Privacy Policy — Ultragent

BluebirdAi Pty Ltd | ABN: 85 696 013 788 | ACN: 696 013 788

BluebirdAi Pty Ltd ("BluebirdAi", "we", "us", "our") operates the Ultragent platform ("Platform"). We are committed to protecting the privacy of individuals whose personal information we handle. This Privacy Policy explains how we collect, use, disclose, and manage personal information in accordance with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs").

This Policy applies to personal information we collect through the Platform, our website (www.ultragent.ai), and in the course of our business activities. By using the Platform or our website, you acknowledge that you have read and understood this Policy.

1. Who This Policy Applies To

This Policy applies to all individuals whose personal information we handle, including:

visitors to our website (www.ultragent.ai);
prospective customers and their representatives;
authorised users of the Ultragent Platform; and
individuals whose personal information is contained in data submitted to the Platform by our customers.

Ultragent is a business-to-business (B2B) service. Where we process personal information on behalf of a customer as a data processor, our obligations are governed by the Data Processing Addendum in our Terms and Conditions. This Policy primarily addresses how we handle personal information in our capacity as a data controller.

2. What Personal Information We Collect

2.1 Information You Provide to Us

We may collect the following types of personal information directly from you:

Identity information: full name, job title, company name.
Contact information: email address, phone number, business address.
Account credentials: username and encrypted password.
Billing information: payment card details (processed securely via our payment provider — we do not store full card numbers), billing address, and invoice history.
Communications: messages, support requests, survey responses, and feedback you send to us.

2.2 Information Collected Automatically

When you visit our website or use the Platform, we may automatically collect:

Usage data: pages visited, features used, actions taken, time and date of access.
Device and technical data: IP address, browser type and version, operating system, device identifiers, and time zone.
Log data: server logs including access times, error logs, and referring URLs.
Cookie and tracking data: as described in our Cookie Policy.

2.3 Information from Third Parties

We may receive personal information from:

our customers when they configure integrations or import data into the Platform;
identity and authentication providers (e.g. single sign-on services); and
publicly available sources and business directories, where relevant to our business relationship with you.

2.4 Sensitive Information

We do not intentionally collect sensitive information (as defined in the Privacy Act) such as health information, racial or ethnic origin, political opinions, or biometric data. Please do not submit sensitive information through the Platform unless strictly necessary. If you do submit sensitive information, you consent to its collection and handling in accordance with this Policy.

3. How We Collect Personal Information

We collect personal information:

directly from you when you register for an account, subscribe to a plan, complete a form, or contact us;
automatically through your use of the Platform and website, including via cookies and similar tracking technologies (see our Cookie Policy);
from our customers in the course of providing the Services; and
from third-party sources, including identity providers and publicly available business information.

Where we collect personal information about you from a third party or via indirect means, we will take reasonable steps to notify you of the collection as required by APP 5, unless an exception applies.

4. Why We Collect Personal Information (Purposes)

We collect and hold personal information for the following purposes:

to provide, operate, maintain, and improve the Ultragent Platform and Services;
to create and manage your account and verify your identity;
to process payments and manage billing;
to communicate with you about your account, the Services, updates, and technical notices;
to respond to your enquiries, feedback, and support requests;
to send marketing and promotional communications where you have consented or where permitted by applicable law (you may opt out at any time);
to conduct product analytics, usage research, and service improvement;
to comply with our legal and regulatory obligations;
to detect, prevent, and investigate fraud, security incidents, and other misuse of the Platform; and
to enforce our Terms and Conditions and other agreements.

We will only use your personal information for the purpose for which it was collected, or for a directly related secondary purpose, or with your consent.

5. Disclosure of Personal Information

5.1 When We Disclose

We may disclose personal information to:

our employees, contractors, and related bodies corporate who need access to provide the Services;
trusted third-party service providers who assist us in operating the Platform (including cloud hosting, payment processing, analytics, customer support, and email delivery providers), subject to appropriate confidentiality obligations;
professional advisers including lawyers, accountants, and auditors;
government agencies, law enforcement bodies, or courts where required or authorised by law; and
a buyer or successor entity in connection with a merger, acquisition, restructure, or sale of assets, subject to appropriate confidentiality protections.

5.2 We Do Not Sell Personal Information

We do not sell, rent, or trade personal information to third parties for their own marketing purposes.

6. Overseas Disclosure

Some of our service providers and subprocessors are located outside Australia, including in the United States, the European Economic Area, and other jurisdictions. As a result, personal information we hold may be transferred to, stored in, or processed in countries other than Australia.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles that information consistently with the Australian Privacy Principles, including through contractual arrangements. We maintain an up-to-date list of the countries in which we store or process personal information, available upon written request to privacy@bluebird.com.au.

By using the Platform, you acknowledge and consent to the overseas transfer of your personal information as described in this section, in accordance with APP 8 of the Privacy Act.

7. Security of Personal Information

We take the security of personal information seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction. Our security measures include:

encryption of data in transit using TLS 1.2 or higher;
encryption of data at rest;
role-based access controls and least-privilege principles;
multi-factor authentication for administrative access;
regular security assessments and penetration testing; and
staff training on data privacy and security.

While we take these measures, no method of transmission or storage is completely secure. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

8. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer. Our general retention periods are:

Account and profile data: retained for the duration of the Subscription plus seven (7) years following termination (for legal and compliance purposes).
Billing records: seven (7) years as required by Australian tax and accounting laws.
Support and communication records: three (3) years from the date of the last interaction.
Website analytics and log data: up to twenty-four (24) months on a rolling basis.

When personal information is no longer required, we will securely delete or de-identify it.

9. Your Privacy Rights

9.1 Access

You have the right to request access to the personal information we hold about you. We will respond to access requests within thirty (30) days. We may charge a reasonable fee for providing access in certain circumstances.

9.2 Correction

If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request that we correct it. We will take reasonable steps to correct the information or, if we disagree, note your request on the record.

9.3 Opting Out of Marketing

You may opt out of receiving marketing communications from us at any time by clicking the unsubscribe link in any marketing email, updating your account preferences, or contacting us at privacy@bluebird.com.au. We will process opt-out requests promptly.

9.4 Complaints

If you believe we have handled your personal information in a way that breaches the Privacy Act or the APPs, you may lodge a complaint by contacting our Privacy Officer (see Section 13). We will acknowledge your complaint within five (5) business days and endeavour to resolve it within thirty (30) days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

10. Cookies and Tracking Technologies

Our website and Platform use cookies and similar tracking technologies to enhance your experience and collect usage information. For full details of the types of cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

11. Children's Privacy

The Ultragent Platform is intended for use by businesses and their representatives. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected personal information from a minor, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated Policy on our website with a revised effective date and, where changes are material, notify you by email or in-platform notification. Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy.

13. Contact — Privacy Officer

For any questions, concerns, access requests, or complaints regarding this Privacy Policy or our handling of your personal information, please contact our Privacy Officer:

BluebirdAi Pty Ltd — Privacy Officer
7 Gracemere Crescent, Glenorie NSW 2157, Australia
Email: privacy@bluebird.com.au
Website: www.ultragent.ai