Privacy Policy

1. STREAMTIME’S COMMITMENT TO PRIVACY

Streamtime Australia Pty Ltd ABN 52 654 231 777 and Streamtime Software Limited (Registration Number 06507751) (together, Streamtime) is committed to protecting your privacy and your security in accordance with applicable privacy and data protection laws, such as the Australian Privacy Principles under the Privacy Act 1988 (Cth) (Privacy Act), the General Data Protection Regulation (EU) 2016/679 (EU GDPR), the UK General Data Protection Regulation and the Data Protection Act 2018 (UK) (UK GDPR), the Privacy Act 2020(New Zealand), the Personal Information Protection and Electronic Documents Act (Canada) and, where applicable, the Act respecting the protection of personal information in the private sector (Quebec).

For the purposes of the EU GDPR and UK GDPR, Streamtime Australia Pty Ltd is the “data controller” in respect of your personal information.

We want to be as transparent as possible and never want to hide anything from those individuals who trust us with their important information. We take protecting your privacy very seriously.

We strongly encourage you to read this document, so that you understand and are comfortable with how we handle your personal information. If you have any questions about this document, or about Streamtime’s handling of your personal information, please contact us using the relevant contact details set out in section 17.

2. ABOUT THIS PRIVACY POLICY

This document sets out our policies for managing your personal information and is referred to as our Privacy Policy. It sets outs how we collect, store, process, use and disclose personal information.

In this Privacy Policy, "we", "us" and “our” refer to Streamtime, and "you" and “your” refers to any individual we collect personal information about. References to “personal information” includes “personal data” as that term is defined under the EU GDPR and the UK GDPR.

This Privacy Policy applies to all personal information collected by us, or submitted to us, whether offline or online, including personal information collected or submitted through streamtime.net and app.streamtime.net (together, our Websites), Streamtime Classic, our Streamtime iOS app, our in-product AI assistant and our public MCP server, our social media channel pages which we control, or any email or other messages that we may send to or receive from you (together with any and all future online and offline service offerings operated by or on behalf of us, our Services).

Other privacy terms and conditions may apply to you, such as:

• - any privacy related terms and conditions contained in our Streamtime Terms of Use (Terms) (as applicable to you) which are available here;
• - the collection notices and privacy statements which may be provided to you at the time your personal information is collected;
• - the privacy policies and terms and conditions of third party service providers we use (if applicable to you, as explained below in this Privacy Policy); and
• - the privacy policies and terms and conditions of third parties’ websites, accessible through links contained on our website (Linked Sites).

3. WHAT PERSONAL INFORMATION DO WE COLLECT AND HOLD ABOUT YOU?

When collecting personal information, we do so to ensure we’re providing you with the best service possible. The type of personal information that we collect or request from you, and how we collect or request this personal information will depend on who you are and how we are interacting with you.

Information you provide to us

We collect personal information when you input it into our Services or otherwise provide it directly to us. We may ask you to provide some or all of the following types of information:

• - Account and profile information: We collect information about you when you register for an account, create or modify your profile or set preferences. This may include your name, company you work for, job title and contact details (such as email and telephone number).
• - Content you provide through our Services: We collect information that you post, send, receive and share through our Services. Examples of content we collect include:some text
  • - project management information (such as contacts, jobs, invoices and expenses);
  • - information you submit to our support services;
  • - internal team information including team member cost and sell rates, email addresses, roles and telephone numbers;
  • - financial information including prices, mark-ups, profit and time spent; and
  • - information about your work schedule.
• - Conversations with our AI assistant: Where you use our in-product AI assistant, we collect the questions and instructions you enter and the responses generated, together with the Streamtime records retrieved in order to answer them. This content is free text and may contain any personal information you choose to enter, including information about your staff and your own clients.
• - Billing information: When you purchase our Services, we will ask you to provide your billing address and credit card information, which we collect via Secure SocketLayer (SSL) technology.
• - Communications through support channels: We collect personal information contained in any forms and inquiries you may submit to us for customer support. We may ask for any additional information to help us in resolving any issues or questions you may have.

Information we collect automatically when you use our Websites

We automatically collect certain information when you navigate and use our Websites, otherwise known as usage data. This includes information that your browser or device sends whenever you visit our Websites, which may include:

• - your Internet Protocol address and approximate general locations derived from such Internet Protocol address;
• - device and application data (type of operating system, mobile device or app id, browser version, browser type, language settings);
• - activity logs and recorded activity (such as the pages of our Websites you visit, the time and date of your visit and the time spent on those pages);
• - the name of the website from which you entered our Website as well as the name of the website to which you head when you leave our Website; and
• - cookies and pixels installed or utilised on your device.

