Privacy Policy

1. Our Commitment

We are committed to handling personal information in accordance with:

• Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• Spam Act 2003 (Cth)
• Do Not Call Register Act 2006 (Cth)
• Australian Consumer Law
• Privacy Act 2020 (NZ) and Unsolicited Electronic Messages Act 2007 (NZ), where we handle information about New Zealand individuals

This policy explains what we collect, why, who we share it with, and how you can access, correct or delete it.

2. Who This Policy Covers

We handle personal information about five groups of people, and the way we handle it differs for each:

1. Visitors to our website and people who contact us, subscribe to our newsletter, or register for our own events and training
2. Our clients and their staff
3. Prospects: people we contact, or show content or advertising to, on behalf of a client through LinkedIn, email, SMS or AI voice calling
4. Registrants and attendees of webinars or LinkedIn Live sessions we run for a client
5. Training participants in our masterclasses and accelerator programs

If you received outreach from us, or saw advertising we ran for a client, and want to know how we got your details or how to stop contact, go straight to section 3.

3. If We Contacted You

We run LinkedIn account-based marketing and outbound campaigns for B2B businesses in Australia and New Zealand. If you received a LinkedIn message, email, SMS or AI voice call from us or from a persona acting for one of our clients, or saw LinkedIn advertising we ran for a client, this section is for you.

3.1 Why you were contacted. You were contacted because your professional role, your employer, or a publicly observable business signal suggested our client's service might be relevant to your organisation. Our clients often choose specific organisations they would like to work with, and contact is directed to decision makers at those organisations in their professional capacity, not their personal one.

3.2 Where your information came from. Typically one or more of:

• Publicly available business sources, including company websites, professional networking profiles, job advertisements, news coverage, public registers, and business, industry and membership directories, for example trade association member listings, professional body registers, chamber of commerce and business network directories, industry association member lists, conference and event speaker or exhibitor listings, and public company registers
• Commercially available business contact data providers, including Prospeo
• A list supplied to us by our client, drawn from their own records

3.3 What we hold. Generally your name, job title, employer, business email address, business phone number, professional profile URL, and a record of the outreach sent to you and any response. We do not seek personal, financial, health or other sensitive information about prospects.

3.4 If you saw advertising. Where a client's campaign includes LinkedIn advertising, we may upload a list of target organisations or business contacts to LinkedIn so that ads are shown to people at those organisations ("matched audiences"). LinkedIn matches this list against its own members under its own terms and does not tell us which individuals were matched. You can control the ads you see in your LinkedIn advertising settings, and you can ask us to exclude you from matched audiences in any campaign we run.

3.5 If we called you. Where an AI voice agent called you, it will have identified itself as an automated assistant and named the business calling. If a call was recorded, that was disclosed at the start. Recordings and transcripts are held only as long as needed for the campaign and are deleted within 30 days of the engagement ending, unless retention is required for a billing dispute or legal obligation.

3.6 How to stop contact. You can opt out at any time by:

• Replying to a LinkedIn message asking not to be contacted
• Replying to any email and asking to be removed, or using the unsubscribe link
• Replying STOP to any SMS
• Telling an AI voice agent you do not wish to be contacted, or asking to be removed
• Emailing us at hello@aipoint.io

One opt-out covers every channel. An opt-out received on any channel is applied across LinkedIn, email, SMS, voice and matched advertising audiences for that campaign and client. We action opt-outs within five business days, and usually sooner. Because we act for multiple clients, opting out of one client's campaign does not automatically remove you from another's. Tell us if you want to be suppressed across all AIPoint campaigns, and we will do that.

3.7 Your other rights. You can ask us what information we hold about you, ask us to correct it, ask us to delete it, and ask us which client the outreach was sent for. See sections 15 and 21.

4. What We Collect

4.1 Information you give us directly. Name, business email address, phone number, business name, role, payment and billing details, communications with us, marketing preferences, and information you provide during training programs or when booking a call.

4.2 Information we collect automatically from our website. IP address, browser and device information, pages visited, time on site, links clicked, referral source, and cookie and analytics data. See section 19.

4.3 Client Data. Where a client engages us, we receive access to their prospect lists, CRM records, brand assets, LinkedIn and advertising accounts, and systems as needed to deliver the engagement.

4.4 Prospect data we source. As described in section 3.2, we identify and enrich business contact information for the purpose of our clients' campaigns.

