PRIVACY POLICY

1. Introduction

This Privacy Policy explains how Earlibird AI Pty Ltd (ABN 76 674 568 140), trading as Earlibird AI ("we", "us", "our"), collects, uses, discloses, stores, and protects personal information in connection with our AI voice and text agent services and our website at earlibird.ai (together, the "Service").

We are committed to handling personal information in an open and transparent way, in accordance with the Privacy Act 1988 (Cth) (the "Privacy Act") and the Australian Privacy Principles (APPs).

This Policy applies to our customers (the businesses who engage us) and, where relevant, to their End-Users (the individuals who interact with the Service, such as callers, leads, customers, patients, or clients).

By using the Service, you agree to the collection, use, and disclosure of personal information as described in this Policy. If you do not agree, please do not use the Service.

2. Our Role, and Your Role as the Business Customer

When we process personal information about End-Users (such as callers to your business), we generally do so on your behalf as a service provider. As the business customer, you are typically responsible for:

• deciding what personal information is collected and how it is used;

• giving your End-Users appropriate privacy notices;

• obtaining any required consents from End-Users, including consent to call recording and to the handling of Sensitive Information such as health information;

• having a lawful basis to collect and disclose personal information to us; and

• meeting your own obligations under the Privacy Act and other applicable laws.

If you are an End-User with questions about how a particular business handles your personal information, please contact that business directly.

3. Our Contact Details

Earlibird AI Pty Ltd ABN: 76 674 568 140 Address: Suite 25 / 29 Claremont Street, South Yarra, VIC 3141, Australia Email: [email protected] Phone: 1300 542 635

4. Information We Collect

We only collect personal information that is reasonably necessary for our functions and activities (APP 3). The types of information we may collect include:

Account information. When you engage us, we collect information such as your business name, contact name and role, email address, phone number, business address, and ABN.

Payment information. To process fees, we collect billing details and payment method type. Payments are processed by third-party payment processors (such as Stripe). We do not store full credit card or bank account numbers on our systems.

Call and message data. As the core of the Service, we process data generated from voice and text interactions, including call recordings and audio streams, call and message transcripts, AI-generated summaries, metadata (such as caller and recipient phone numbers, timestamps, and call duration), the content of what an End-User provides during a conversation (such as name, contact details, reason for contact, and booking preferences), and the bookings, actions, and AI outputs created as a result. This applies to inbound and outbound calls and to SMS, email, and messaging interactions handled through the Service.

Sensitive information (including health information). Depending on how you use the Service, End-Users may share Sensitive Information as defined in the Privacy Act, such as health information. We do not deliberately solicit unnecessary Sensitive Information, but we may collect and handle it where it is provided voluntarily in the course of using the Service and is reasonably necessary to provide the Service. We only collect, use, or disclose Sensitive Information where we have consent (or you have confirmed that appropriate consent has been obtained), or where otherwise permitted under the Privacy Act. We do not use identifiable Sensitive Information for cross-customer training or improvement.

Voice data. Call recordings contain voice characteristics. We do not create, store, or process voiceprints, speaker-identification templates, or other biometric templates from recordings. Voice recordings are processed solely to provide the Service (including transcription, AI response generation, and analytics) and are retained and deleted in line with Section 7.

Integration credentials. To connect the Service to your other tools, we may collect and store (in encrypted form) authentication credentials such as tokens and API keys for the third-party services you authorise (for example calendars, CRMs, and booking systems).

Usage data. We automatically collect information about how the Service and our website are used, including log data (such as IP address, browser and device information, and access times), feature usage, and error and performance data.

Cookies. We use cookies and similar technologies to operate, secure, and analyse our website and Service. You can control cookies through your browser settings.

5. How We Use Personal Information

We use personal information to:

• provide the Service: set up and manage your account, handle inbound and outbound calls and messages, qualify and progress leads, manage bookings and scheduling, facilitate integrations, generate AI outputs, and provide support;

• send notifications: deliver confirmations, reminders, and notifications to you and your End-Users in line with your configurations;

• process payments: manage subscriptions, usage-based billing, and invoicing;

• communicate with you: respond to enquiries and send service and account updates;

• improve the Service: analyse usage, diagnose issues, and develop new features. Where we use call data to refine and improve our AI configurations and models, we rely on aggregated or de-identified data wherever reasonably practicable, and we do not use identifiable data in a way that would let other customers identify you, your business, or any individual End-User;

• market to customers only: send you information about our services, which you can opt out of at any time. We do not use End-User personal information for direct marketing;

• maintain security: detect, prevent, and respond to fraud, abuse, and security incidents; and

• meet legal obligations: comply with the law and establish, exercise, or defend legal claims.

