Privacy Policy

1. Who we are

VentureTech AI (ABN 54 142 811 470) ("VentureTech AI", "we", "us" or "our") is an Australian AI advisory practice. We help organisations set a direction for change and develop the capability to lead that change internally.

This Privacy Policy explains how we collect, hold, use and disclose personal information, and how you can access and correct that information or make a complaint.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle the personal information of people located outside Australia, we also aim to meet the requirements of applicable overseas privacy laws, including the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), to the extent they apply to us.

2. What this policy covers

This policy applies to personal information collected through:

• our website at venturetech.ai and any subdomains;
• every software application, web app, mobile app, browser extension, AI assistant, agent, chatbot, API, client portal, tool, demo, prototype or other digital product that VentureTech AI develops, publishes, hosts or deploys for public or client use, whether now or in the future (together, the "Apps");
• our advisory and education services (the "Services");
• our social media pages, newsletters and marketing activities; and
• any other dealings you have with us, including by email, phone, video call or in person.

Unless an App has its own privacy notice that expressly replaces this policy, this policy governs that App. Where an App has a supplementary notice, that notice should be read together with this policy, and this policy applies to anything the supplementary notice does not cover.

Where we have built an App on behalf of a client and the client operates it under its own brand, the client is usually the entity responsible for the personal information collected through that App, and its privacy policy will apply. In those cases we act as a service provider (a "processor" under the GDPR) and handle personal information only on the client's instructions.

3. Personal information we collect

The personal information we collect depends on how you interact with us. It may include:

Identity and contact details. Your name, job title, organisation, email address, phone number, postal address and social media handles.

Account information. Usernames, passwords (stored in hashed form only), profile details, preferences, and the organisation or workspace you belong to when you register for an App or client portal.

Business and project information. Information you share with us about your organisation, processes, systems, staff and projects during advisory sessions and education work. This may incidentally include personal information about your employees, contractors, customers or suppliers.

Content you submit to our Apps. Text, prompts, documents, files, images, audio, spreadsheets, data sets and any other content you upload, type, paste or otherwise provide to an App, including inputs to AI features and the outputs generated in response.

Communications. Emails, messages, meeting notes, call recordings and transcripts (where you have been notified that a recording is taking place), support requests and feedback.

Payment and billing information. Billing contact details, invoicing information, purchase history and payment status. Card details are handled by our third-party payment providers and are not stored on our systems.

Technical and usage data. IP address, device type, operating system, browser type and version, unique device or advertising identifiers, app version, crash reports, referring pages, pages and features viewed, time spent, clicks, and interaction logs. This is collected automatically when you use our website or Apps.

Location data. Approximate location derived from your IP address. Precise device location is collected only if an App asks for it and you grant permission through your device settings.

Marketing data. Your subscription preferences and how you engage with our newsletters, campaigns and events.

Sensitive information. We do not seek to collect sensitive information (such as health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record or biometric data). If you or your organisation provide sensitive information to us or upload it to an App, we will handle it only with your consent, or as otherwise permitted by law, and only for the purpose for which it was provided.

If you do not provide the personal information we request, we may not be able to provide you with the App, Service or response you are seeking.

4. How we collect personal information

We collect personal information:

• directly from you, when you fill in a form on our website, register for or use an App, contact us, take part in an advisory session, sign a proposal or agreement, subscribe to our communications, or attend an event;
• automatically, through cookies, software development kits (SDKs), server logs, analytics tools and similar technologies when you use our website or Apps (see section 9);
• from your organisation, where your employer or a client engages us and provides your details as a contact, user or stakeholder;
• from third parties, including our development and hosting partners, payment providers, publicly available sources such as company websites and LinkedIn, referral partners, and social media platforms in line with their privacy settings; and
• through integrations, when you connect an App to a third-party service (for example Microsoft 365, Google Workspace, a CRM or an accounting platform) and authorise that service to share data with us.

Where reasonably practicable, we collect personal information directly from you. If we collect it from someone else, we take reasonable steps to make sure you are aware of this policy.

