Privacy Policy

1. Our Commitment

We are committed to handling personal information in accordance with:

• Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• Spam Act 2003 (Cth)
• Do Not Call Register Act 2006 (Cth)
• Australian Consumer Law
• New Zealand Privacy Act 2020, where we handle information about New Zealand individuals

This policy explains what we collect, why, who we share it with, and how you can access, correct or delete it.

2. Who This Policy Covers

We handle personal information about four groups of people, and the way we handle it differs for each:

1. Visitors to our website and people who contact us, subscribe to our newsletter, or register for our training
2. Our clients and their staff
3. Prospects — people we contact on behalf of a client through email, LinkedIn, SMS or AI voice calling
4. Training participants in the AI Outbound Masterclass and AI Outbound Accelerator

If you received outreach from us and want to know how we got your details or how to stop contact, go straight to section 3.

3. If We Contacted You

We run outbound sales campaigns for B2B businesses in Australia and New Zealand. If you received an email, LinkedIn message, SMS or AI voice call from us or from a persona acting for one of our clients, this section is for you.

3.1 Why you were contacted. You were contacted because your professional role, your employer or a publicly observable business signal suggested our client's service might be relevant to your organisation. Contact was directed to you in your professional capacity, not your personal one.

3.2 Where your information came from. Typically one or more of:

• Publicly available business sources, including company websites, professional networking profiles, job advertisements, news coverage, public registers, and business, industry and membership directories — for example trade association member listings, professional body registers, chamber of commerce and business network directories, industry association member lists, conference and event speaker or exhibitor listings, and public company registers
• Commercially available business contact data providers, including Prospeo and Clay
• A list supplied to us by our client, drawn from their own records

3.3 What we hold. Generally your name, job title, employer, business email address, business phone number, professional profile URL, and a record of the outreach sent to you and any response. We do not seek personal, financial, health or other sensitive information about prospects.

3.4 If we called you. Where an AI voice agent called you, it will have identified itself as an automated assistant and named the business calling. If a call was recorded, that was disclosed at the start. Recordings and transcripts are held only as long as needed for the campaign and are deleted within 30 days of the engagement ending, unless retention is required for a billing dispute or legal obligation.

3.5 How to stop contact. You can opt out at any time by:

• Replying to any email and asking to be removed, or using the unsubscribe link
• Replying STOP to any SMS
• Telling an AI voice agent you do not wish to be contacted, or asking to be removed
• Replying to a LinkedIn message asking not to be contacted
• Contacting us directly at aipoint.io/contact

One opt-out covers every channel. An opt-out received on any channel is applied across email, LinkedIn, SMS and voice for that campaign and client. We action opt-outs within five business days, and usually sooner. Because we act for multiple clients, opting out of one client's campaign does not automatically remove you from another's — tell us if you want to be suppressed across all AI Point campaigns, and we will do that.

3.6 Your other rights. You can ask us what information we hold about you, ask us to correct it, ask us to delete it, and ask us which client the outreach was sent for. See sections 15 and 17.

4. What We Collect

4.1 Information you give us directly. Name, business email address, phone number, business name, role, payment and billing details, communications with us, marketing preferences, and information you provide during training programs.

4.2 Information we collect automatically from our website. IP address, browser and device information, pages visited, time on site, links clicked, referral source, and cookie and analytics data.

4.3 Client Data. Where a client engages us, we receive access to their prospect lists, CRM records, brand assets and systems as needed to deliver the engagement.

4.4 Prospect data we source. As described in section 3.2, we identify and enrich business contact information for the purpose of our clients' campaigns.

4.5 Buying-signal research. We collect publicly observable information indicating that an organisation may be in market — for example hiring activity, funding announcements, leadership changes, technology adoption, tender activity or public commentary. This is organisation-level research, though it may be associated with the individuals holding relevant roles.

5. Why We Collect It

We collect and use personal information to:

• Deliver, operate and improve outbound campaigns for our clients
• Identify and qualify prospects who may benefit from our clients' services
• Produce and send approved outreach and follow-up across the four channels
• Book meetings and pass qualified leads to our clients
• Provide reporting and analytics
• Deliver training programs and manage registrations
• Respond to enquiries and provide support
• Process payments and manage subscriptions
• Send our own marketing communications, where we have consent or another lawful basis
• Comply with legal, tax and regulatory obligations

Providing information to us is generally optional, but we may be unable to deliver some services without it.

6. Our Role: When We Act on Instruction and When We Collect Ourselves

This distinction matters and is often glossed over, so we state it plainly.

6.1 When a client supplies the data. Our client determines the purpose and we handle the data on their documented instructions. The client is responsible for having a lawful basis to provide it to us and for having met its own notification obligations.