Google API services. If you connect a Google account (for example to use Google Calendar), our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising or to train generalised AI or ML models, and the AI improvement language in this Policy does not apply to Google API services user data.

6. How We Disclose Personal Information

We do not sell personal information. We may disclose it in the following limited circumstances:

Service providers. We use third-party providers to deliver the Service, who are required to protect your data and use it only as we instruct. These include our platform and automation providers (including the white-labelled platform that powers the Earlibird App, and automation tools such as Make), telephony and SMS providers (such as Twilio), AI and voice providers (such as OpenAI and speech and voice processing providers), payment processors (such as Stripe), and hosting and infrastructure providers. We can make a current list of material providers available on reasonable written request.

Your connected integrations. When you connect a third-party service (such as a calendar, CRM, or booking platform), we share information with that service as you direct, to deliver the features you enable.

Professional advisers, legal requirements, and business transfers. We may disclose personal information to our professional advisers, where required by law or valid legal process, or as part of a merger, acquisition, or sale of our business (subject to reasonable steps to keep it protected).

7. Data Security and Retention

We implement reasonable technical and organisational measures to protect personal information against unauthorised access, modification, disclosure, loss, or misuse (APP 11), including encryption in transit and at rest, access controls on a least-privilege basis, secure credential storage, and security monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain personal information only for as long as reasonably necessary for the purposes it was collected, to provide the Service, and to meet our legal obligations. Call data is retained for the period you configure, or for a default period if none is configured, unless we are required to keep it longer. Payment records are retained as required by Australian tax law. After the applicable retention period, we take reasonable steps to delete or de-identify the information, and we may keep aggregated or de-identified data indefinitely.

Data breach notification. If a data breach involving personal information occurs, we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. Where we process personal information on your behalf, we will notify you without undue delay after our initial assessment so that you can meet your own notification obligations.

8. Your Rights

Under the Privacy Act and the APPs, you may:

• access the personal information we hold about you (APP 12);

• request correction of information that is inaccurate, out of date, incomplete, or misleading (APP 13);

• request deletion or de-identification of information we no longer need and are not required to keep;

• opt out of direct marketing at any time; and

• deal with us anonymously or by pseudonym where practicable, though this is generally not practicable for customers given the nature of the Service.

To exercise these rights, contact us at [email protected]. We may need to verify your identity first. We will respond within a reasonable time, usually within 30 days.

For End-Users: if a business has used the Service to collect your personal information, please contact that business first. We will assist the business in responding to legitimate requests as required.

Complaints. If you believe we have mishandled your personal information, contact us at [email protected]. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, by phone on 1300 363 992, or by email at [email protected].

9. International Data Transfers

Our Service is primarily operated in Australia, but some of our third-party providers process data in or from countries outside Australia, including the United States. When we transfer personal information overseas, we take reasonable steps to ensure overseas recipients handle it consistently with the APPs (APP 8), including through appropriate contractual arrangements and due diligence. By using the Service, you acknowledge these transfers, subject to the safeguards described here and in the Privacy Act.

10. AI and Automated Processing

The Service uses artificial intelligence and automated processing to handle calls and messages, generate responses, and take configured actions such as creating bookings. When an interaction is handled, the End-User's voice or message is processed in real time by AI to generate transcripts, understand intent, and produce responses, and personal information disclosed during the interaction is processed to perform the actions you have configured.

AI outputs are generated probabilistically and may be inaccurate or incomplete. The Service does not make decisions that produce legal or similarly significant effects without your oversight, and you remain responsible for reviewing and overseeing AI outputs. You are required to ensure your End-Users are told they are interacting with an AI agent.

11. Children's Privacy

The Service is designed for use by businesses and is not directed at children. We do not knowingly collect personal information directly from children. If you are a customer whose End-Users may include minors, you are responsible for obtaining appropriate parental or guardian consent and providing appropriate notices. If we become aware that we have inadvertently collected a child's personal information without appropriate consent, we will take reasonable steps to delete it.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Policy on our website with a new "Last updated" date and, for material changes, take reasonable steps to notify you. The updated Policy takes effect when posted unless stated otherwise.

13. Contact Us

For any questions, concerns, or complaints about this Policy or our privacy practices, or to exercise your rights, contact us at:

Earlibird AI Pty Ltd ABN: 76 674 568 140 Email: [email protected] Phone: 1300 542 635 Address: Suite 25 / 29 Claremont Street, South Yarra, VIC 3141, Australia