staff must accept before receiving access. Creators and their currently authorised representatives can access records within their permissions. Campaign access does not give someone signing or payout authority. Review text may contain personal information: include only what the project needs. A safety report collects your contact email, the affected address, your description and case records. Our authorised operators use this information to assess the concern, investigate, contact the relevant people where necessary and keep evidence of the response. Reports are not published in the campaign register. You can report without an account and use the privacy contact above to request access or correction. We retain or restrict these records according to the purposes and obligations described in Section 4. For a public explanation of access, file and incident safeguards, see hyperknown.ai/legal/security.
13. Business contacts we approach
This section applies when we contact you about your work before you have contacted us, for example as a producer, director, founder or executive at an AI production studio, agency or brand. Pylon Film Pty Ltd (ABN 14 698 990 215), trading as HyperKnown, is the controller of this information; contact privacy@hyperknown.ai or Level 2, 111 Harrington Street, The Rocks NSW 2000, Australia. We collect your name, role, employer, work email address, the public page or provider where we found the address and the date we found it, which country's rules apply to our contact and the legal basis we rely on, the date we first sent you this notice, our emails to you, your replies and any opt-out or objection. We do not collect phone numbers, personal email addresses or sensitive information for this purpose. We get these details from your organisation's website, press and news pages and other pages that you or your organisation published, and from business contact data providers. We reach those providers through treg, a routing service that uses email-finding and email-verification providers such as Hunter and Tomba. Each record notes the provider that found or checked the address, and you can ask us which one it was. We use these details to decide whether our service is relevant to your work, to write and send up to four short emails from a named founder over about two weeks, to stop when you reply, opt out or an email bounces, and to keep records that show we followed the law. A founder approves every first email before it is sent; we do not make decisions about you by automated means that have legal or similarly significant effects. Where the GDPR or UK GDPR applies, our legal basis is our legitimate interest in telling businesses about a service relevant to their work (Article 6(1)(f); UK GDPR Article 6(11)(a) and GDPR Recital 47 recognise direct marketing as a possible legitimate interest). We have assessed that this interest is not overridden by your interests and rights, and you can ask us for that assessment. You have an absolute right to object to direct marketing at any time: reply "stop" to any email, use the unsubscribe link or write to privacy@hyperknown.ai, and we will stop. You also have the rights of access, correction, erasure and restriction described in Section 5. We share these details only with service providers that help us do this work: Google (Google Workspace and Gmail, for sending and storing email), treg and the finding and verification providers it routes to, OpenRouter and the AI model provider it routes to (to help us draft emails from information about your public work), and Cloudflare (for hosting our records). We do not sell or rent these details or share them with other marketers. We handle these details from Australia, and our providers may process them in the United States, the European Union, the United Kingdom and other countries; Section 7 explains how we protect overseas transfers. We keep outreach records for 12 months after our last contact with you and then delete them, unless you become a customer or ask us to stay in touch. If you opt out or object, we keep only your email address (or a one-way hash of it), the date and the reason on a do-not-contact list, with no end date, so that we never contact you again. You can complain to us first, and also to the Office of the Australian Information Commissioner (oaic.gov.au), the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live or work.
For privacy inquiries, email privacy@hyperknown.ai.