4.5 Buying-signal research. We collect publicly observable information indicating that an organisation may be in market, for example hiring activity, funding announcements, leadership changes, expansions, technology adoption, tender activity or public commentary. This is organisation-level research, though it may be associated with the individuals holding relevant roles.

4.6 Engagement data. Where we run LinkedIn content or advertising for a client, we receive engagement information from LinkedIn, such as which organisations are engaging with ads, and which members have reacted to or commented on a client's public posts.

4.7 Webinar and event registrations. Where we run a webinar or LinkedIn Live session for a client, we collect registrants' names, business email addresses, organisations, roles, any answers to registration questions, and attendance information.

5. Why We Collect It

We collect and use personal information to:

• Deliver, operate and improve account-based marketing and outbound campaigns for our clients
• Identify and qualify organisations and prospects who may benefit from our clients' services
• Produce and send approved outreach, content and advertising across the channels described in this policy
• Run webinars and live sessions for our clients, and pass registrant details to the client for follow-up
• Book meetings and pass qualified leads to our clients
• Provide reporting and analytics
• Deliver training programs and manage registrations
• Respond to enquiries and provide support
• Process payments and manage subscriptions
• Send our own marketing communications, where we have consent or another lawful basis
• Comply with legal, tax and regulatory obligations

Providing information to us is generally optional, but we may be unable to deliver some services without it.

6. Our Role: When We Act on Instruction and When We Collect Ourselves

This distinction matters and is often glossed over, so we state it plainly.

6.1 When a client supplies the data. Our client determines the purpose and we handle the data on their documented instructions. The client is responsible for having a lawful basis to provide it to us and for having met its own notification obligations.

6.2 When we source the data. Where we identify, collect or enrich prospect information ourselves, we are collecting personal information in our own right for the purpose of our client's campaign. In that case:

• We collect only business contact and professional role information, and only where it is reasonably necessary for the campaign
• Where we collect information about an individual from a source other than that individual, APP 5 requires that reasonable steps be taken to notify them. We meet this by identifying ourselves or the client in every outreach message, by referring recipients to this policy, and by publishing section 3 above
• The individual can access, correct or delete their information by contacting us directly, without going through our client

6.3 Data Processing Agreements. For every engagement involving personal information we execute a DPA specifying scope, duration, security measures, retention, deletion and return, sub-processors, and each party's obligations.

6.4 Client responsibilities. Our clients remain responsible for their own compliance with privacy, spam and telemarketing laws in relation to campaigns they approve, and for honouring the suppression list after an engagement ends.

7. How We Handle Each Channel

7.1 LinkedIn messaging. Outreach is sent from the client's own LinkedIn account or an authorised account. We collect only profile information visible to that account. LinkedIn data is used solely for the client's campaign, is not re-sold, and is not merged into other datasets except as LinkedIn permits.

7.2 LinkedIn content and advertising. Content is published on the client's own profile or company page. Advertising runs through the client's own LinkedIn advertising account. Where matched audiences are used, lists are uploaded to LinkedIn only for that client's campaign and are removed from the advertising account when the engagement ends.

7.3 Email. Every commercial email identifies the sender, includes valid contact details and includes a functional unsubscribe facility. Unsubscribes are actioned within five business days. Where open and click tracking is enabled, we tell the client, and tracking can be disabled on request.

7.4 SMS. Commercial SMS identifies the sender, includes contact details, and includes an opt-out instruction. STOP replies and equivalent requests are added to the suppression list within five business days. We send within reasonable business hours only.

7.5 AI voice calling. Voice agents identify themselves as automated at the start of every call and name the business they are calling for. Australian calling lists are washed against the Do Not Call Register before dialling. Calls are made only within permitted calling hours. Recording, where used, is disclosed at the start of the call. Recipients who ask for a human are transferred or offered a callback.

7.6 Webinars and LinkedIn Live. Registration pages state that registrant details will be shared with the client hosting the session. Recording, where used, is disclosed at registration and at the start of the session.

7.7 Suppression. We maintain a suppression list per client engagement, and a global suppression list for individuals who ask to be excluded from all AIPoint campaigns.

8. Data Enrichment and Third-Party Sources

We use commercially available business data providers, together with public and directory sources, to verify and supplement business contact information. Directory sources may include trade and industry association listings, professional body registers, business network and chamber directories, event and exhibitor listings, and public company registers. We use these sources only where their terms of use permit, and only to obtain business contact and professional role information.