5. Why we collect, use and disclose personal information

We collect, hold, use and disclose personal information for the following purposes:

• to provide, operate, maintain and support our website, Apps and Services;
• to create and manage your account and authenticate you;
• to provide advisory and education services, and to produce recommendations and other agreed materials;
• to process the content you submit to an App so that the App can generate the output or perform the function you have requested, including through AI models (see section 6);
• to communicate with you about your enquiries, projects, accounts, invoices and support requests;
• to send you service notices, security alerts and updates about changes to our Apps, Services or policies;
• to send you marketing communications, newsletters, invitations and information about products and services we think will interest you, where you have consented or would reasonably expect this, and always with the option to opt out;
• to improve and develop our website, Apps and Services, including through analytics, testing, troubleshooting and research;
• to personalise your experience and remember your preferences;
• to detect, investigate and prevent fraud, abuse, security incidents and unlawful activity;
• to comply with our legal and regulatory obligations, respond to lawful requests, and enforce our agreements; and
• for any other purpose you have consented to or that is required or authorised by law.

Where the GDPR applies, our legal bases for processing are: performance of a contract with you; our legitimate interests (such as running and improving our business, securing our systems and marketing to business contacts), balanced against your rights; compliance with a legal obligation; and your consent, where we ask for it.

6. How we use artificial intelligence

Many of our Apps and Services use AI, including large language models and other machine learning systems. This section explains how personal information is handled in that context.

Third-party AI providers. Our Apps may send content you submit (for example a prompt, a document or a data set) to third-party AI model providers so that a response can be generated. These providers may be located overseas (see section 8). We select providers that offer commercial or enterprise terms under which your inputs and outputs are not used to train their general-purpose models, and we configure our integrations accordingly wherever that option is available. Each App identifies its principal AI providers in its settings, documentation or in-app notice.

Our own use of your content. We do not use the content you submit to an App to train AI models for other customers without your express consent. We may use de-identified and aggregated information, from which you cannot reasonably be identified, to evaluate and improve the performance, safety and accuracy of our Apps.

Retention of AI inputs and outputs. Prompts, uploaded content and generated outputs are retained only as long as needed to provide the App's features (for example to show you your history), to meet our legal obligations, and to investigate misuse. You can delete conversation or file history within an App where that feature is offered, and you can ask us to delete it at any time.

Automated decision-making. Our Apps are designed to assist people, not to replace human judgement. We do not use personal information to make decisions that have legal or similarly significant effects on you solely by automated means without human review. If an App ever includes such a feature, we will tell you clearly, explain the logic involved, and give you the option to request human intervention.

Accuracy of AI outputs. AI-generated outputs can be incomplete or incorrect. You should review outputs before relying on them, particularly where they relate to people.

Content you should not upload. Unless an App is expressly designed and contracted for that purpose, please do not upload sensitive information, government identifiers, payment card numbers or information about children to our Apps.

7. Who we disclose personal information to

We may disclose personal information to:

• service providers who help us host, maintain and support our Apps and Services, under contracts that require them to protect your information;
• service providers and suppliers, including cloud hosting and infrastructure providers, AI model providers, database and storage providers, analytics and error-monitoring providers, email and communication platforms, customer relationship management platforms, payment processors, e-signature providers, scheduling tools and customer support tools;
• your organisation, where you use an App or Service through an account provided by your employer or a client of ours, in which case your organisation's administrators may access information about your use of that App;
• third-party services you choose to connect, such as productivity suites, CRMs and accounting platforms, in line with the permissions you grant;
• professional advisers, including lawyers, accountants, auditors and insurers;
• referral and channel partners, where you have been introduced to us by a partner or we introduce you to one, limited to what is needed to manage the referral;
• a purchaser or successor, if we sell, merge or restructure all or part of our business, provided they agree to handle your information consistently with this policy; and
• government bodies, regulators, courts and law enforcement, where required or authorised by law.

We do not sell personal information, and we do not share it with third parties for their own direct marketing purposes.

