Privacy Policy

1. About This Policy

VidPilot (ABN 99 329 949 174) ("VidPilot", "we", "us", "our") is an Australian-based AI software company headquartered at 81 Carrington Street, Adelaide, South Australia 5000. VidPilot operates the website at vidpilot.com.au and provides an autonomous AI marketing agent platform to business clients.

VidPilot is committed to handling personal information responsibly and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy explains how VidPilot collects, uses, discloses, stores, and manages personal information in connection with the vidpilot.com.au website and the VidPilot platform.

This policy should be read alongside any separate service agreement or terms of use entered into between VidPilot and a pilot client.

2. Scope and Application

2.1 Who This Policy Covers

This policy applies to:

• Website visitors who access vidpilot.com.au, including individuals who submit a waitlist or demo request form;
• Prospective clients whose personal information is collected during pre-sales or pilot enquiry processes;
• Pilot clients and their authorised representatives, including founders, marketing leads, and other business decision-makers, whose personal information is collected and processed during onboarding and ongoing service delivery; and
• Any other individual whose personal information VidPilot handles in connection with the above activities.

2.2 B2B Context

VidPilot's platform is a business-to-business (B2B) SaaS product. VidPilot's contractual customers are businesses, not individual consumers. However, VidPilot necessarily collects and processes personal information about the individuals who represent those businesses. This policy governs VidPilot's handling of that personal information.

2.3 What This Policy Does Not Cover

This policy does not govern:

• The internal privacy or data practices of client businesses in their own right; or
• The privacy practices of third-party platforms such as YouTube, LinkedIn, Instagram, or X to which client content is published. Those platforms operate under their own privacy policies.

3. Categories of Personal Information Collected

VidPilot collects personal information in two distinct operational contexts: website interactions and client service delivery.

3.1 Website Visitors and Waitlist / Demo Request Forms

When an individual submits a waitlist or demo request form on vidpilot.com.au, VidPilot collects:

• Full name;
• Company name; and
• Work email address.

The form is protected by Google reCAPTCHA v2. As part of that bot-detection process, Google collects browser metadata, behavioural signals, and device information directly from the individual's device. This data is processed by Google under Google's own Privacy Policy. VidPilot does not receive or store this reCAPTCHA-generated data.

3.2 Client Onboarding and Service Delivery

When a business is onboarded as a VidPilot pilot client, VidPilot collects and processes the following categories of information to deliver the platform service:

• Contact and identity information about authorised client representatives, including names and work contact details;
• Business context information, including website content, business descriptions, product and service information, market positioning documents, and company background materials;
• Brand assets, including logos, visual style guides, colour palettes, and design materials;
• Audience and campaign data, including target demographic profiles, historical marketing campaign materials, and past content performance data;
• Tone of voice documentation and brand communication guidelines;
• Voice samples and voice profile data, where a client representative or authorised person provides voice recordings for AI voice synthesis through ElevenLabs. This data constitutes biometric information;
• Avatar or likeness materials, where a client or authorised representative provides facial imagery or video footage for use in AI-generated avatar videos through HeyGen. This data may also constitute biometric information;
• CRM data, at the Scale service tier only, where the client opts to integrate CRM-aware context into the VidPilot agent. See Section 3.4 for important information about CRM data; and
• Content performance data, including views, engagement metrics, and publishing analytics collected by the VidPilot agent on behalf of the client after content is published.

3.3 Sensitive and Biometric Information

Clients are responsible for obtaining any necessary consents from individuals whose voice or likeness is provided to VidPilot for processing.

3.4 CRM Data and Third-Party Personal Information (Scale Tier)

At the Scale service tier, clients may integrate CRM data with the VidPilot agent to enable CRM-aware content context. CRM data typically contains personal information about the client's own customers and contacts, being individuals who have no direct relationship with VidPilot.

Where a client provides CRM data to VidPilot:

• VidPilot acts as a data processor in relation to that third-party personal information, processing it solely on the client's instruction and for the purpose of delivering the platform service;
• The client, as the data controller, is responsible for ensuring they have a lawful basis to share their customers' personal information with VidPilot and for complying with their own privacy obligations in relation to that data;
• VidPilot will handle CRM data in accordance with this policy and any applicable data processing agreement entered into with the Scale tier client; and
• VidPilot will not use CRM data for any purpose other than delivering the contracted service to that specific client.

