Privacy Policy · ultragent

BluebirdAi Pty Ltd | ABN: 85 696 013 788 | ACN: 696 013 788

BluebirdAi Pty Ltd ("BluebirdAi", "we", "us", "our") develops and operates the ultragent platform ("ultragent", "Platform"). We are committed to protecting the privacy of individuals whose personal information we handle. This Privacy Policy explains how we collect, use, disclose, and manage personal information — including any data we access from Google APIs and Microsoft Graph — in accordance with the Privacy Act 1988 (Cth) ("Privacy Act"), the Australian Privacy Principles ("APPs"), and the Google API Services User Data Policy.

This Policy applies to personal information we collect through the Platform, our website (www.ultragent.ai), and in the course of our business activities. By using the Platform or our website, you acknowledge that you have read and understood this Policy.

1. Who This Policy Applies To

This Policy applies to all individuals whose personal information we handle, including:

visitors to our website (www.ultragent.ai);
prospective customers and their representatives;
authorised users of the ultragent Platform; and
individuals whose personal information is contained in data submitted to the Platform by our customers.

ultragent is a business-to-business (B2B) service operated by BluebirdAi Pty Ltd. Where we process personal information on behalf of a customer as a data processor, our obligations are governed by the Data Processing Addendum in our Terms and Conditions. This Policy primarily addresses how we handle personal information in our capacity as a data controller.

2. What Personal Information We Collect

2.1 Information You Provide to Us

We may collect the following types of personal information directly from you:

Identity information: full name, job title, company name.
Contact information: email address, phone number, business address.
Sign-in information: the email address you sign in with and the sign-in method you use (an emailed magic link, Google, Microsoft, or your organisation's single sign-on). ultragent does not use passwords, so we do not collect or store one. If you turn on two-factor authentication, we store the authenticator secret and backup codes in protected form.
Billing information: payment card details (processed securely via our payment provider — we do not store full card numbers), billing address, and invoice history.
Communications: messages, support requests, survey responses, and feedback you send to us.

2.2 Information Collected Automatically

When you visit our website or use the Platform, we may automatically collect:

Usage data: pages visited, features used, actions taken, time and date of access.
Device and technical data: IP address, browser type and version, operating system, device identifiers, and time zone.
Log data: server logs including access times, error logs, and referring URLs.
Cookie and tracking data: as described in our Cookie Policy.

2.3 Information from Third Parties

We may receive personal information from:

our customers when they configure integrations or import data into the Platform;
identity and authentication providers (e.g. single sign-on services, including Google Sign-In and Microsoft sign-in);
data enrichment providers (People Data Labs) and web search (SerpAPI), when you or your workspace ask ultragent to enrich or research a contact or company — this can include business contact details, job titles, employment history and company information about people who are not ultragent users; and
publicly available sources and business directories, where relevant to our business relationship with you.

2.4 Google and Microsoft User Data

Where you choose to connect your Google Account or your Microsoft (Outlook / Microsoft 365) account to ultragent, we access a limited set of your mailbox, calendar, contacts and tasks data, strictly to provide the features you have requested. See Section 6 (Google User Data and API Services) and Section 7 (Microsoft User Data) for full details of what data we access, how we use it, how it is shared, retained, and deleted, and the limits we place on that use.

2.5 Sensitive Information

We do not intentionally collect sensitive information (as defined in the Privacy Act) such as health information, racial or ethnic origin, political opinions, or biometric data. Please do not submit sensitive information through the Platform unless strictly necessary. If you do submit sensitive information, you consent to its collection and handling in accordance with this Policy.

3. How We Collect Personal Information

We collect personal information:

directly from you when you register for an account, subscribe to a plan, complete a form, or contact us;
automatically through your use of the Platform and website, including via cookies and similar tracking technologies (see our Cookie Policy);
from connected third-party services that you authorise, including Google APIs (see Section 6) and Microsoft Graph (see Section 7);
from our customers in the course of providing the Services; and
from third-party sources, including identity providers and publicly available business information.

Where we collect personal information about you from a third party or via indirect means, we will take reasonable steps to notify you of the collection as required by APP 5, unless an exception applies.