Information we receive from other sources

We may receive information about you from other sources, including through third party services and organisations, to supplement information provided by you. This includes:

• - Other users: Other users of our Services may provide personal information about you via the Services (for example, when they create and invite you to be a team member on the Services, or when they provide details about you as a customer of their products or services).
• - Other integrated services: We collect information which you have set up to be received by our Services when you integrate our Services with other third party applications you use (such as, your Gmail or email account). For example, we may receive invoice documentation into our Services (held in your account) which may include personal information such as email address and company address.

What happens if you don’t provide your personal information?

You can always decline to give us any personal information we request, but that may mean we cannot provide you with some or all of the Services you have requested or we may not be able to do business with you effectively or meet the expectations of customers. If you have any concerns about the personal information we have requested, please let us know.

4. WHY DO WE COLLECT, USE AND HOLD YOUR PERSONAL INFORMATION?

Streamtime collects personal information that is reasonably necessary to carry out our business, to assess and manage our customers' needs, provide our Services to you, and comply with our legal and contractual obligations. We may also collect information to fulfil administrative functions associated with our products and services, for example billing, entering into contracts with you and/or third parties and managing customer and other business relationships.

The purposes for which Streamtime usually collects and uses personal information depends on the nature of your interaction with us, but may include:

• - To contact or identify you. We may use your account and profile information so that we can contact you or identify you.
• - To personalise your experience when using our Services. We want nothing more than to provide you with the best experience possible when using our Services. The information you provide helps us create your account and to better respond to your needs. We may use information about you to:some text
  • organise your initial set up and suggest reports, templates and information which may be useful to your business; and
  • provide you with a custom set of resources (including articles / videos) that are most relevant to your job role.
• - To improve customer service. The more informed we are, the quicker we can help you. Your information helps us to effectively respond to your customer service requests and support needs, including to respond to any billing queries, provide demos and provide support in respect of specific requests from you.
• - To invoice you and process payments. We use your information to invoice you for our Services, process payments and conduct other billing related activities.
• - For the performance of a contract. We may use your personal information in connection with the compliance and undertaking of a contract. This may include fulfilling administrative functions such as establishing you as a customer.
• - To maintain and improve our Services: We want Streamtime to be the best it can be. We may use your personal information to maintain and improve our Services and our products and services. We may also use information we receive via third party applications such as Intercom and Fullstory to help us to make informed decisions on product direction and improvements.
• - To market our Services: We may use personal information to send you direct marketing communications, newsletters, information and offers about our Services that we think may interest you and other marketing materials, as permitted under applicable privacy and spam laws. We may also send you periodic emails to advise you of product updates, training webinars and useful tips on using our Services. This may take the form of emails, SMS or other forms of communication. You may opt-out of receiving these communications by selecting the unsubscribe option on any communication from us.
• - To manage our relationship with you. We may use personal information to manage our relationship with you.
• - To create anonymous and aggregated information: Streamtime may use personal information and other information about you to create anonymised and aggregated information, such as de-identified demographic information, de-identified location information, information about the computer or device from which you access our Services or other analyses we create. Anonymised and aggregated information is used for a variety of functions, including the measurement of visitors’ interest in and use of various portions or features of the Services, to conduct benchmarking and to improve our Services and other products or services. Anonymised or aggregated information is not personal information, and we may use such information in a number of ways, including research, internal analysis, analytics and any other legally permissible purposes.
• - In connection with Business transfers: We may use personal information to evaluate or conduct a merger, divestiture, restructuring, reorganisation, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
• - For market research. We may use your personal information for market research purposes and to innovate our delivery of the Services.
• - To prevent or investigate possible wrongdoing. We may use your personal information to prevent or investigate possible wrongdoing in connection with the Services, or Websites or o ur products and services.
• - To analyse trends. We use all of your information, including usage data, to analyse trends among our visitors to our Websites to help improve our Websites.
• - For other purposes: We may use personal information for other purposes for which Streamtime has a legitimate interest, such as:some text
  • - responding to requests for information and other general inquiries about our Services;
  • - ensuring the safety and quality of our Services;
  • - responding to enquires, requests and complaints;
  • - protecting against fraud; and
  • - compliance with legal obligations.

Most of the personal information we hold reaches us from our customers, about their own staff and their own clients, rather than from those individuals directly.

