INTRODUCTION

This document sets out the privacy policy of Alcova Software Pty Ltd ACN 684 877 101 and our related entities such as Alcova AI Pty Ltd ACN 676 351 349, referred to in this privacy policy as ‘we’, ‘us’, or ‘our’.

We take our privacy obligations seriously and we’ve created this privacy policy to explain how we store, maintain, use and disclose personal information.

By providing personal information to us, you consent to our storage, maintenance, use and disclosing of personal information in accordance with this privacy policy.

We may change this privacy policy from time to time by posting an updated copy on our website and we encourage you to check our website regularly to ensure that you are aware of our most current privacy policy.

TYPES OF PERSONAL INFORMATION WE COLLECT

The personal information we collect may include the following:

(a) name;

(b) mailing or street address;

(c) email address;

(d) telephone number and other contact details;

(e) date of birth and age;

(f) credit card or other payment information;

(g) information about your business or personal circumstances, including financial information relevant to the provision of financial advice;

(h) professional qualifications, licensing details, and regulatory identifiers (such as AFSL or adviser numbers);

(i) Google account information, including your name, email address, profile picture, calendar data, contacts, and email content, where you choose to connect your Google account to our services;

(j) information in connection with client surveys, questionnaires, and promotions;

(k) your device identity and type, IP address, geo-location information, page view statistics, and standard web log information;

(l) authentication and account credentials;

(m) information about third parties, such as your clients' personal and financial details, where you input these into our platform; and

(n) any other information provided by you to us via our website, our platform, or otherwise required by us or provided by you.

HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information either directly from you, or from third parties such as our clients, including where you:

(a) contact us through our website;

(b) receive goods or services from us;

(c) submit any of our online sign up or booking forms, including if you book in a consultation;

(d) communicate with us via email, telephone, SMS, social applications (such as LinkedIn) or otherwise;

(e) interact with our website, social applications, services, content and advertising; and

(f) invest in our business or enquire as to a potential purchase in our business.

We may also collect personal information from you when you use or access our website or our social media pages. This may be done through use of web analytics tools, ‘cookies’ or other similar tracking technologies that allow us to track and analyse your website usage. Cookies are small files that store information on your computer, mobile phone or other device and enable and allow the creator of the cookie to identify when you visit different websites. If you do not wish information to be stored as a cookie, you can disable cookies in your web browser.

We may use Google Analytics to collect and process data, including when you use third party websites or apps. To find out more see How Google uses data when you use our partners’ sites or apps.

USE OF YOUR PERSONAL INFORMATION

We collect and use personal information for the following purposes:

(a) to provide goods, services or information to you, including the provision of the Alcova software;

(b) for record keeping and administrative purposes;

(c) to provide information about you to our contractors, employees, consultants, agents or other third parties for the purpose of providing goods or services to you;

(d) to improve and optimise our service offering and customer experience;

(e) to comply with our legal obligations, resolve disputes or enforce our agreements with third parties;

(f) to send you marketing and promotional messages and other information that may be of interest to you and for the purpose of direct marketing (in accordance with the Spam Act). In this regard, we may use email, SMS, social media or mail to send you direct marketing communications. You can opt out of receiving marketing materials from us by using the opt-out facility provided (e.g. an unsubscribe link);

(g) to send you administrative messages, reminders, notices, updates, security alerts, and other information requested by you; and

(h) to consider an application of employment from you.

We may disclose your personal information to cloud-providers, contractors and other third parties located inside or outside of Australia, such as SalesForce CRM software. If we do so, we will take reasonable steps to ensure that any overseas recipient deals with such personal information in a manner consistent with how we deal with it.

GOOGLE USER DATA

Our application accesses certain Google user data through Google APIs to provide our services. This section describes how we access, use, store, and share Google user data.

Data We Access: When you connect your Google account, we may access the following data:

Google account profile information (name, email address, profile picture)

Google Calendar data (to schedule and manage appointments)

Gmail data (to send and receive communications on your behalf)

Google Contacts (to manage client contact information)

(Adjust the above list to match the specific Google API scopes your app requests.)

How We Use Google Data: We use Google user data solely to provide and improve the Alcova software services you have requested. We do not use Google user data for serving advertisements or for any purpose unrelated to the core functionality of our application.

Storage & Retention: Google user data is stored securely using industry-standard encryption in transit and at rest. We retain Google user data only for as long as necessary to provide our services to you, or as required by law. You may revoke our access at any time through your Google Account permissions at myaccount.google.com/permissions.

Sharing of Google Data: We do not sell Google user data. We may share Google user data only:

(a) with service providers who assist us in delivering our services, subject to appropriate confidentiality obligations;

(b) as required by law, regulation, or legal process; or

(c) with your explicit consent.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

SECURITY

We maintain a comprehensive information security program designed to protect your personal information from unauthorised access, use, disclosure, alteration, or destruction. Our security program includes:

(a) Organisational controls: We are SOC 2 Type II certified, meaning our security controls are independently audited and verified for operational effectiveness over time. We maintain formal security policies, conduct regular risk assessments, and provide security awareness training to all personnel.

(b) Technical controls: We employ industry-standard encryption for data in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, multi-factor authentication, continuous monitoring, and automated vulnerability scanning across our infrastructure.

(c) Operational controls: We maintain incident response procedures, conduct regular security reviews, and apply timely patches and updates to our systems. Access to personal information is restricted to authorised personnel on a need-to-know basis.

(d) Third-party management: We assess the security practices of our service providers and require appropriate contractual safeguards before sharing any personal information.

While we implement these measures to maintain a high standard of security, no method of electronic transmission or storage is completely secure. We continually review and improve our security practices to address emerging threats.

LINKS

Our website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites and we suggest you review the privacy policies of those websites before using them.

REQUESTING ACCESS OR CORRECTING YOUR PERSONAL INFORMATION

If you wish to request access to the personal information we hold about you, please contact us using the contact details set out below including your name and contact details. We may need to verify your identity before providing you with your personal information. In some cases, we may be unable to provide you with access to all your personal information and where this occurs, we will explain why. We will deal with all requests for access to personal information within a reasonable timeframe.

If you think that any personal information we hold about you is inaccurate, please contact us using the contact details set out below and we will take reasonable steps to ensure that it is corrected.

COMPLAINTS

If you wish to complain about how we handle your personal information held by us, please contact us using the details set out below including your name and contact details. We will investigate your complaint promptly and respond to you within a reasonable timeframe.

CONTACT US

For further information about our privacy policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below:

Email: care@alcova.ai

Our privacy policy was last updated on 16 March 2026