Platform Privacy Policy

1. Two kinds of information, two roles

Information we hold about you as an account holder or user — your name, email, phone, role, sign-in records, billing details and how you use the Platform. We decide how this is handled, and this policy describes it.

Information inside a customer's workspace ("Customer Data") — the contacts, companies, records, documents, messages and conversations a business and its team put into their private workspace, and what Robo creates from them. The business that owns the workspace controls that information and is responsible for collecting and using it lawfully. We process it on their instructions, to provide the Platform, under our Platform Terms. If your information is in a customer's workspace, that customer's privacy policy applies to it and requests about it should go to them first; we help them respond.

2. What we collect

• Account and workspace details: name, email address, phone (optional), job title, business name and website, industry, the workspace's plan and settings, and sign-in records. Sign-in uses one-time email codes; we do not hold passwords.
• Billing: subscription, seat count, invoices and payment status. Card details are collected and stored by our payment processor (Stripe), not by us; we hold a token that identifies the payment method and the last four digits.
• Content you and your team put in your workspace, and what Robo produces for you: records, notes, tasks, files and images, emails and messages sent or received through the Platform, pages and documents, canvas boards, chat and voice conversations with Robo, meeting recordings and transcripts where you use those features.
• Product-specific records — for example listings, inspections and offers (RoboResi); schemes, lots, levies and committee records (RoboStrata); participant support records (RoboAbility — see section 9).
• Automatically: service logs, IP address, device and browser information, approximate location derived from IP, and the pages you use. Pages our customers publish may include a lightweight visitor beacon (page views and approximate location) that reports to the publishing workspace.
• From third parties: where a workspace operator connects a service (their email or calendar, a listing portal, a booking or accounting system) or uses contact enrichment, information flows from that service into their workspace. The operator decides to collect it and is responsible for doing so lawfully.

3. How we use it

• To provide, secure, support and improve the Platform, and to bill for it.
• AI and speech processing: Robo processes workspace content to do the tasks operators ask of it. This means sending relevant content to the AI model, speech and image providers listed in section 5 so they can return a result to us. RoboIQ does not use Customer Data to train general-purpose AI models. Our AI model providers (Anthropic, OpenAI and Google) are used under their commercial API terms, which do not permit them to train on the content we send; we have not enabled any optional data-sharing or model-improvement programme with any of them. Every request we send to our speech provider (Deepgram) carries the opt-out from its model-improvement programme and is sent to its Australian endpoint.
• Email and telecommunications processing: our email provider (Resend) states that it does not use customer content to train AI models. Our SMS and voice carrier (Twilio) may use limited message and call metadata to operate and protect its network, including to detect spam and fraud, under its own data-protection terms.
• No-training is not the same as no-retention. These providers keep operational records of our requests — for example delivery logs, usage records and abuse-monitoring logs — for a limited period under their own terms, after which they are deleted. Section 8 describes how this affects deletion.
• Service communications: sign-in codes, invitations, approvals, alerts, billing notices and material changes to our terms or this policy.
• Our own marketing to account holders about RoboIQ products, which you can opt out of at any time. We do not use Customer Data for our marketing.
• To meet legal obligations, resolve disputes, prevent abuse and enforce our terms.

We do not sell personal information, and we do not use Customer Data to build profiles for anyone other than the workspace it belongs to.

4. Who we share it with

We share personal information only with the service providers listed in section 5, with our professional advisers, with a purchaser or successor of our business (subject to confidentiality), and with regulators, courts or others where the law requires or permits. Dealers or partners who introduced you to us may see account-level details needed to support you, never the contents of your workspace unless you invite them in.

5. Service providers and overseas disclosure (APP 8)

The Platform runs on international cloud infrastructure. Personal information is stored or processed by the following providers, in the locations shown. Some are located outside Australia; before disclosing personal information overseas we take reasonable steps — contractual data-protection terms, encryption in transit and at rest, and access controls — to ensure it is handled consistently with the APPs.