Our agreements with our AI service providers prohibit them from training their models on your information, and for the models we use they do not retain the content of requests or responses. We do retain a copy of your conversation with our AI assistant for 30 days, as described in section 9.

We have a legitimate interest in using your information in the ways listed above. It is also fundamental to the nature of the products and services we provide. In some cases, it will be lawful for us to collect and use your personal information, for example where it is necessary as part of our, or a third party’s, statutory or public functions or because the law permits or requires us to.

4A. ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISION-MAKING

This section explains how personal information is used in the AI features of our Services, and the kinds of decisions those features are involved in.

Our AI features

Our AI assistant operates inside Streamtime. It can read the records in your Streamtime account and, where you ask it to, change them — for example by creating a job, updating time entries, or raising a quote or invoice. It runs on models supplied by Anthropic and operated for us by Amazon Web Services.

We also make available an MCP server, which lets you connect an AI assistant of your own choosing — such as Claude, ChatGPT or Microsoft Copilot — to your Streamtime account. If you use it, that assistant can read and change your Streamtime data on your behalf, and your data is sent to the provider of the assistant you have chosen. That provider is not our service provider, and we have no control over what it does with the data it receives. What happens to your data once it reaches that provider is governed by your agreement with them, not by this Privacy Policy.

The kinds of personal information used

The AI features may use any personal information held in your Streamtime account. In practice this includes names and contact details of your staff and of your own clients; time entries recording who worked on what and when; individual cost and charge-out rates; job, quote, invoice and expense records; work schedules and availability; and the free text of your conversations with the assistant.

Decisions made only by a computer program

Where you instruct our AI assistant to make a change, it proposes that change and asks you to confirm it before it is applied. Changes affecting an individual — such as an alteration to a person’s recorded time, their charge-out rate, or the work assigned to them — are therefore made with a person’s confirmation.

Where you connect an AI assistant of your own through our MCP server, we do not impose a confirmation step of our own. Whether that assistant asks you to approve a change before making it is determined by the assistant you have chosen. Changes made this way may be made by the operation of a computer program alone.

Decisions a computer program contributes to

Our AI features may also produce information that substantially and directly contributes to a decision made by a person — for example, by proposing which members of a team should be assigned to a job or a phase of work, based on their recorded availability, capacity and rates. A person reviews and approves any such proposal before it takes effect.

Your rights

If a decision described above significantly affects you, you may ask us for information about how it was reached, ask a person to review it, express your point of view, and contest it. Section 14 sets out the additional rights that apply if you are in the European Economic Area or the United Kingdom. Please contact us using the details in section 17.

5. HOW DO WE COLLECT AND USE YOUR PERSONAL INFORMATION?

Streamtime generally collects personal information directly from you. We may collect and update your personal information over the phone, by email, over the internet or social media, or in person. We may also collect personal information about you from other sources, for example:

• - third party suppliers and contractors who assist us to operate our business;
• - our employees, agents, contractors and suppliers;
• - your authorised representatives; and
• - other publicly available sources of information.

Recorded calls and meetings. We use note-taking services to record and transcribe meetings and calls, including calls with customers, and to produce notes and summaries from them. We use those recordings, transcripts and notes for our own record of what was discussed, for internal feedback and for training our team. Where a call is being recorded we will tell you at the start, and if you would prefer that it is not recorded, tell us and we will turn it off. The recording covers what is said on the call, and so may include anything you choose to tell us during it.

The services we use for this are named, with where they process information, at streamtime.net/legal/subprocessors. You can ask us for a copy of a recording of a call you took part in, or ask us to delete it, using the contact details at Section 17.

6. WHAT ARE OUR LEGAL BASES FOR PROCESSING PERSONAL INFORMATION?

For personal information which is subject to the UK GDPR or the EU GDPR, we must have a legal basis to process your personal information. We rely on the following legal bases to process your personal information:

• - where you have given your consent – if we ask for your consent, this will be communicated to you clearly and you will be required to actively “opt-in” and you can withdraw such consent at any time;
• - to comply with our legal and regulatory obligations;
• - for the performance of our contract with you (e.g. in order to provide you with the Services); and
• - for our legitimate interests or those of a third party – this is when we have a business or commercial reason to use your personal information, so long as it is not overridden by your own rights and interests. Our legitimate interests include the provision of the Services and the Websites, running our business and marketing relevant products and services to you.