We do not guarantee the accuracy or currency of third-party data. Records may be outdated, duplicated or misattributed. Where you tell us information we hold about you is wrong, we will correct it (see section 15).

Where our clients direct us to use enriched data, they are responsible for validating it, for having a lawful basis to market to the contacts, and for compliance with spam laws. We are not responsible for regulatory consequences of a client's use of data outside our engagement.

9. AI Service Providers

We use AI services to research, draft, qualify and deliver campaigns, including services provided by Anthropic, OpenAI and ElevenLabs, and comparable providers.

• Data sent to these providers is subject to their terms and privacy policies
• We use business or enterprise tiers with enhanced privacy protections where available, under which customer data is not used to train the provider's models
• We do not use client data or prospect data to train any AI system of our own
• We may use aggregated, de-identified performance data to improve our services, in a form that cannot identify any individual or business

10. Automated Decision-Making

We use automated processes to prioritise and route prospects, including lead scoring, qualification against a client's ideal client profile, prioritisation of Target Accounts by buying signals, and sequencing of outreach across channels. The personal information used is limited to business contact details, professional role, employer and publicly observable business signals.

These processes determine whether and how a person is approached with a commercial offer. They do not determine any person's legal rights, contractual entitlements, access to a service or benefit, or eligibility for anything. A person's information is added to a suppression list rather than scored if they have opted out.

From 10 December 2026, APP 1.7 requires entities using personal information in automated decisions that could significantly affect an individual's rights or interests to disclose the kinds of information and decisions involved in their privacy policy. We publish the disclosure above and will update it in line with OAIC guidance as it is finalised.

A person reviews all outreach and content before it is sent or published. If you believe an automated process has affected you and want it reviewed by a person, contact us and we will do so.

11. Sensitive Information

We do not seek or intentionally collect sensitive information, including health, biometric, genetic, racial or ethnic origin, political, religious, sexual orientation or criminal record information.

If a specific engagement would require sensitive information, we will seek explicit written consent, explain how it will be protected, and apply enhanced security measures.

12. Who We Disclose Information To

We disclose personal information to:

12.1 Our clients, in relation to prospects contacted on their behalf, registrants for sessions run on their behalf, and leads generated for them.

12.2 Service providers and sub-processors, being at the date of this policy:

• Cloud and hosting: Amazon Web Services, Google Cloud, Webflow
• AI and voice: Anthropic, OpenAI, ElevenLabs
• LinkedIn outreach, content and advertising: LinkedIn (including Sales Navigator and Campaign Manager), HeyReach
• Email sending and deliverability: Instantly, lemlist
• Data sourcing and enrichment: Prospeo, Apify
• Automation and workflow: n8n, Make, Zapier
• Event registration and streaming: LinkedIn Live, Zoom, Luma, Humanitix, as used per engagement
• Telephony and SMS carriage: as specified per engagement
• CRM platforms, where a client directs integration: HubSpot, Salesforce, Attio and others
• Analytics: Google Analytics, LinkedIn Insight Tag
• Payments, accounting and invoicing providers

This list is current as at the date above and is updated as our stack changes. Clients engaged under a DPA are notified of material sub-processor changes.

12.3 Professional advisers, including lawyers and accountants, where necessary.

12.4 Regulators and law enforcement, where required by law, or to a court.

We do not sell personal information.

13. Overseas Disclosure

Several of our service providers store or process data outside Australia. Personal information may be disclosed to recipients in:

• United States (including AI, LinkedIn, sending, enrichment and cloud providers)
• European Union and United Kingdom
• Other jurisdictions where our cloud providers operate data centres

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including by relying on contractual data protection commitments in our vendor agreements and by preferring providers offering Australian or contractually restricted data residency where available.

You should be aware that overseas recipients may be subject to laws that differ from Australian privacy law, and that in some cases we may not be able to guarantee the same level of protection or the same enforcement options available to you in Australia.

14. Marketing Communications From Us

We may send you information about our services, training, events and insights.

You can opt out at any time by using the unsubscribe link in any email, updating your preferences, or contacting us. Opt-outs are actioned within five business days.

We will continue to send transactional and service messages, such as invoices, receipts, security notices and material service updates, regardless of marketing preferences.