6.2 When we source the data. Where we identify, collect or enrich prospect information ourselves, we are collecting personal information in our own right for the purpose of our client's campaign. In that case:

• We collect only business contact and professional role information, and only where it is reasonably necessary for the campaign
• Where we collect information about an individual from a source other than that individual, APP 5 requires that reasonable steps be taken to notify them. We meet this by identifying ourselves and the client in every outreach message, by referring recipients to this policy, and by publishing section 3 above
• The individual can access, correct or delete their information by contacting us directly, without going through our client

6.3 Data Processing Agreements. For every engagement involving personal information we execute a DPA specifying scope, duration, security measures, retention, deletion and return, sub-processors, and each party's obligations.

6.4 Client responsibilities. Our clients remain responsible for their own compliance with the Privacy Act, Spam Act and Do Not Call Register Act in relation to campaigns they approve, and for honouring the suppression list after an engagement ends.

7. How We Handle Each Channel

7.1 Email. Every commercial email identifies the sender, includes valid contact details and includes a functional unsubscribe facility. Unsubscribes are actioned within five business days. Where open and click tracking is enabled, we tell the client, and tracking can be disabled on request.

7.2 LinkedIn. Outreach is sent from the client's own LinkedIn account or an authorised account. We collect only profile information visible to that account. LinkedIn data is used solely for the client's campaign, is not re-sold, and is not merged into other datasets except as LinkedIn permits.

7.3 SMS. Commercial SMS identifies the sender, includes contact details, and includes an opt-out instruction. STOP replies and equivalent requests are added to the suppression list within five business days. We send within reasonable business hours only.

7.4 AI voice calling. Voice agents identify themselves as automated at the start of every call and name the business they are calling for. Australian calling lists are washed against the Do Not Call Register before dialling. Calls are made only within permitted calling hours. Recording, where used, is disclosed at the start of the call. Recipients who ask for a human are transferred or offered a callback.

7.5 Suppression. We maintain a suppression list per client engagement, and a global suppression list for individuals who ask to be excluded from all AI Point campaigns.

8. Data Enrichment and Third-Party Sources

We use commercially available business data providers, including Prospeo and Clay, together with public and directory sources, to verify and supplement business contact information. Directory sources may include trade and industry association listings, professional body registers, business network and chamber directories, event and exhibitor listings, and public company registers. We use these sources only where their terms of use permit, and only to obtain business contact and professional role information.

We do not guarantee the accuracy or currency of third-party data. Records may be outdated, duplicated or misattributed. Where you tell us information we hold about you is wrong, we will correct it (see section 15).

Where our clients direct us to use enriched data, they are responsible for validating it, for having a lawful basis to market to the contacts, and for compliance with the Spam Act. We are not responsible for regulatory consequences of a client's use of data outside our engagement.

9. AI Service Providers

We use AI services to research, draft, qualify and deliver campaigns, including services provided by Anthropic, OpenAI and ElevenLabs, and comparable providers.

• Data sent to these providers is subject to their terms and privacy policies
• We use business or enterprise tiers with enhanced privacy protections where available, under which customer data is not used to train the provider's models
• We do not use client data or prospect data to train any AI system of our own
• We may use aggregated, de-identified performance data to improve our services, in a form that cannot identify any individual or business

10. Automated Decision-Making

We use automated processes to prioritise and route prospects — including lead scoring, qualification against a client's ideal customer profile, and sequencing of outreach across channels. The personal information used is limited to business contact details, professional role, employer and publicly observable business signals.

These processes determine whether and how a person is approached with a commercial offer. They do not determine any person's legal rights, contractual entitlements, access to a service or benefit, or eligibility for anything. A person's information is added to a suppression list rather than scored if they have opted out.

From 10 December 2026, new APP 1.7 requires entities using personal information in automated decisions that could significantly affect an individual's rights or interests to disclose the kinds of information and decisions involved in their privacy policy. We publish the disclosure above and will update it in line with OAIC guidance as it is finalised.

Human review applies to all outreach content before sending. If you believe an automated process has affected you and want it reviewed by a person, contact us and we will do so.

11. Sensitive Information

We do not seek or intentionally collect sensitive information, including health, biometric, genetic, racial or ethnic origin, political, religious, sexual orientation or criminal record information.

If a specific engagement would require sensitive information, we will seek explicit written consent, explain how it will be protected, and apply enhanced security measures.

12. Who We Disclose Information To

We disclose personal information to:

12.1 Our clients, in relation to prospects contacted on their behalf and leads generated for them.

12.2 Service providers and sub-processors, being at the date of this policy:

• Cloud and hosting: Amazon Web Services, Google Cloud, Webflow
• AI and voice: Anthropic, OpenAI, ElevenLabs
• Email sending and deliverability: Instantly
• LinkedIn outreach and engagement: HeyReach, LinkedIn Sales Navigator
• Data sourcing and enrichment: Prospeo, Clay
• Automation and workflow: n8n, Make, Zapier
• Telephony and SMS carriage: as specified per engagement
• CRM platforms, where a client directs integration: HubSpot, Salesforce, Attio and others
• Analytics: Google Analytics
• Payments, accounting and invoicing providers
• Event registration and training delivery platforms

This list is current as at the date above and is updated as our stack changes. Clients engaged under a DPA are notified of material sub-processor changes.