Where we process special category personal information (as defined in the UK GDPR and the EU GDPR), we will also ensure we are permitted to do so under the UK GDPR and/or the EU GDPR, e.g.:

• we have your explicit consent;
• the processing is necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent; or
• the processing is necessary to establish, exercise or defend legal claims.

7. HOW DO WE INTERACT WITH YOU VIA THE INTERNET?

Generally, you control the amount and type of information you provide to us when using our Websites. You may visit our Websites without identifying yourself. If you identify yourself (for example, by providing your contact details in an enquiry), any personal information you provide to us will be managed in accordance with this Privacy Policy.

When you use our Websites, we may automatically collect certain computer information by the interaction of your mobile phone or web browser with our Website. Such information may not necessarily be personal information.

• - Cookies

Our Websites use “cookies” to identify the areas of our Websites that you have visited. A “cookie” is a small piece of data stored on your computer or mobile device by your web browser, which assists in managing customised settings of the Website and delivering content to personalise your browsing experience. You can use the settings in your browser to disable the use of cookies.

Google use cookies to serve ads on third party websites (including Google) based on someone’s past visits to our Website. Any data collected will be used in accordance with our own Privacy Policy and Google’s privacy policy. You can opt out of Google’s use of cookies by visiting Google’s Ad Settings.

• - Third Party Products and Services

We use third party products and services (such as third party tracking tools) to improve the performance and features of our Websites. These third party products and services are designed to collect information about your use of the Websites, but you are not identifiable from the information. We may use third party products and services including: Intercom (in-app customer support & email marketing analytics), Fullstory (user analytics), Mixpanel (website analytics), and Google AdWords (remarketing).

In particular:

• - we use third parties such as Intercom for in-app customer support and email marketing analytics and Fullstory for user analytics;
• - we use third parties such as Mixpanel for website analytics. You may opt out of third party cookies from Mixpanel on their respective websites; and
• - our Websites use the Google AdWords remarketing service to advertise on third party websites (including Google) to previous visitors to our Websites. This could be in the form of an advertisement on the Google search results page, or a site in the Google Display Network.

If you wish to opt out of any data collection, you can install browser analytics blocker plug-ins (eg. Ghostery). You can also opt out of Fullstory by navigating here.

• - Automatic information

As set out at Section 3, we automatically receive usage data when you navigate and use our Websites. Please see Section 3 for further information on the type of usage data we collect. Please see Section 4 for how we use your information, including usage data.

• - Third Party links

Our Websites may contain links to third-party websites. You should make your own enquiries as to the privacy policies of these parties. Streamtime is not responsible for the content or privacy practices of websites that are linked to our Website.

8. CAN YOU DEAL WITH US ANONYMOUSLY?

Most of the time, we will need your real name as it may not be practicable for us to deal with you anonymously or pseudonymously on an ongoing basis. For example, this includes when providing you with access to our Services. This means that if we do not collect your personal information, we may not be able to provide you with the products and/or services you have asked for.

In some circumstances however, Streamtime will provide individuals with the opportunity of remaining anonymous or using a pseudonym in their dealings with us where it is lawful and practicable. This includes, for example, when you make a general enquiry via our Websites.

9. HOW DO WE HOLD AND PROTECT YOUR PERSONAL INFORMATION?

Security of personal information

We are committed to protecting your personal information, and ensuring that we securely store any personal information we collect (and in accordance with applicable privacy laws).

We take all reasonable steps to ensure that any personal information we collect, use or disclose is accurate, complete, up-to-date and stored in a secure environment protected from misuse, interference and loss, and from unauthorised access, modification or disclosure.

The security of your personal information is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

We implement a variety of security measures to maintain the safety of your personal information, including:

• - all supplied sensitive/credit information is transmitted via Secure SocketLayer (SSL) technology;
• - credit card details stored on site are encrypted using 256bit AES encryption;
• - we use Stripe to process all credit card transactions and their privacy policy can be found here; and
• - your Streamtime database is hosted on Amazon’s AWS servers and you can view their privacy & security policies on their website.

If you are a Streamtime Classic customer, your system is FileMaker based (the FileMaker privacy policy can be found here) and you are responsible for managing your own FileMaker Server.

If Streamtime agrees to provide hosting services to you in connection with the use of Streamtime Classic then that Service is as per section 9 of our Terms. These server providers have their own privacy policies: Blue Pineapple (Amsterdam), Servers Australia (Melbourne), Amazon Web Services & Servers Australia (Sydney), Nimbus Hosting (London), Productive Computing (New York).