8. Overseas disclosure

VentureTech AI is based in Australia, but some of our service providers, including cloud hosting, AI model, analytics and communication providers, store or process information overseas. Countries where recipients are likely to be located include the United States, the United Kingdom, the European Union, Singapore and other locations where major cloud infrastructure operates.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it in a way that is consistent with the Australian Privacy Principles, including through contractual protections and, for transfers subject to the GDPR, standard contractual clauses or an adequacy decision. By using our website, Apps or Services, you acknowledge that your personal information may be transferred and stored overseas as described in this section.

9. Cookies, analytics and similar technologies

Our website and Apps use cookies, local storage, pixels and SDKs to:

• keep you signed in and remember your settings (strictly necessary);
• measure traffic and understand how features are used (analytics);
• diagnose errors and monitor performance; and
• measure the effectiveness of our marketing (where used).

Analytics tools may collect your IP address, device information and usage data and may process it overseas. You can control cookies through your browser settings, and most browsers allow you to block or delete them, although some parts of our website or Apps may not function correctly if you do. Mobile Apps may offer settings to limit tracking, and you can also use your device's advertising and tracking controls.

Where the law requires it, we will ask for your consent before setting non-essential cookies.

10. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include encryption of data in transit and at rest, access controls and least-privilege permissions, multi-factor authentication for our systems, secure software development practices, logging and monitoring, vendor due diligence, and staff training.

No method of transmission or storage is completely secure. If you believe your account has been compromised, please contact us immediately using the details in section 15.

We manage data breaches under the Notifiable Data Breaches scheme in the Privacy Act. If a breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required, and we will notify other regulators and affected individuals where overseas laws require it.

11. Data retention

We keep personal information only for as long as it is needed for the purposes described in this policy, to meet our legal, accounting and reporting obligations, or to resolve disputes and enforce our agreements. As a guide:

• account information is kept while your account is active and for a reasonable period afterwards so you can reactivate it or we can respond to queries;
• project and engagement records are kept for the duration of the engagement and for up to seven years afterwards to meet Australian record-keeping requirements;
• App content, including AI inputs and outputs, is kept according to the retention settings of the relevant App and deleted or de-identified when no longer required; and
• technical logs are typically kept for a limited period for security and troubleshooting.

When information is no longer required, we take reasonable steps to destroy it or permanently de-identify it.

12. Your rights and choices

Access and correction. You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. We will respond within a reasonable time, usually within 30 days. We may need to verify your identity first. In limited circumstances permitted by law we may refuse a request, and if so we will tell you why.

Marketing opt-out. You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting us. We will still send you essential service and account messages.

Account and content deletion. You can delete content within many of our Apps, and you can ask us to close your account and delete your personal information. We may need to retain some information where the law requires it or where it is needed for a legitimate business purpose described in this policy.

Additional rights for EEA and UK residents. If the GDPR or UK GDPR applies to you, you also have the right to request erasure, restriction of processing and data portability, to object to processing based on our legitimate interests, to withdraw consent at any time without affecting earlier processing, and to lodge a complaint with your local supervisory authority.

Additional rights for California residents. If the CCPA applies to you, you have the right to know what personal information we collect, use and disclose, to request deletion, to correct inaccurate information, and not to be discriminated against for exercising your rights. We do not sell or share personal information for cross-context behavioural advertising.

To exercise any of these rights, contact us using the details in section 15.

13. Children

Our website, Apps and Services are intended for businesses and adults. They are not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. Third-party websites and services

Our website and Apps may contain links to, or integrate with, third-party websites and services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies before providing them with personal information.

15. How to contact us and make a complaint

If you have a question about this policy, want to exercise your rights, or believe we have breached the Australian Privacy Principles or other applicable privacy law, please contact us:

We take complaints seriously. We will acknowledge your complaint promptly, investigate it, and aim to respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992. If you are located in the EEA or the UK, you may also contact your local data protection authority.

16. Changes to this policy

We may update this policy from time to time to reflect changes in our Apps, Services, business or the law. The current version will always be available at venturetech.ai/privacy, and the "Last updated" date at the top shows when it was last changed. Where a change is significant, we will take reasonable steps to notify you, for example by email or by a notice in the relevant App. Your continued use of our website, Apps or Services after a change takes effect means you accept the updated policy.