4. How VidPilot Collects Personal Information

VidPilot collects personal information:

• Directly from individuals, through the waitlist and demo request form on vidpilot.com.au and through client onboarding communications;
• From client-provided materials, including documents, assets, and data files uploaded or shared during onboarding and ongoing service delivery;
• Through automated platform activity, including the VidPilot AI agent's research and performance tracking functions operating on behalf of clients; and
• From third-party sources, including publicly available website content scraped from a client's own business website as part of the onboarding and brand memory build process.

Where practicable, VidPilot collects personal information directly from the individual concerned.

5. Purposes of Collection, Use, and Disclosure

5.1 Website Visitor and Waitlist Data

VidPilot collects and uses personal information submitted through the waitlist and demo request form for the following purposes:

• To respond to the individual's enquiry about the VidPilot pilot program;
• To contact the individual regarding their waitlist position or demo request;
• To communicate information about VidPilot's services relevant to the individual's expressed interest; and
• To assess pipeline demand and manage pilot onboarding capacity.

VidPilot will not use waitlist contact details for unrelated marketing communications without obtaining separate consent.

5.2 Client Onboarding and Service Delivery Data

Personal information collected from or in connection with pilot clients is used for the following purposes:

• To build and continuously update the client's brand memory context within the VidPilot AI agent;
• To enable the AI agent to generate content ideas, scripts, and video content aligned to the client's brand;
• To produce video content using AI video generation (HeyGen) and AI voice synthesis (ElevenLabs) on behalf of the client;
• To present content to the client for review and approval prior to publication;
• To publish approved content to the client's connected digital and social channels;
• To monitor post-publication content performance on behalf of the client;
• To feed performance data back into the AI agent's learning loop to improve future content decisions;
• To manage the client relationship, provide support, and administer the service agreement; and
• To comply with legal and regulatory obligations.

5.3 AI Model Training — Explicit Statement

5.4 Automated Decision-Making

The VidPilot AI agent performs automated analysis and decision-making in connection with content strategy, production scheduling, and performance optimisation for each client. These automated processes operate on client-provided data and publicly available information. No content produced through automated processes is published without explicit client review and approval. Clients retain full human oversight and sign-off at the publishing stage.

6. Disclosure of Personal Information

6.1 Third-Party Service Providers and Data Processors

VidPilot discloses personal information to third-party service providers who assist in delivering the platform and associated services. These disclosures are made to the extent necessary for each provider's function and are subject to confidentiality and data handling obligations.

6.2 OAuth Access Tokens and Social Platform Credentials

To publish content to client social media accounts, VidPilot requires clients to authenticate via OAuth and grant VidPilot API access to their connected accounts (including YouTube, Instagram, LinkedIn, and X). VidPilot stores these access tokens in its Supabase database infrastructure. The following applies to stored access tokens:

• Tokens are encrypted at rest within Supabase's infrastructure;
• Access to stored tokens is restricted to authorised VidPilot system processes only;
• Clients may revoke VidPilot's access to any connected social account at any time through that platform's account settings; and
• Upon termination of a pilot engagement, VidPilot will delete stored access tokens within the retention period described in Section 10.

6.3 Other Disclosures

VidPilot may also disclose personal information:

• Where required or authorised by Australian law, including in response to a valid legal process;
• To professional advisers, including legal, accounting, or audit professionals, under binding confidentiality obligations;
• In connection with a business sale, merger, or restructuring, in which case VidPilot will notify affected individuals as required by law; or
• With the express consent of the individual concerned.

VidPilot does not sell personal information to third parties.

7. Cross-Border Disclosure of Personal Information

7.1 Overseas Transfers

VidPilot transfers personal information to recipients located outside Australia, principally to the United States, in connection with the services provided by HeyGen, ElevenLabs, Supabase, Render, Netlify, Google, and the social media publishing platforms listed in Section 6.1.

7.2 Obligations Under APP 8

Under Australian Privacy Principle 8, before VidPilot discloses personal information to an overseas recipient, VidPilot takes reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to that information. These steps include:

• Reviewing the data processing terms and privacy commitments of each overseas service provider prior to engagement;
• Where available, entering into data processing agreements or relying on contractual data protection obligations with overseas processors;
• Selecting service providers whose published privacy and security practices are consistent with APP obligations; and
• Monitoring service provider terms on an ongoing basis.

Where VidPilot is satisfied that an overseas recipient will handle personal information consistently with the APPs, VidPilot proceeds with that disclosure. Where VidPilot cannot be so satisfied, VidPilot will seek the express consent of the individual in accordance with APP 8.2(b) before making the disclosure, or will not make the disclosure.