Where a workspace operator connects an additional model provider, data provider or external tool, that provider receives the information the operator sends it under the operator's own arrangement with them.

6. Marketing messages our customers send

Emails and SMS sent through the Platform's campaign features include a working unsubscribe facility (one-click email unsubscribe; STOP for SMS). Opt-outs are recorded on the contact record and enforced automatically at send time, and bounced or opted-out recipients are excluded. The business sending the message is responsible for having consent under the Spam Act 2003 (Cth); if you receive a message you did not want, use the unsubscribe link or reply STOP, and you can also contact us.

7. Security (APP 11)

Workspaces are isolated from each other at the application layer. Data is encrypted in transit (TLS) and at rest with our storage providers. Access is role-based within a workspace and least-privilege within RoboIQ. Consequential actions by Robo pass through approval gates and are recorded in an activity ledger the workspace can review. Secrets are held in a dedicated secrets manager. Uploaded files are type-checked and are never served as executable web content. We review dependencies and container images for vulnerabilities on a schedule and apply fixes promptly.

No system is perfectly secure. If you believe your account or data has been compromised, contact [email protected].

8. Retention and deletion

• Customer Data is retained while the workspace is active.
• A workspace administrator can permanently delete the whole workspace ("Close workspace") at any time. Deletion from RoboIQ's live application is immediate and cannot be undone. Copies in our encrypted database backups expire on the backup rotation cycle (currently about seven days). Our service providers delete their own operational records on their schedules — for example, email delivery logs are kept by our email provider for about 30 days, and provider-held data is removed within about 90 days of our account with them ending.
• After a subscription is cancelled or a trial lapses we keep the workspace for at least 30 days so it can be exported or reactivated, then delete it.
• Account, billing and audit records are kept as long as the law requires (generally seven years for financial records).
• Service logs are kept for a short operational period and then deleted or aggregated.

9. RoboAbility — health and other sensitive information

RoboAbility workspaces may contain health information and other sensitive information about a person receiving support, including observations, plans, funding details and documents. Additional protections apply:

• The parent, guardian or participant who owns the workspace controls every invitation; nothing is shared with anyone they have not explicitly invited.
• We collect and handle this information only with consent, only to provide the Platform, and never for marketing, advertising, profiling beyond the participant's own workspace, or sale.
• RoboAbility's database and document storage are located in Australia (Sydney).
• The Platform records observations, not diagnoses. It is not a medical device, does not give health advice and does not determine eligibility for any government scheme.
• Prospecting and contact-enrichment features are disabled in RoboAbility workspaces.

10. Cookies

Our apps use strictly necessary cookies for sign-in sessions and security. We do not use advertising cookies. Pages our customers publish are their pages; their cookie and privacy practices apply.

11. Access, correction and complaints (APP 12, 13)

You can access and update your own account details in Settings. For anything else — access to or correction of personal information we hold about you, or a complaint about how we have handled it — contact [email protected]. We respond within 30 days. Where your information is held in a customer's workspace we may refer your request to that customer and help them respond. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

12. Data breaches

We maintain a response process aligned with the Notifiable Data Breaches scheme: contain the incident, assess it within 30 days, notify the OAIC and affected individuals (through the workspace owner where the data is theirs) if an eligible data breach is likely to result in serious harm, and remediate. Report suspected breaches to [email protected].

13. Children

The Platform is for business use and for adults organising support for their family. We do not knowingly collect personal information directly from children under 16, other than information a parent or guardian records about a child in a RoboAbility workspace under section 9.

14. Changes

We may update this policy. The effective date at the top shows the version in force. Material changes are notified in-app or by email to workspace administrators before they take effect.

15. Contact

RoboIQ Pty Ltd (ABN 16 661 653 667), Marsfield NSW 2122, Australia. Privacy: [email protected]. Security: [email protected].