Storage of personal information

We store electronic records in secure databases, using trusted third party storage providers. We store your personal information in the United States of America. All of our production systems — including the database in which your Streamtime account is held — are located in the United States. Personal information in your Streamtime account is stored and processed in the United States at all times, and not only when our AI features are used. Some business records, such as billing and accounting records, are also held in Australia. When you use our AI assistant, the content of your conversation — including any Streamtime records retrieved in order to answer you — is processed in the United States, and a copy of that conversation is retained there for 30 days before deletion. The particular United States region in which an individual AI request is processed is selected by Amazon Web Services at the time of the request and may be any of its United States regions; it does not leave the United States. Where you connect your own AI assistant through our MCP server, that connection is also served from the United States. Conversations with our AI assistant are stored encrypted at rest using 256-bit AES encryption, are not publicly accessible, and do not themselves contain your name or any credential. Any service we use to monitor or diagnose the AI features also stores information in the United States. We also maintain physical security measures in relation to storage of our electronic records (such as through locks and security systems at our electronic data stores).

Using technical methods, we also maintain computer and network security. For example, we use firewalls (security measures for the internet) and other security systems such as user identifiers and passwords to control access to our computer systems.

Data retention

We will only keep the personal information we collect about you for as long as is necessary for the purposes set out in this Privacy Policy (see above section 4 above) or as required to comply with legal obligations to which we are subject.

We will not keep your personal information for longer than necessary. Different retention periods apply to different types of personal information. To determine the appropriate retention period for personal data, we consider, for example:

• - the amount, nature and sensitivity of such personal information;
• - the potential risk of harm from unauthorised use or disclosure of such personal information;
• - the purposes for which we collect, use and hold your personal information; and
• - any applicable legal retention requirements.

We take steps to destroy or de-identify information that we no longer require or as required by applicable law.  

Conversations with our AI assistant are retained for 30 days and are then deleted. We also keep a billing record for each AI request — the organisation, the user, a request reference, and the credits and amount charged, with no conversation content. We keep those records for as long as tax and corporations law requires us to keep financial records, currently seven years. Those records are also what lets us find and delete the conversations belonging to a particular account or person if you ask us to.

10. WHO WE DISCLOSE PERSONAL INFORMATION TO AND WHY?

We may share personal information with third parties:

• - for the reasons for which we collect, use and hold personal information (see section 4) which may include for direct marketing purposes where we have the necessary rights or consents or we are otherwise allowed to do so under applicable law;
• - for other purposes explained at the time we collect your personal information;
• where we are otherwise allowed or required to do so under applicable law;
• - to comply with our legal obligations;
• - to protect and defend the rights and property of Streamtime, our Services and Websites;
• - to prevent or investigate possible wrongdoing in connection with our Services and Websites; or
• - to protect the safety and wellbeing of end users or members of the public.

In particular, we may share personal information in the following situations set out below.

To other Service users

When you use our Services, we disclose certain information about you to other Service users.

• - Collaboration Features: When you create or interact with specific content (such as, when you create a new quote or post information regarding the products or services you are providing to your customers) through our Services, you may share information about yourself (such as, your name or your avatar), and you grant permission for others to view, disclose, edit, copy, and download that content based on the settings you or your administrator (if applicable) choose. Others users with appropriate permissions at your organisation may also be able to see your work schedule and any tasks assigned to you during any given week.

• - Managed Accounts and Administrators: If you register for or access our Services using an email address associated with your employer or organisation, or if you link that email address with your existing account, certain information about you, including your name, contact details, content, cost and sell rates in respect of your time and past account activity, may become accessible to that organisation’s administrator and other users sharing the same domain. If you are an administrator for a site or a group of users within our Services, we may disclose your contact information to current or past service users to facilitate service-related requests.

To contractors and other service providers (including integrated services)

We may disclose information to third parties we engage in order to provide our Services, including contractors and service providers used for data processing, data analysis, customer satisfaction surveys, information technology services and support, website maintenance/development, printing, archiving, mail-outs, and market research.

Third parties to whom we have disclosed your personal information may contact you directly to let you know they have collected your personal information and to give you information about their privacy policies.

For administration and management

We will also disclose personal information for a range of administrative, management and operational purposes. This includes:

• - administering billing and payments and debt recovery;
• - planning, managing, monitoring and evaluating our services;
• - quality improvement activities;
• - statistical analysis and reporting;
• - training staff, contractors and other workers;
• - risk management and management of legal liabilities and claims (for example, liaising with insurers and legal representatives);
• - responding to enquiries and complaints regarding our services;
• - verifying the identifies of our shareholders and managing our relationships with them;
• - obtaining advice from consultants and other professional advisers; and
• - responding to subpoenas and other legal orders and obligations.

