Privacy Policy — Ultragent

BluebirdAi Pty Ltd | ABN: 85 696 013 788 | ACN: 696 013 788

BluebirdAi Pty Ltd ("BluebirdAi", "we", "us", "our") develops and operates the Ultragent platform ("Ultragent", "Platform"). We are committed to protecting the privacy of individuals whose personal information we handle. This Privacy Policy explains how we collect, use, disclose, and manage personal information — including any data we access from Google APIs — in accordance with the Privacy Act 1988 (Cth) ("Privacy Act"), the Australian Privacy Principles ("APPs"), and the Google API Services User Data Policy.

This Policy applies to personal information we collect through the Platform, our website (www.ultragent.ai), and in the course of our business activities. By using the Platform or our website, you acknowledge that you have read and understood this Policy.

1. Who This Policy Applies To

This Policy applies to all individuals whose personal information we handle, including:

visitors to our website (www.ultragent.ai);
prospective customers and their representatives;
authorised users of the Ultragent Platform; and
individuals whose personal information is contained in data submitted to the Platform by our customers.

Ultragent is a business-to-business (B2B) service operated by BluebirdAi Pty Ltd. Where we process personal information on behalf of a customer as a data processor, our obligations are governed by the Data Processing Addendum in our Terms and Conditions. This Policy primarily addresses how we handle personal information in our capacity as a data controller.

2. What Personal Information We Collect

2.1 Information You Provide to Us

We may collect the following types of personal information directly from you:

Identity information: full name, job title, company name.
Contact information: email address, phone number, business address.
Account credentials: username and encrypted password.
Billing information: payment card details (processed securely via our payment provider — we do not store full card numbers), billing address, and invoice history.
Communications: messages, support requests, survey responses, and feedback you send to us.

2.2 Information Collected Automatically

When you visit our website or use the Platform, we may automatically collect:

Usage data: pages visited, features used, actions taken, time and date of access.
Device and technical data: IP address, browser type and version, operating system, device identifiers, and time zone.
Log data: server logs including access times, error logs, and referring URLs.
Cookie and tracking data: as described in our Cookie Policy.

2.3 Information from Third Parties

We may receive personal information from:

our customers when they configure integrations or import data into the Platform;
identity and authentication providers (e.g. single sign-on services, including Google Sign-In); and
publicly available sources and business directories, where relevant to our business relationship with you.

2.4 Google User Data

Where you choose to connect your Google Account to Ultragent, we access a limited set of Google user data through Google APIs, strictly to provide the features you have requested. See Section 6 (Google User Data and API Services) for full details of what Google data we access, how we use it, how it is shared, retained, and deleted, and the limits we place on that use.

2.5 Sensitive Information

We do not intentionally collect sensitive information (as defined in the Privacy Act) such as health information, racial or ethnic origin, political opinions, or biometric data. Please do not submit sensitive information through the Platform unless strictly necessary. If you do submit sensitive information, you consent to its collection and handling in accordance with this Policy.

3. How We Collect Personal Information

We collect personal information:

directly from you when you register for an account, subscribe to a plan, complete a form, or contact us;
automatically through your use of the Platform and website, including via cookies and similar tracking technologies (see our Cookie Policy);
from connected third-party services that you authorise, including Google APIs (see Section 6);
from our customers in the course of providing the Services; and
from third-party sources, including identity providers and publicly available business information.

Where we collect personal information about you from a third party or via indirect means, we will take reasonable steps to notify you of the collection as required by APP 5, unless an exception applies.

4. Why We Collect Personal Information (Purposes)

We collect and hold personal information for the following purposes:

to provide, operate, maintain, and improve the Ultragent Platform and Services;
to create and manage your account and verify your identity;
to process payments and manage billing;
to communicate with you about your account, the Services, updates, and technical notices;
to respond to your enquiries, feedback, and support requests;
to send marketing and promotional communications where you have consented or where permitted by applicable law (you may opt out at any time);
to conduct product analytics, usage research, and service improvement;
to comply with our legal and regulatory obligations;
to detect, prevent, and investigate fraud, security incidents, and other misuse of the Platform; and
to enforce our Terms and Conditions and other agreements.

We will only use your personal information for the purpose for which it was collected, or for a directly related secondary purpose, or with your consent. We do not use Google user data for any purpose other than providing or improving the user-facing features of Ultragent (see Section 6).

5. Disclosure of Personal Information

5.1 When We Disclose

We may disclose personal information to:

our employees, contractors, and related bodies corporate who need access to provide the Services;
trusted third-party service providers who assist us in operating the Platform (including cloud hosting, payment processing, analytics, customer support, and email delivery providers), subject to appropriate confidentiality obligations;
professional advisers including lawyers, accountants, and auditors;
government agencies, law enforcement bodies, or courts where required or authorised by law; and
a buyer or successor entity in connection with a merger, acquisition, restructure, or sale of assets, subject to appropriate confidentiality protections.

5.2 We Do Not Sell Personal Information

We do not sell, rent, or trade personal information — including Google user data — to third parties for their own marketing purposes or for any other purpose.

6. Google User Data and API Services

This section describes how Ultragent accesses, uses, stores, shares, and protects data obtained through Google APIs. Ultragent's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6.1 What Google User Data We Access

When you connect your Google Account, and only after you grant consent on Google's OAuth consent screen, we may access:

Basic profile and email (OpenID / userinfo): your name, email address, and profile picture, used to create and authenticate your Ultragent account.
Gmail data: the messages, metadata, and related content necessary to deliver the email-related features you enable within Ultragent (for example, reading, organising, drafting, or sending messages on your instruction).
Google Calendar data: your calendar events and related details necessary to deliver the scheduling and calendar features you enable within Ultragent.