4. Why We Collect Personal Information (Purposes)

We collect and hold personal information for the following purposes:

to provide, operate, maintain, and improve the ultragent Platform and Services;
to create and manage your account and verify your identity;
to process payments and manage billing;
to communicate with you about your account, the Services, updates, and technical notices;
to respond to your enquiries, feedback, and support requests;
to send marketing and promotional communications where you have consented or where permitted by applicable law (you may opt out at any time);
to conduct product analytics, usage research, and service improvement;
to comply with our legal and regulatory obligations;
to detect, prevent, and investigate fraud, security incidents, and other misuse of the Platform; and
to enforce our Terms and Conditions and other agreements.

We will only use your personal information for the purpose for which it was collected, or for a directly related secondary purpose, or with your consent. We do not use Google user data for any purpose other than providing or improving the user-facing features of ultragent (see Section 6).

5. Disclosure of Personal Information

5.1 When We Disclose

We may disclose personal information to:

our employees, contractors, and related bodies corporate who need access to provide the Services;
trusted third-party service providers (sub-processors) who assist us in operating the Platform, including those named in Section 5.3, subject to appropriate confidentiality and data-protection obligations;
professional advisers including lawyers, accountants, and auditors;
government agencies, law enforcement bodies, or courts where required or authorised by law; and
a buyer or successor entity in connection with a merger, acquisition, restructure, or sale of assets, subject to appropriate confidentiality protections.

5.2 We Do Not Sell Personal Information

We do not sell, rent, or trade personal information — including Google or Microsoft user data — to third parties for their own marketing purposes or for any other purpose.

5.3 Our Sub-processors

We use the following service providers to run ultragent. Each receives only the information it needs for the purpose listed, and each is bound by contractual confidentiality and data-protection obligations. Where a provider processes the content of your email, calendar, files, calls or CRM records, it does so only to deliver the feature you use, and not to train its own models.

Provider	What it does for ultragent	Information it may process
Amazon Web Services	Servers, file storage, outbound email delivery (Amazon SES) and access to AI models (Amazon Bedrock)	All Platform data we host, including email, calendar, CRM records and files; email addresses and message content we send
MongoDB	Database hosting	All Platform data we store
OpenAI	AI models for summaries, drafts, analysis, chat, transcription and search embeddings	Text of emails, calendar events, notes, files, call transcripts and CRM records sent with a request
Anthropic	AI models for analysis, drafting and chat (directly and through Amazon Bedrock)	Text of emails, calendar events, notes, files and CRM records sent with a request
Google (Gemini)	AI models for company and account research, analysis and drafting	Company and contact names and the text sent with a request
Perplexity	Web research for account and company intelligence	Company names, domains and research questions
Pinecone	Vector database that powers search across your emails, notes, messages and transcripts	Numerical representations (embeddings) of your content, plus short text excerpts and record identifiers
ElevenLabs	AI phone calls and voice	Call audio, transcripts, phone numbers and the call brief you approve
Twilio	Phone numbers and call routing for AI phone calls	Phone numbers and call metadata
LiveKit	Audio and video for ultragent meeting rooms	Meeting audio and video while the meeting is live, and participant names
Deepgram	Speech-to-text	Audio sent for transcription
People Data Labs	Contact and company enrichment	Names, email addresses, company domains and the enrichment results returned
SerpAPI	Web and location search for prospecting and research	Search queries, such as company names and locations
Composio	Connecting optional external services you choose to link (for example Slack or Notion)	The data you choose to send to or read from those services
Cloudinary	Image hosting	Images you upload, such as profile pictures
Stripe	Payments and billing	Name, email, billing address, payment card details (held by Stripe) and invoice history
Sentry	Error monitoring	Technical error reports, which can include your user ID, IP address and the page or request that failed
Cloudflare (Turnstile)	Bot protection on sign-in and contact forms	IP address and browser signals
Microsoft Clarity	Website analytics (public website only, not inside the app)	Usage and device data as described in our Cookie Policy
Google Analytics	Website analytics and sign-up measurement	Usage and device data, and a sign-up event as described in our Cookie Policy
Meta	Advertising measurement (public website only, plus a server-side sign-up event)	Usage data and a sign-up event as described in our Cookie Policy
Spotify	Advertising measurement (public website and sign-up pages, plus a one-time sign-up event for new accounts)	Usage and device data, and a sign-up event as described in our Cookie Policy

We will update this list when we add or replace a sub-processor. To ask about a specific provider or the countries where it processes data, contact privacy@bluebird.com.au.