7.3 GDPR and CCPA

VidPilot's primary regulatory framework is the Privacy Act 1988 (Cth) and the APPs. Individuals located in the European Union may have additional rights under the General Data Protection Regulation (GDPR). The lawful bases on which VidPilot relies for processing under GDPR are:

• Contract performance, for processing necessary to deliver the VidPilot platform service to a client;
• Legitimate interests, for processing carried out in connection with pre-sales enquiries, lead management, and platform improvement activities, where those interests are not overridden by the individual's rights; and
• Consent, for processing of biometric data, including voice cloning and avatar likeness materials.

Individuals located in California, United States, may have additional rights under the California Consumer Privacy Act (CCPA). Individuals in those locations are encouraged to contact VidPilot using the details in Section 12 to discuss their specific rights.

9. Website Tracking, Cookies, and Analytics

9.1 Google reCAPTCHA

The waitlist and demo request form on vidpilot.com.au uses Google reCAPTCHA v2. Google reCAPTCHA collects browser metadata, behavioural signals, and device information for the purpose of distinguishing human users from automated bots. This data is collected and processed by Google under Google's Privacy Policy (available at policies.google.com/privacy). VidPilot does not independently store reCAPTCHA-generated device or behavioural data.

9.2 Website Analytics

VidPilot may deploy website analytics tools on vidpilot.com.au to measure visitor behaviour, page performance, and traffic sources. VidPilot will update this section to identify the specific analytics tool and the data it collects prior to activating any such tool. At the effective date of this policy, no third-party analytics tool beyond Google reCAPTCHA is active on the website.

Individuals who wish to confirm which analytics tools are currently active on the website may contact VidPilot using the details in Section 12.

9.3 Cookies

The vidpilot.com.au website may use cookies or similar tracking technologies in connection with platform functionality and any active analytics tools. Cookies do not identify individuals by name but may collect device identifiers and browsing behaviour. Most web browsers can be configured to refuse or delete cookies; however, doing so may affect the functionality of certain website features.

10. Data Retention and Deletion

10.1 Waitlist and Enquiry Contacts

Personal information collected through the waitlist and demo request form from individuals who do not proceed to become pilot clients will be retained for a period of twelve (12) months from the date of submission, after which it will be securely deleted or de-identified. VidPilot may retain aggregated, non-identifiable information about enquiry volume and demand beyond this period.

Individuals who wish to have their waitlist data deleted prior to the expiry of this period may submit a deletion request to VidPilot using the contact details in Section 12.

10.2 Pilot Client Data

Personal information and business data collected during the pilot program will be retained for the duration of the active service relationship and for a period of twelve (12) months following the conclusion or termination of the pilot engagement, to allow for any post-engagement queries, dispute resolution, or transition requirements.

After this retention period, client data will be securely deleted or de-identified from VidPilot's systems, including from Supabase and associated infrastructure.

10.3 Brand Memory and Stored AI Context

Each pilot client has the right to request deletion of their stored brand memory and accumulated AI agent context at any time. VidPilot will process a verified deletion request within 30 days of receipt. Upon termination of a pilot engagement, VidPilot will, by default, delete or de-identify the client's brand memory context within the retention period described in Section 10.2 unless the client requests earlier deletion.

To request deletion of brand memory and stored business context data, clients should contact VidPilot using the details in Section 12 and include sufficient information to identify the relevant account. VidPilot will provide written confirmation that the deletion request has been submitted and actioned.

10.4 OAuth Access Tokens

OAuth access tokens for connected social media accounts will be deleted from VidPilot's systems within 30 days of the termination of a pilot engagement, or earlier upon a client's specific request. Clients should also independently revoke VidPilot's access through each platform's account settings to ensure complete disconnection.

10.5 Deletion from Third-Party Processors

VidPilot will take reasonable steps to request deletion of client data held by third-party processors, including HeyGen and ElevenLabs, where a deletion request is received, consistent with those providers' deletion and data removal terms. VidPilot will provide the client with written confirmation that the deletion request has been submitted to each relevant third-party processor.

VidPilot cannot guarantee deletion from third-party systems beyond what those providers' terms and processes allow. Clients are encouraged to submit deletion requests directly to those providers as well to ensure completeness.

11. Storage and Security

11.1 Storage Infrastructure

Personal information collected by VidPilot is stored in Supabase's PostgreSQL database infrastructure. The VidPilot backend (FastAPI) runs on Render's cloud infrastructure. Website files are hosted on Netlify. Each of these providers maintains security certifications and data protection commitments relevant to their infrastructure.