With our affiliates

We may share your personal information with our affiliates, in which case, we will require those affiliates to comply with this Privacy Policy.

For business sale or corporate transaction

We may share your personal information with third parties, whether affiliated or unaffiliated, for the purpose of facilitating or implementing a transfer or sale of all or part of our assets or business or if we undergo any other kind of corporate restructure, acquisition or sale. In this context, your personal information may be transferred to another entity (or if such a sale, transfer, acquisition or corporate restructure is being contemplated by us).

With your consent

We may share your personal information for any other purpose with your consent.

With law enforcement agencies

We may share your personal information with regulatory bodies and law enforcement bodies to comply with our legislative or regulatory obligations (such as to assist with police investigations).

Where required to do so by applicable law

Under certain circumstances, we may be required to disclose your personal information if required to do so by applicable law or in response to valid requests by public authorities (e.g. a court or a government agency).

For other uses and disclosures

We may share your personal information for other purposes explained at the time of collection (such as in a specific privacy collection statement or notice) or otherwise as set out in this Privacy Policy.

To providers of AI services

We disclose personal information to Amazon Web Services, which hosts the AI models used by our in-product AI assistant on our behalf. The models are supplied by Anthropic. Both are contractually prohibited from training their models on your information, and for the models we use neither retains the content of a request or its response. Amazon Web Services may store inputs and outputs for up to 30 days for abuse detection in respect of certain other models; that does not apply to the models we use, and if we change models we will review this statement. The processing takes place in the United States. The providers we use to deliver the Services are listed at streamtime.net/legal/subprocessors, and we update that list when it changes.

To providers who help us operate and monitor the AI features

We may disclose personal information to service providers engaged to help us operate, monitor, diagnose and secure the AI features — for example services that record how a request was handled so that we can investigate faults and improve reliability. Any such provider processes that information in the United States, on our instructions and under confidentiality obligations, and is listed at streamtime.net/legal/subprocessors. We do not permit them to use it for any other purpose.

To an AI assistant you have chosen

If you connect your own AI assistant to Streamtime through our MCP server, the personal information in your Streamtime account is disclosed to the provider of that assistant, at your instruction and to the extent your connected assistant requests it. You choose that provider; we have no contractual relationship with them in respect of your data and no visibility of what they do with it. Before connecting an assistant, you should satisfy yourself that its provider’s terms are acceptable to you and to the people whose information is held in your account.

11. DO WE USE OR DISCLOSE YOUR PERSONAL INFORMATION FOR DIRECT MARKETING?

We have a legitimate interest in processing your personal information for promotional purposes and we may use or disclose your personal information for the purpose of informing you about our Services, upcoming promotions, or other opportunities that may interest you or as otherwise permitted under applicable privacy and spam laws.

This means under certain privacy or spam laws we do not usually need your consent to send you marketing communications. For example, under the EU GDPR and the UK GDPR, where we have a legitimate interest in using your personal information for marketing purposes, we do not need your consent to send you such communications. However, where consent is required under applicable privacy and spam laws, we will ask for this consent separately and clearly.

If you do not want to receive direct marketing communications, you can opt-out at any time by contacting us using the contact details below or using the opt-out functionality contained in the electronic message. If you opt-out of receiving marketing material from us, we may still contact you in relation to its ongoing relationship with you.

12. DO WE DISCLOSE YOUR PERSONAL INFORMATION OVERSEAS?

We collect personal information in Australia and any country in which users of our Service are located. As Streamtime operates internationally, it is the case that we share your Personal Information with overseas recipients located in the UK, Europe and the United States. These recipients include our Service Providers who may handle, process or store your Personal Information on our behalf.

We will only disclose your personal information outside the jurisdiction in which it was collected where we are permitted to do so under applicable privacy laws. Generally, this means we will take reasonable steps to ensure your personal information is treated securely and in accordance with applicable privacy laws.

Disclosures outside of the EEA / UK

Where we transfer your personal information outside of the European Economic Area (EEA) or the UK, we only do so if we are satisfied the transfer complies with the EU GDPR and/or the UK GDPR (as applicable) by ensuring that appropriate safeguards are in place, and enforceable rights and effective legal remedies are available for you.

