Privacy policy
This policy explains what personal information Dislab collects, why, where it is kept, who it is shared with, and the choices you have. We have written it to be read, not skimmed past.
1. Who we are
Dislab is a digital signage service run by [Business name] (ABN [ABN]), Victoria, Australia ("Dislab", "we", "us"). It is made up of the web console at app.dislab.app, the Dislab app for Amazon Fire TV devices, the Dislab app for Canva, the Dislab API, and this website at dislab.app.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and, where they apply to you, other privacy laws such as the GDPR.
2. What we collect
When you create and use an account
- Sign-in details: your email address and password. Passwords are stored by our sign-in provider as a one-way hash; we never see them.
- Business details: your business name, time zone, the names of your locations and screens, and anything you choose to add, such as a location's address, opening hours and public holidays.
- Content: photos, videos, signs, menus, playlists, schedules, QR code links, live values and other content you upload or create. Photos and videos often record where they were taken; Dislab removes that location data when it converts each file, from the stored original as well as from the copies your screens play.
- Billing details: your plan, the number of screens billed, and the identifiers Stripe gives your customer record and subscription. Card details go straight to Stripe and never reach us. Stripe may also collect a billing address and tax number (such as an ABN).
- Messages to us: what you send to support and any ideas you submit with "Suggest a widget", together with your email address, business name and plan so we can reply.
From the TVs you pair
- Device details: the device's make and model, operating system and app version, screen capabilities (such as the largest video it can play), whether it opens Dislab at start-up, and free storage.
- Status: when the screen last checked in (about every 5 minutes), download progress, and what it is showing.
- Play log: each item played, when, and for how long, used for your play reports. It is kept only if you turn play reports on.
- Support requests: what you send us through the console, by email or with the website's form, our answers, and what came with a request so we can help: your plan, the page you were on, your browser, and for a screen, its status and a screenshot of what it showed.
- Screenshots: only when you ask for one from the console. On an ordinary Fire TV Stick it shows Dislab's own picture. On an Amazon Signage Stick it captures the whole screen.
- Amazon Signage Stick details: on a Signage Stick, the stick also reports its serial number, model, software versions, uptime, memory, storage, processor use and temperature, Wi-Fi network name, local network address and hardware (MAC) address, and the connected TV's make, model and power state. These are shown to you on the screen's page in the console.
Automatically
- Register interest: if you ask to hear when something new is out (such as the Dislab Player), the email, business name and number of screens you give us. We use them only to tell you about it.
- Network addresses: to stop abuse, we briefly record the internet (IP) address used for some actions, such as a TV registering, pairing attempts and joining a list. These records are deleted after one day.
- Server logs: our hosting providers keep standard request logs (such as IP address, time, and the page or address requested) for operation and security.
- QR code scans: we count scans of your tracked QR codes by day and by screen. We do not record who scanned, their IP address or their device.
We do not use analytics or advertising trackers on the console or this website, and we do not sell personal information.
3. How we use it
- To run the service: store and convert your files, send content to your screens, show your screens' status, and produce your reports.
- To bill you through Stripe, and to apply your plan's limits.
- To send you service emails: sign-in links, password resets, alerts you have switched on (such as a screen going offline), and your morning summary. You can turn alerts and summaries off on the Health page. We do not send marketing email without your permission.
- To keep Dislab secure: limit repeated attempts, check sign-ins with Cloudflare Turnstile, and investigate misuse.
- To answer support requests and improve Dislab, including from suggestions you send us.
- To meet legal obligations, such as tax records.
4. Your customers' information
Some features collect information from the people who see your screens:
- "Join our list": when someone scans one of your join QR codes, they can give their email, mobile number and first name, and must tick a consent box naming your business. We store their details, the exact consent wording they agreed to and when, and which screen they scanned.
- Tracked QR codes: counted only, as above.
For this information, your business decides what to collect and how to use it, and is responsible for doing so lawfully, including any messages you send. We store and process it for you, show it on your Contacts page, let you download or delete it, and never message your contacts ourselves or use their details for anything else.
The same applies to anything personal inside content you upload, such as photos of people.