11.2 Security Practices

VidPilot takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Measures in place include:

• Transmission of data over encrypted connections (TLS/HTTPS);
• Encryption of OAuth access tokens and other credentials at rest within Supabase's infrastructure;
• Access controls limiting who within VidPilot can access personal information to those with a legitimate operational need;
• Authentication controls for platform access, including those provided by Supabase's authentication infrastructure;
• Regular review of third-party provider security practices; and
• Secure handling protocols for biometric data, given its sensitive nature.

11.3 Security Incidents

In the event of a data breach that is likely to result in serious harm to affected individuals, VidPilot will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth), including notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as required.

11.4 No Absolute Guarantee

No method of electronic data storage or transmission is completely secure. While VidPilot applies the measures described above, VidPilot cannot guarantee absolute security of personal information transmitted to or stored by VidPilot or its processors.

12. Privacy Contact

VidPilot has established a dedicated privacy contact channel for all privacy-related enquiries, access and correction requests, and complaints.

All privacy enquiries and requests directed to the above contact will be acknowledged within 5 business days and responded to substantively within 30 days of receipt, in accordance with the timeframes under the APPs.

13. Access to and Correction of Personal Information

13.1 Right of Access

Individuals whose personal information VidPilot holds have the right to request access to that information. Access requests should be submitted to the privacy contact details in Section 12. VidPilot will respond within 30 days of receiving a verified request.

VidPilot may ask for reasonable verification of identity before providing access to personal information. In some circumstances, VidPilot may be unable to provide full access, for example where doing so would unreasonably impact the privacy of another individual, or where an applicable exception under the APPs applies. Where access is refused or limited, VidPilot will provide written reasons.

VidPilot will not charge a fee for lodging an access request. VidPilot will not charge a fee for providing access to personal information.

13.2 Right of Correction

Individuals may request correction of personal information held by VidPilot that is inaccurate, out of date, incomplete, irrelevant, or misleading. Correction requests should be submitted to the privacy contact details in Section 12. VidPilot will respond within 30 days and will take reasonable steps to correct the information.

Where VidPilot does not agree that a correction is warranted, VidPilot will notify the individual of its reasons and the individual may request that a statement of disagreement be associated with their record.

14. Privacy Complaints

14.1 Internal Complaints Process

Any individual who considers that VidPilot has handled their personal information in a manner that does not comply with the Privacy Act 1988 (Cth) or the APPs may submit a complaint to VidPilot using the privacy contact details in Section 12.

Complaints should include:

• The complainant's full name and contact details;
• A description of the personal information involved;
• A description of the conduct that is the subject of the complaint; and
• Any prior correspondence with VidPilot regarding the matter.

VidPilot will acknowledge receipt of a complaint within 5 business days and will endeavour to resolve the complaint within 30 days. Where a complaint requires additional time to investigate, VidPilot will notify the complainant of the expected resolution timeline.

14.2 Escalation to the OAIC

If a complaint is not resolved to the individual's satisfaction through VidPilot's internal process, or if VidPilot has not responded within 30 days, the individual may escalate their complaint to the Office of the Australian Information Commissioner (OAIC):

15. Regulatory Compliance

VidPilot's privacy practices are governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). VidPilot operates as an APP entity and handles personal information in accordance with APP obligations.

VidPilot monitors developments in Australian privacy law, including any amending legislation arising from the Attorney-General's Department's review of the Privacy Act 1988 (Cth), and will update its practices and this policy as required to maintain compliance.

Where VidPilot receives personal information from individuals located in the European Union, VidPilot acknowledges the applicability of the GDPR and will respond to GDPR-related enquiries through the privacy contact in Section 12. Where applicable, VidPilot similarly acknowledges the CCPA in relation to individuals located in California, United States.

16. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of South Australia and the Commonwealth of Australia. The primary legislative framework applicable to VidPilot's handling of personal information is the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Any dispute arising in connection with this Privacy Policy that is not resolved through the complaint process in Section 14 will be subject to the jurisdiction of the courts of South Australia, without prejudice to any right of an individual to lodge a complaint with the OAIC under the Privacy Act 1988 (Cth).

17. Updates to This Policy

VidPilot reviews this Privacy Policy periodically and updates it to reflect changes in business operations, services, applicable law, or third-party processor arrangements. The current version of this policy, together with its effective date and version number, is published at vidpilot.com.au/privacy.

Where a change to this policy is material, VidPilot will take reasonable steps to notify affected individuals, for example by updating the effective date and version number prominently on the website. Continued use of the VidPilot website or platform following publication of an updated policy constitutes acceptance of the updated terms to the extent permitted by applicable law.

Individuals with questions about any update to this policy are encouraged to contact VidPilot using the details in Section 12.