6. Google User Data and API Services

This section describes how ultragent accesses, uses, stores, shares, and protects data obtained through Google APIs. ultragent's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6.1 What Google User Data We Access

When you connect your Google Account, and only after you grant consent on Google's OAuth consent screen, we may access:

Basic profile and email (OpenID / userinfo): your name, email address, and profile picture, used to create and authenticate your ultragent account.
Gmail data: the messages, metadata, and related content necessary to deliver the email-related features you enable within ultragent (for example, reading, organising, drafting, or sending messages on your instruction).
Google Calendar data: your calendar events and related details necessary to deliver the scheduling and calendar features you enable within ultragent.
Google Contacts and Tasks data (read-only): your contacts and tasks, used to keep the matching records in ultragent current.

We request only the OAuth scopes required for the features you use, and you may decline or later revoke any of these permissions.

6.2 How We Use Google User Data

We use Google user data solely to provide and improve the user-facing features of ultragent that you have requested — such as authenticating your account, displaying and acting on your Gmail and Calendar within the Platform, and enabling the workflows you configure. We do not use Google user data for any unrelated purpose.

6.3 Limited Use Commitments

Consistent with Google's Limited Use requirements, we affirm that we do not:

use Google user data to train, develop, or improve generalised or non-personalised artificial intelligence and/or machine learning models;
use Google user data for serving advertisements of any kind, including targeted, personalised, retargeted, or interest-based advertising;
sell Google user data, transfer it to data brokers or information resellers, or use it to determine credit-worthiness or for lending purposes;
transfer or disclose Google user data to third parties except (i) as necessary to provide or improve the user-facing features of ultragent, (ii) to comply with applicable law, or (iii) as part of a merger, acquisition, or sale of assets with notice to you; and
allow humans to read Google user data unless: we first obtain your affirmative consent for specific messages; it is necessary for security purposes (such as investigating abuse); it is necessary to comply with applicable law; or the data has been aggregated and anonymised for internal operations.

6.4 Sharing of Google User Data

We share Google user data only with the sub-processors listed in Section 5.3 that are strictly necessary to deliver the features you use — our cloud hosting and database providers, and the AI model and search providers that process message and calendar content to produce the summaries, drafts, analysis and search results you request — under confidentiality and data-protection obligations that are consistent with the Limited Use requirements. We do not otherwise share Google user data with third parties.

6.5 Retention and Deletion of Google User Data

We retain Google user data only for as long as needed to provide the features you use. You can revoke ultragent's access to your Google data at any time via your Google Account permissions page or by disconnecting your Google Account within ultragent. You may also request deletion of Google user data we hold by contacting privacy@bluebird.com.au. When you revoke access or request deletion, we will delete the associated Google user data from our active systems within a reasonable period, except where retention is required by law.

7. Microsoft User Data

This section describes how ultragent accesses, uses, stores, shares, and protects data obtained from your Microsoft account (Outlook, Microsoft 365) through Microsoft Graph. We apply the same commitments to Microsoft user data that Section 6 sets out for Google user data.

7.1 What Microsoft User Data We Access

When you connect your Microsoft account, and only after you grant consent on Microsoft's consent screen, we may access:

Basic profile (User.Read): your name and email address, used to create and authenticate your ultragent account.
Outlook mail: the messages, metadata, and related content necessary to deliver the email features you enable (for example, reading, organising, drafting, or sending messages on your instruction).
Outlook calendar: your calendar events and related details necessary to deliver the scheduling and calendar features you enable, including adding meetings you approve to your calendar.
Outlook contacts and Microsoft To Do tasks (read-only): your contacts and tasks, used to keep the matching records in ultragent current.

We request only the permissions required for the features you use, and you may decline or later revoke any of them.

7.2 How We Use Microsoft User Data

We use Microsoft user data solely to provide and improve the user-facing features of ultragent that you have requested. We do not use it to train, develop, or improve generalised AI or machine learning models; to serve advertising; or for any unrelated purpose. We do not sell it, and people at BluebirdAi do not read it except with your consent, for security purposes, to comply with law, or in aggregated and anonymised form.

7.3 Sharing of Microsoft User Data

We share Microsoft user data only with the sub-processors listed in Section 5.3 that are strictly necessary to deliver the features you use — our cloud hosting and database providers, and the AI model and search providers that process message and calendar content to produce the summaries, drafts, analysis and search results you request — under confidentiality and data-protection obligations. We do not otherwise share Microsoft user data with third parties.