5. Who we share it with
We share personal information only with the service providers that run Dislab, only as much as each one needs, and under their own privacy and security terms:
| Provider | What for |
|---|---|
| Supabase | Database, sign-in, file storage and server code (Sydney, Australia) |
| Fly.io | Converting uploaded photos and videos (Sydney, Australia) |
| Vercel | Hosting the console and this website |
| Stripe | Payments, invoices and tax. Receives your business name, email and billing details |
| Resend | Sending our emails (sign-in links, alerts, summaries) |
| Cloudflare | Turnstile checks on sign-in, sign-up and password reset |
| Google Fonts | Typefaces for the console and this website. Your browser requests them directly from Google |
| Open-Meteo | Weather. Your browser sends the town you type to find it; our server then asks for weather by map position only, with nothing about you |
| Anthropic | The AI sign writer, only if you use it: your brief and the text on the sign |
| Canva | Only if you connect Dislab in Canva: Canva receives your Dislab business name and plan, and sends us the designs you publish |
| Pixabay | Stock photos and videos, only if you search them: our server sends your search words, with nothing about you. Your browser loads the preview pictures and clips straight from Pixabay |
| Square | Only if you connect Square: we read your Square items, prices, stock, photos, business name and locations to keep your menus up to date. We never change anything in Square or see your payments or customers |
| Amazon | On an Amazon Signage Stick, Dislab works with Amazon's device software to read the stick's health and carry out restarts, TV power and updates you request |
Some widgets reach other sites at your request: news feeds and calendar links are fetched by our server, and a website frame on a sign is loaded by the TV and your browser, so that website sees their IP address and may set its own cookies.
Partner apps you connect (such as Canva) get only the access you approve, and you can disconnect them any time in Settings. We may also disclose information if the law requires it, to protect people or our service, or to a buyer if Dislab's business is sold, under this policy.
6. Where it is stored
Your account data and files are stored in Sydney, Australia. Some providers above are based in, or process data in, other countries, including the United States (for example Stripe, Resend, Vercel, Cloudflare, Google and Anthropic). We choose providers that protect data to a standard comparable to the Australian Privacy Principles.
7. How long we keep it
| Information | Kept for |
|---|---|
| Account, locations, screens, content | While your account is open, until you delete them or ask us to delete your account |
| Original uploaded files | 30 days after conversion, then deleted. The converted copies stay until you delete them |
| Failed and unfinished uploads | Up to 7 days |
| Play logs (when play reports are on) | Single plays about 3 months; daily totals 13 months |
| Support requests and our replies | 2 years after the request is closed |
| Screenshots | The last 3 for each screen |
| IP addresses for abuse limits | 1 day |
| Register interest (such as the Dislab Player) | Until we’ve told you it’s out, or sooner if you ask us to remove it |
| TVs that were never paired | Deleted after 7 days without checking in |
| Remote commands to a screen (restart, TV power, updates) | 90 days |
| Screen alerts and monthly usage counts | 13 months |
| Partner app connections (such as Canva) | Until you disconnect, then 30 days |
| Your Square connection (Square's access to your items) | Until you disconnect Square or delete your account; Square is told to end Dislab's access when you disconnect |
| Copies of news feeds, calendars and weather fetched for your signs | 7 days after they were last used |
| Contacts from "join our list" | Until you delete them or your account |
| Billing and tax records | As long as the law requires (in Australia, generally 5 years) |
8. Cookies and browser storage
Dislab does not set advertising or tracking cookies. When you sign in to the console, your browser keeps your sign-in session in local storage so you stay signed in; signing out removes it. Cloudflare Turnstile and Google Fonts may set or read their own cookies when they load. This website uses no cookies of its own.
9. Security
Data travels encrypted (HTTPS). Files are kept in private storage that only your account can reach. Secrets such as API keys, TV tokens and partner app tokens are stored only as one-way hashes. The access Square gives us to your items is stored encrypted, with a key kept apart from the database. Each TV checks a signed licence from our server. Sign-ins are protected by Cloudflare Turnstile and rate limits. No system is perfectly secure; if a breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner as the law requires.
10. Your choices and rights
- Access and correction: most of your information can be seen and changed in the console. For anything else, email us.
- Deletion: you can delete content, screens and contacts in the console at any time. To delete your whole account, use Settings, Delete account. It takes effect at once: your data is deleted, its files are removed from storage within a day, any subscription is cancelled, your sign-in is removed, and we email you to confirm. Stripe keeps the invoices it issued, as tax law requires. You can also ask us by email.
- Export: download any photo or video from Media (the file you uploaded while we keep it, then the copy your screens play), and play reports and contacts as spreadsheets. Ask us for anything else.
- Emails: turn alerts and summaries off on the Health page. Sign-in and billing emails are part of the service.
- Connected apps: disconnect any partner app in Settings, Connected apps, and Square in Settings, Square.
If you are in the European Economic Area or the United Kingdom, you also have the rights to object to or restrict processing, to data portability, and to complain to your local data protection authority. Where the GDPR applies, we rely on our contract with you to run the service, on our legitimate interests to keep it secure and improve it, on legal obligations for billing records, and on consent where we ask for it.
If you are one of a Dislab customer's contacts, please contact that business first. We will help them respond, and you can also write to us.
11. Children
Dislab is a service for businesses and is not meant for anyone under 18. We do not knowingly collect information from children.
12. Changes to this policy
We may update this policy as Dislab changes. We will change the date at the top, and for significant changes we will tell account owners by email or in the console before they take effect.
13. Contact and complaints
For privacy questions, requests or complaints, email support@dislab.app. We will reply within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.