All our marketing communications comply with the Spam Act 2003 (Cth) and, for New Zealand recipients, the Unsolicited Electronic Messages Act 2007 (NZ): we identify ourselves clearly, include valid contact details, and provide a functional unsubscribe facility.

15. Your Rights

15.1 Access. You may request access to the personal information we hold about you. We may verify your identity first. We will respond within 30 days, or explain why we need longer. We may charge a reasonable administrative fee for access where permitted, but never for making a request.

15.2 Correction. You may ask us to correct information that is inaccurate, out of date, incomplete or misleading. We will correct it, or explain why we have not, within 30 days. Where we have disclosed the information to a client, we will tell them of the correction on request.

15.3 Deletion. You may ask us to delete your personal information. We will confirm deletion within 30 days or explain why we cannot, for example where retention is required for tax, accounting or legal reasons. If we delete your record entirely we lose the ability to keep you suppressed, so we will normally retain a minimal suppression record containing only what is needed to ensure you are not contacted again. Tell us if you would prefer complete deletion instead.

15.4 How to ask. Email our Privacy Officer at hello@aipoint.io.

16. Security

We protect personal information using:

• Encrypted transmission (HTTPS, TLS)
• Access controls, multi-factor authentication and least-privilege access
• Reputable cloud infrastructure with security controls
• Vendor security assessment before onboarding
• Confidentiality and privacy obligations on staff and contractors
• Secure deletion and disposal procedures

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we maintain practices appropriate to the sensitivity of the information we hold.

17. Data Breaches

If we experience an eligible data breach likely to result in serious harm, we will:

• Assess and contain the incident promptly
• Notify affected individuals as soon as practicable
• Notify the Office of the Australian Information Commissioner where required under the Notifiable Data Breaches scheme, and the New Zealand Office of the Privacy Commissioner where required under the Privacy Act 2020 (NZ)
• Notify affected clients, and support their own notification obligations

If a third-party provider we use experiences a breach affecting your information, we will notify you once we become aware and provide guidance on steps to take.

18. Data Retention

We retain personal information only as long as necessary for the purpose it was collected, or as required by law.

• Prospect and campaign data: duration of the client engagement plus 30 days, after which it is deleted or returned to the client, unless a written agreement provides otherwise
• Matched audience lists: removed from the advertising account when the engagement ends
• Webinar registrant data: duration of the client engagement plus 30 days, after which it is deleted or returned to the client
• Suppression records: retained indefinitely, containing only what is necessary to ensure a person is not contacted again
• Voice and session recordings and transcripts: deleted within 30 days of the engagement ending, unless required for a billing dispute or legal obligation, or unless the client keeps a session recording under its own policy
• Client contractual and project records: duration of engagement plus seven years
• Financial records: seven years, as required for tax and accounting
• Our own marketing list: three years from last engagement; after you unsubscribe, we keep only a suppression record
• Training participant records: two years after program completion
• Website analytics: as configured in the analytics platform, generally no more than 26 months

Once no longer needed, information is securely destroyed or de-identified.

19. Cookies and Analytics

We use cookies and analytics tools, including Google Analytics and the LinkedIn Insight Tag, to understand how our website is used, measure our own advertising, and improve our website.

You can manage cookies through your browser settings, opt out of Google Analytics at tools.google.com/dlpage/gaoptout, manage LinkedIn advertising preferences in your LinkedIn settings, or contact us to request that we do not track your visits.

20. Children

Our services are directed at businesses and are not intended for individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have, we will delete it promptly.

21. Complaints

Step 1. Email our Privacy Officer at hello@aipoint.io with details of your concern. We will investigate and respond within 30 days.

Step 2. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

• oaic.gov.au
• 1300 363 992
• enquiries@oaic.gov.au

New Zealand individuals may complain to the Office of the Privacy Commissioner at privacy.org.nz.

22. Changes to This Policy

We may update this policy to reflect changes in our practices, our technology stack or the law. Material changes will be posted on our website, and we will email clients and subscribers where the change is significant. The "last updated" date above will be revised.

23. Contact Us

Privacy Officer: Ima Miri AI Point Pty Ltd (trading as AIPoint) ABN 32 667 971 388 Sydney, New South Wales, Australia Email: hello@aipoint.io

This policy is governed by the laws of New South Wales, Australia, and the Privacy Act 1988 (Cth).

‍