If there is no adequacy decision, we may transfer your personal information to another country using legally-approved transfer mechanisms, such as the standard contractual clauses, to deliver the Service to you or otherwise perform our functions. It is sometimes necessary for us to share your personal information outside the UK/EEA, e.g.:

• - with our offices or other companies within our group located outside the EEA/UK; and
• - with Our Service Providers located outside the EEA/UK.

Under the EU GDPR and/or UK GDPR, we can only transfer your personal information to a country or international organisation outside the EEA/UK where:

• - the UK GDPR applies, the UK government or, where the EU GDPR applies, the European Commission, has decided the particular country or international organisation ensures an adequate level of protection of personal data (known as an ‘adequacy decision’);
• - there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for data subjects; or
• - a specific exception applies under data protection law.

These are explained below.

Adequacy decision

Where we rely on an adequacy decision, we will identify the decision relied on. Where no adequacy decision covers a transfer, we put in place standard contractual clauses or another approved transfer mechanism.

The list of countries that benefit from adequacy decisions will change from time to time. We will always seek to rely on an adequacy decision, where one exists.

Transfers with appropriate safeguards

Where there is no adequacy decision, we may transfer your personal information to another country or international organisation if we are satisfied the transfer complies with applicable data protection law, appropriate safeguards are in place, and enforceable rights and effective legal remedies are available for data subjects.

The safeguards will usually include using legally-approved standard data protection contract clauses.

Transfers under an exception

In the absence of an adequacy decision or appropriate safeguards, we may transfer personal information to a third country or international organisation where an exception applies under relevant data protection law, such as:

• - you have explicitly consented to the proposed transfer after having been informed of the possible risks;
• - the transfer is necessary for the performance of a contract between us or to take pre-contract measures at your request;
• - the transfer is necessary for a contract in your interests, between us and another person; or
• - the transfer is necessary to establish, exercise or defend legal claims.

We may also transfer information for the purpose of our compelling legitimate interests, so long as those interests are not overridden by your interests, rights and freedoms. Specific conditions apply to such transfers and we will provide relevant information if and when we seek to transfer your personal information on this ground.

In particular, personal information held in your Streamtime account is disclosed to recipients in the United States at all times, because our production systems are located there, as described in sections 4A and 9. If you connect your own AI assistant through our MCP server, your information may additionally be disclosed to that assistant’s provider, in whichever country it operates. This applies to every customer, wherever located. We do not route customers in the European Economic Area, the United Kingdom, Australia or New Zealand to processing in their own region.

Disclosures outside Australia and New Zealand

Where we disclose personal information collected in Australia to an overseas recipient, we take such steps as are reasonable in the circumstances to ensure that the recipient does not breach the Australian Privacy Principles in relation to that information. Where we disclose personal information collected in New Zealand outside New Zealand, we do so in accordance with information privacy principle 12 of the Privacy Act 2020.

13. HOW CAN YOU ACCESS OR SEEK CORRECTION OF YOUR PERSONAL INFORMATION?

You are entitled to access your personal information held by us on request. To request access to your personal information, please contact us using the contact details at Section 17 below.

We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up-to-date. You can help us to do this by letting us know if you notice errors or discrepancies in information we hold about you and letting us know if your personal details change.

However, if you consider any personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading you are entitled to request correction of the information. After receiving a request from you, we will take reasonable steps to correct your information.

We may decline your request to access or correct your personal information in certain circumstances in accordance with the applicable privacy laws. If we do refuse your request, we will provide you with a reason for our decision and, in the case of a request for correction, we will include a statement with your personal information about the requested correction.

14. WHAT ADDITIONAL RIGHTS DO YOU HAVE IF YOU ARE LOCATED IN THE EUROPEAN ECONOMIC AREA OR THE UNITED KINGDOM?

If the EU GDPR and/or UK GDPR applies to you, you have the following additional and specific rights in relation to your personal information (where applicable):