We request only the OAuth scopes required for the features you use, and you may decline or later revoke any of these permissions.

6.2 How We Use Google User Data

We use Google user data solely to provide and improve the user-facing features of Ultragent that you have requested — such as authenticating your account, displaying and acting on your Gmail and Calendar within the Platform, and enabling the workflows you configure. We do not use Google user data for any unrelated purpose.

6.3 Limited Use Commitments

Consistent with Google's Limited Use requirements, we affirm that we do not:

use Google user data to train, develop, or improve generalised or non-personalised artificial intelligence and/or machine learning models;
use Google user data for serving advertisements of any kind, including targeted, personalised, retargeted, or interest-based advertising;
sell Google user data, transfer it to data brokers or information resellers, or use it to determine credit-worthiness or for lending purposes;
transfer or disclose Google user data to third parties except (i) as necessary to provide or improve the user-facing features of Ultragent, (ii) to comply with applicable law, or (iii) as part of a merger, acquisition, or sale of assets with notice to you; and
allow humans to read Google user data unless: we first obtain your affirmative consent for specific messages; it is necessary for security purposes (such as investigating abuse); it is necessary to comply with applicable law; or the data has been aggregated and anonymised for internal operations.

6.4 Sharing of Google User Data

We share Google user data only with the limited set of service providers (such as our secure cloud hosting provider) strictly necessary to operate the Platform and deliver the features you use, under confidentiality and data-protection obligations. We do not otherwise share Google user data with third parties.

6.5 Retention and Deletion of Google User Data

We retain Google user data only for as long as needed to provide the features you use. You can revoke Ultragent's access to your Google data at any time via your Google Account permissions page or by disconnecting your Google Account within Ultragent. You may also request deletion of Google user data we hold by contacting privacy@bluebird.com.au. When you revoke access or request deletion, we will delete the associated Google user data from our active systems within a reasonable period, except where retention is required by law.

7. Overseas Disclosure

Some of our service providers and subprocessors are located outside Australia, including in the United States, the European Economic Area, and other jurisdictions. As a result, personal information we hold may be transferred to, stored in, or processed in countries other than Australia.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles that information consistently with the Australian Privacy Principles, including through contractual arrangements. We maintain an up-to-date list of the countries in which we store or process personal information, available upon written request to privacy@bluebird.com.au.

By using the Platform, you acknowledge and consent to the overseas transfer of your personal information as described in this section, in accordance with APP 8 of the Privacy Act.

8. Security of Personal Information

We take the security of personal information seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction. Our security measures include:

encryption of data in transit using TLS 1.2 or higher;
encryption of data at rest;
role-based access controls and least-privilege principles;
optional multi-factor authentication;
tamper-evident audit logging of security-relevant events;
regular security reviews; and
staff training on data privacy and security.

While we take these measures, no method of transmission or storage is completely secure. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

9. Use of Personal Information for AI and Machine Learning

Ultragent provides AI-assisted features. We do not use your personal information, your content, or any Google user data to train, develop, or improve generalised or non-personalised AI or machine learning models. Where AI features process your data to deliver a result you have requested, that processing is limited to providing the feature to you and is not used to build models for other users or third parties. Any use of third-party AI service providers to deliver these features is subject to contractual confidentiality and data-protection obligations and to the Limited Use commitments in Section 6.

10. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer. Our general retention periods are:

Account and profile data: retained for the duration of the Subscription plus seven (7) years following termination (for legal and compliance purposes).
Billing records: seven (7) years as required by Australian tax and accounting laws.
Support and communication records: three (3) years from the date of the last interaction.
Website analytics and log data: up to twenty-four (24) months on a rolling basis.
Google user data: retained only while needed to provide the features you use, and deleted upon revocation or deletion request (see Section 6.5).

When personal information is no longer required, we will securely delete or de-identify it.

11. Your Privacy Rights

11.1 Access

You have the right to request access to the personal information we hold about you. We will respond to access requests within thirty (30) days. We may charge a reasonable fee for providing access in certain circumstances.

11.2 Correction

If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request that we correct it. We will take reasonable steps to correct the information or, if we disagree, note your request on the record.

11.3 Deletion

You may request that we delete the personal information we hold about you. We will delete or de-identify it within a reasonable period, except where we are required or permitted to retain it by law (for example, billing records subject to tax and accounting obligations). To delete Google user data specifically, see Section 6.5. To make a deletion request, contact privacy@bluebird.com.au.

11.4 Opting Out of Marketing

You may opt out of receiving marketing communications from us at any time by clicking the unsubscribe link in any marketing email, updating your account preferences, or contacting us at privacy@bluebird.com.au. We will process opt-out requests promptly.

11.5 Complaints

If you believe we have handled your personal information in a way that breaches the Privacy Act or the APPs, you may lodge a complaint by contacting our Privacy Officer (see Section 14). We will acknowledge your complaint within five (5) business days and endeavour to resolve it within thirty (30) days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

12. Cookies and Tracking Technologies

Our website and Platform use cookies and similar tracking technologies to enhance your experience and collect usage information. For full details of the types of cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

13. Children's Privacy

The Ultragent Platform is intended for use by businesses and their representatives. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected personal information from a minor, we will take steps to delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated Policy on our website with a revised effective date and, where changes are material, notify you by email or in-platform notification. Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy.

15. Contact — Privacy Officer

For any questions, concerns, access requests, deletion requests, or complaints regarding this Privacy Policy or our handling of your personal information (including Google user data), please contact our Privacy Officer:

BluebirdAi Pty Ltd — Privacy Officer (operator of the Ultragent platform)
7 Gracemere Crescent, Glenorie NSW 2157, Australia
Email: privacy@bluebird.com.au
Website: www.ultragent.ai