7.4 Retention and Deletion of Microsoft User Data

We retain Microsoft user data only for as long as needed to provide the features you use. You can revoke ultragent's access at any time from your Microsoft account's app permissions page (or, for a work account, through your administrator), or by disconnecting the account within ultragent. You may also request deletion by contacting privacy@bluebird.com.au. When you revoke access or request deletion, we will delete the associated Microsoft user data from our active systems within a reasonable period, except where retention is required by law.

8. Overseas Disclosure

Some of our service providers and subprocessors are located outside Australia, including in the United States, the European Economic Area, and other jurisdictions. As a result, personal information we hold may be transferred to, stored in, or processed in countries other than Australia.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles that information consistently with the Australian Privacy Principles, including through contractual arrangements. We maintain an up-to-date list of the countries in which we store or process personal information, available upon written request to privacy@bluebird.com.au.

By using the Platform, you acknowledge and consent to the overseas transfer of your personal information as described in this section, in accordance with APP 8 of the Privacy Act.

9. Security of Personal Information

We take the security of personal information seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction. Our security measures include:

encryption of data in transit using TLS 1.2 or higher;
encryption of data at rest;
role-based access controls and least-privilege principles;
optional multi-factor authentication;
tamper-evident audit logging of security-relevant events;
regular security reviews; and
staff training on data privacy and security.

While we take these measures, no method of transmission or storage is completely secure. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

10. Use of Personal Information for AI and Machine Learning

ultragent provides AI-assisted features. We do not use your personal information, your content, or any Google user data to train, develop, or improve generalised or non-personalised AI or machine learning models. Where AI features process your data to deliver a result you have requested, that processing is limited to providing the feature to you and is not used to build models for other users or third parties. Any use of third-party AI service providers (listed in Section 5.3) to deliver these features is subject to contractual confidentiality and data-protection obligations and to the commitments in Sections 6 and 7.

11. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer. Our general retention periods are:

Account and profile data: retained for the duration of the Subscription plus seven (7) years following termination (for legal and compliance purposes).
Billing records: seven (7) years as required by Australian tax and accounting laws.
Support and communication records: three (3) years from the date of the last interaction.
Website analytics and log data: up to twenty-four (24) months on a rolling basis.
Google and Microsoft user data: retained only while needed to provide the features you use, and deleted upon revocation or deletion request (see Sections 6.5 and 7.4).

When personal information is no longer required, we will securely delete or de-identify it.

12. Your Privacy Rights

12.1 Access

You have the right to request access to the personal information we hold about you. We will respond to access requests within thirty (30) days. We may charge a reasonable fee for providing access in certain circumstances.

12.2 Correction

If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request that we correct it. We will take reasonable steps to correct the information or, if we disagree, note your request on the record.

12.3 Deletion

You may request that we delete the personal information we hold about you. We will delete or de-identify it within a reasonable period, except where we are required or permitted to retain it by law (for example, billing records subject to tax and accounting obligations). To delete Google or Microsoft user data specifically, see Sections 6.5 and 7.4. To make a deletion request, contact privacy@bluebird.com.au.

12.4 Opting Out of Marketing

You may opt out of receiving marketing communications from us at any time by clicking the unsubscribe link in any marketing email, updating your account preferences, or contacting us at privacy@bluebird.com.au. We will process opt-out requests promptly.

12.5 Complaints

If you believe we have handled your personal information in a way that breaches the Privacy Act or the APPs, you may lodge a complaint by contacting our Privacy Officer (see Section 16). We will acknowledge your complaint within five (5) business days and endeavour to resolve it within thirty (30) days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

13. Cookies and Tracking Technologies

Our website and Platform use cookies and similar tracking technologies to enhance your experience and collect usage information. For full details of the types of cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

14. Children's Privacy

The ultragent Platform is intended for use by businesses and their representatives. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected personal information from a minor, we will take steps to delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated Policy on our website with a revised effective date and, where changes are material, notify you by email or in-platform notification. Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy.

16. Contact — Privacy Officer

For any questions, concerns, access requests, deletion requests, or complaints regarding this Privacy Policy or our handling of your personal information (including Google and Microsoft user data), please contact our Privacy Officer:

BluebirdAi Pty Ltd — Privacy Officer (operator of the ultragent platform)
7 Gracemere Crescent, Glenorie NSW 2157, Australia
Email: privacy@bluebird.com.au
Website: www.ultragent.ai