• - Access: you have the right to request a copy of any personal information we hold about you. Any request for access to or a copy of your personal information must in writing, and we will endeavour to respond within a reasonable period and in any event within one month (in compliance with the EU GDPR and UK GDPR).
• - Rectification: you have the right to the rectification of your personal information if you consider that it is inaccurate.
• - Deletion: you have the right to request that we delete personal information that we process about you, except we are not obliged to do so if we need to retain such personal information in order to comply with a legal obligation or to establish, exercise or defend legal claims. To delete your account, email us at help@streamtime.net with your request.
• - Restriction: you have the right to restrict the processing of your personal information where you believe such information to be inaccurate, our processing to be unlawful, or that we no longer need to process such information (but we are not able to delete the information due to a legal or other obligation, or because you do not wish for us to delete it).
• - Portability: you have the right to ask us to transfer a copy of your personal information to you or to another service provider or third party where technically feasible. Information can be exported from Streamtime in a structured, commonly used and machine-readable format. The categories of data available for export, the formats used, and any known technical limitations are described in the register we publish at streamtime.net/legal/data-formats.
• - Objection: you have the right to object to your personal information being processed for a particular purpose or to request that we stop using your information.
• - Complaint: if you are unhappy with our treatment of your personal information, and you have contacted us as set out at Section 17 below, you have the right to lodge a complaint with the local data protection authority.
• - Automated decisions: you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, other than in the limited circumstances permitted by law. Where such a decision is made, you have the right to be told about it, to obtain human intervention, to express your point of view and to contest the decision. Section 4A describes the AI features in our Services and the kinds of decisions they are involved in.
• - Withdrawing consent: if you have consented to our processing of your personal information, you have the right to withdraw, at any time, any consent that you have previously given to us for use of your personal information. In certain circumstances even if you withdraw your consent, we may still be able to process your personal information if required or permitted by law or for the purpose of exercising or defending our legal rights or meeting our legal and regulatory obligations.

To make a request to exercise any of these rights (where applicable) in relation to your personal information, please contact us using the contact details at Section 17 below.

14A. ADDITIONAL RIGHTS IN NEW ZEALAND AND CANADA

If you are in New Zealand, you have rights of access to and correction of your personal information under the Privacy Act 2020, and you may complain to the Office of the Privacy Commissioner.

If you are in Canada, you have rights of access and correction under the Personal Information Protection and Electronic Documents Act, and you may complain to the Office of the Privacy Commissioner of Canada. If you are in Quebec, you may in addition ask us to confirm whether a decision about you was made exclusively by automated processing and, if it was, to be told what personal information was used, the reasons for the decision and the principal factors that led to it, and you may ask us to correct that information.

15. WHAT SHOULD YOU DO IF YOU HAVE A COMPLAINT ABOUT THE HANDLING OF YOUR PERSONAL INFORMATION?

You may contact us at any time using the contact details at Section 17 below if you have any questions or concerns about this Privacy Policy or about the way in which your personal information has been handled.

You may make a privacy complaint about the way Streamtime handles your personal information using our complaint form at streamtime.net/privacy-complaint. The form is the best way to reach us: it goes to the people who handle privacy complaints, and you will receive an acknowledgement that we have received it. You can also make a complaint using the contact details at Section 17 below.

Streamtime will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. We will generally acknowledge the receipt of your complaint within a week.

If your complaint requires more detailed consideration or investigation, we will acknowledge receipt of your complaint within a week and endeavour to complete our investigation into your complaint promptly. We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved.

In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know.

If you are not satisfied with our response to your complaint, or you consider that we may have breached the Australian Privacy Principles or the Privacy Act, a complaint may be made to the Office of the Australian Information Commissioner. The Office of the Australian Information Commissioner can be contacted by telephone on 1300 363 992 or by using the contact details on the website: www.oaic.gov.au.

If you are located in the European Union, you may wish to take your complaint up with the local European Data Protection Authority. A list of the local authorities can be found on the European Data Protection Board’s website: https://edpb.europa.eu/about-edpb/about-edpb/members_en data protection.

If you are located in the UK, you may wish to take your complaint up with the Information Commissioner’s Office by telephone 0303 123 1113 or by using the contact details on the website: https://ico.org.uk/.

If you are located in New Zealand, you may complain to the Office of the Privacy Commissioner at privacy.org.nz. If you are located in Canada, you may complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d’accès à l’information.

16. HOW ARE CHANGES MADE TO THIS PRIVACY POLICY?

We may amend this Privacy Policy from time to time, with or without notice to you. However, where we make a material change to the Privacy Policy, we will provide notice to you (including by updating our Websites, notifying you via the Services and, where appropriate, notifying you directly via email), prior to the change becoming effective. We recommend that you visit our Websites regularly to keep up to date with any changes.

17. HOW CAN YOU CONTACT US?

You can contact us using the help link in the app or on the ‘contact us’ link on our Websites. Alternatively, you can contact us using the following details:

help@streamtime.net
‍Streamtime Australia Pty Ltd
Level 17, 383 Kent Street, Sydney
NSW 2000
Australia

‍