12.3 Professional advisers, including lawyers and accountants, where necessary.

12.4 Where required by law, or to a regulator, court or law enforcement agency.

We do not sell personal information.

13. Overseas Disclosure

Several of our service providers store or process data outside Australia. Personal information may be disclosed to recipients in:

• United States (including AI, sending, enrichment and cloud providers)
• European Union and United Kingdom
• Other jurisdictions where our cloud providers operate data centres

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including by relying on contractual data protection commitments in our vendor agreements and by preferring providers offering Australian or contractually restricted data residency where available.

You should be aware that overseas recipients may be subject to laws that differ from Australian privacy law, and that in some cases we may not be able to guarantee the same level of protection or the same enforcement options available to you in Australia.

14. Marketing Communications From Us

We may send you information about our services, training, events and insights.

You can opt out at any time by using the unsubscribe link in any email, updating your preferences, or contacting us. Opt-outs are actioned within five business days.

We will continue to send transactional and service messages — invoices, receipts, security notices and material service updates — regardless of marketing preferences.

All our marketing communications comply with the Spam Act 2003 (Cth): we identify ourselves clearly, include valid contact details, and provide a functional unsubscribe facility.

15. Your Rights

15.1 Access. You may request access to the personal information we hold about you. We may verify your identity first. We will respond within 30 days, or explain why we need longer. We may charge a reasonable administrative fee for access where permitted, but never for making a request.

15.2 Correction. You may ask us to correct information that is inaccurate, out of date, incomplete or misleading. We will correct it, or explain why we have not, within 30 days. Where we have disclosed the information to a client, we will tell them of the correction on request.

15.3 Deletion. You may ask us to delete your personal information. We will confirm deletion within 30 days or explain why we cannot — for example where retention is required for tax, accounting or legal reasons. Note that if we delete your record entirely we lose the ability to keep you suppressed, so we will normally retain a minimal suppression record containing only what is needed to ensure you are not contacted again. Tell us if you would prefer complete deletion instead.

15.4 How to ask. Contact us at aipoint.io/contact.

16. Security

We protect personal information using:

• Encrypted transmission (HTTPS, TLS)
• Access controls, multi-factor authentication and least-privilege access
• Reputable cloud infrastructure with security controls
• Vendor security assessment before onboarding
• Confidentiality and privacy obligations on staff and contractors
• Secure deletion and disposal procedures

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we maintain practices appropriate to the sensitivity of the information we hold.

17. Data Breaches

If we experience an eligible data breach likely to result in serious harm, we will:

• Assess and contain the incident promptly
• Notify affected individuals as soon as practicable
• Notify the Office of the Australian Information Commissioner where required under the Notifiable Data Breaches scheme
• Notify affected clients, and support their own notification obligations

If a third-party provider we use experiences a breach affecting your information, we will notify you once we become aware and provide guidance on steps to take.

18. Data Retention

We retain personal information only as long as necessary for the purpose it was collected, or as required by law.

• Prospect and campaign data: duration of the client engagement plus 30 days, after which it is deleted or returned to the client, unless a written agreement provides otherwise
• Suppression records: retained indefinitely, containing only what is necessary to ensure a person is not contacted again
• Voice recordings and transcripts: deleted within 30 days of the engagement ending, unless required for a billing dispute or legal obligation
• Client contractual and project records: duration of engagement plus seven years
• Financial records: seven years, as required for tax and accounting
• Our own marketing list: three years from last engagement, or six months after unsubscribe
• Training participant records: two years after program completion
• Website analytics: as configured in the analytics platform, generally no more than 26 months

Once no longer needed, information is securely destroyed or de-identified.

19. Cookies and Analytics

We use cookies and analytics tools, including Google Analytics, to understand site usage and improve our website.

You can manage cookies through your browser settings, opt out of Google Analytics at tools.google.com/dlpage/gaoptout, or contact us to request that we do not track your visits.

20. Children

Our services are directed at businesses and are not intended for individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have, we will delete it promptly.

21. Complaints

Step 1. Contact us at aipoint.io/contact with details of your concern. We will investigate and respond within 30 days.

Step 2. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

• oaic.gov.au
• 1300 363 992
• enquiries@oaic.gov.au

New Zealand individuals may complain to the Office of the Privacy Commissioner at privacy.org.nz.

22. Changes to This Policy

We may update this policy to reflect changes in our practices, our technology stack or the law. Material changes will be posted on our website, and we will email clients and subscribers where the change is significant. The "last updated" date above will be revised.

23. Contact Us

AI Point Pty LtdABN 32 667 971 388Sydney, New South Wales, Australiaaipoint.io/contact

This policy is governed by the laws of New South Wales, Australia, and the Privacy Act 1988 (Cth).

‍