Savra Technologies Pty Ltd

1. About This Policy

1.1 This Privacy Policy applies to all personal information collected by Savra Technologies Pty Ltd (ABN 80 695 959 598) (we, us or our) via the website located at www.savra.com.au and the Savra application at app.savra.app (together, the Platform).

1.2 We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

1.3 By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

1.4 We may update this Privacy Policy from time to time. The current version will always be available on our website. We will notify you of material changes by email or by a prominent notice on the Platform.

2. What Information Do We Collect?

2.1 The personal information we collect depends on how you interact with the Platform. We collect information from two categories of users:

(a) Visitors to www.savra.com.au (marketing site): IP address, browser type, device identifiers, referrer URLs, and any contact information voluntarily submitted through forms or emails.

(b) Registered users of app.savra.app (the application): all of the above, plus the following categories of information:

(i) Account and contact information: name, email address, phone number, business name, country, region, and timezone.

(ii) Authentication credentials: password (stored in hashed form) and multi-factor authentication secrets.

(iii) Payment information: payment card details are collected and processed by our payment provider, Stripe. We do not directly store full card details; we retain only summary billing information such as the last four digits of your card and your billing address.

(iv) Usage and interaction data: chat queries submitted to the Savra AI agent, agent responses, files and documents uploaded by you, session metadata, and feature usage analytics.

(v) Third-party integration data: with your authorisation, data accessed from connected platforms as described in clause 4. This data may include your business financial records, transactions, contacts, employees, suppliers, customers and their personal information, marketing performance metrics, and operational records.

(vi) Technical information: IP address, device identifiers, browser type and version, operating system, referrer URLs, cookies, and access timestamps.

(vii) Communications: any information you voluntarily provide through forms, emails, support requests, or other communications with us.

2.2 Where we collect personal information about third parties (such as your customers, employees, or suppliers) through third-party integrations, you are responsible for ensuring that those individuals have been notified of, and have consented to, such collection and use in accordance with applicable privacy laws.

3. Types of Information

3.1 Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true, and whether or not it is recorded in a material form.

3.2 Sensitive Information is a subset of personal information defined in the Privacy Act as including information or an opinion about an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record, or health information.

3.3 We generally do not seek to collect Sensitive Information. Where Sensitive Information is incidentally collected, we will only use or disclose it:

(a) for the primary purpose for which it was obtained;

(b) for a secondary purpose that is directly related to the primary purpose; or

4. Connected Platforms and Third-party Integrations

4.1 The Platform allows you to connect your accounts with third-party platforms to enable Savra to access and analyse your business data. We offer two types of connections:

(a) Direct API connections: Savra connects directly to Xero and QuickBooks using their official APIs. When you authorise a connection, Savra communicates directly with those platforms using credentials and access tokens you provide. No intermediary service is involved in these connections.

(b) Composio-facilitated connections: For all other supported platforms (including HubSpot, Salesforce, Google Workspace, Microsoft 365, Slack, Outlook, Dropbox, Google Ads, Google Analytics, LinkedIn, and others available through Composio's platform), Savra uses Composio as an integration infrastructure provider to facilitate the connection. Composio manages the authentication flow and API communication between Savra and those platforms.

4.2 When you authorise a connection through Composio, Composio may process:

(a) authentication information, including access tokens and connection identifiers;

(b) account, user and workspace information from the connected platform;

(d) API request and response data; and

(e) technical logs and metadata relating to the connection.

4.3 Information obtained through connected platforms may include business financial records, transactions, contacts, employee information, customer and supplier information, communications, documents, calendars, marketing information, and operational records.

4.4 Savra will only request access permissions reasonably required to provide the connection and associated Platform functions. The information available to Savra will depend on the permissions you grant and the scope permitted by the connected platform.

4.5 You may disconnect a third-party platform using the controls available in the Platform. Disconnecting a platform prevents future collection through that connection but does not automatically delete information previously collected or retained for a lawful purpose.

4.6 Where you connect an account containing another person's personal information, you must ensure that you are authorised to provide that information and permit its processing through Savra and, where applicable, Composio.

4.7 The handling of information by a connected platform remains subject to that platform's own terms and privacy policy. Savra is not responsible for the independent privacy practices of third-party platforms.

5. How We Collect Your Personal Information

5.1 We collect personal information in the following ways:

(a) directly from you when you input information into the Platform, register for an account, submit a form, or communicate with us;

(b) automatically through cookies, similar technologies, and our own usage records when you use the Platform (see clause 10 for more detail on cookies);

(d) from third parties in limited circumstances, such as referral partners or publicly available sources, where we will take steps to notify you of that collection.

5.2 Where reasonable and practicable, we collect your personal information directly from you.

6. Purpose of Collection and Use

6.1 We collect and use your personal information for the following purposes:

(a) to provide, operate, and improve the Platform and our services;

(b) to create and manage your account;

(d) to communicate with you about your account, support requests, and service updates;

(e) to send you direct marketing communications about our products and services, where you have provided your express consent or where permitted by law (see clause 6.2);

(f) to comply with our legal obligations; and

(g) to conduct analytics and improve the performance and features of the Platform.

6.2 Direct marketing: We will only send you direct marketing communications where you have expressly opted in to receive them, or where the law otherwise permits. Every marketing communication will include a clear and simple mechanism for you to opt out, such as an unsubscribe link. We will honour opt-out requests promptly. We do not use Sensitive Information for direct marketing purposes.

6.3 We will not use or disclose your personal information for a purpose other than those described in this Privacy Policy without your consent, unless required or authorised by law.

7. Disclosure of Personal Information

7.1 We may disclose your personal information to:

(a) our employees, contractors, and service providers who assist us in operating the Platform, on the condition that they handle your information in accordance with this Privacy Policy and applicable privacy laws;

(b) Stripe, for the purpose of processing payments;

(c) Composio, where reasonably necessary to authenticate, establish, maintain, monitor, or troubleshoot a connection you have selected, as described in clause 4;

(d) infrastructure providers that host and run the Platform, and Google Fonts (see clause 10); and

(e) government agencies, regulators, or law enforcement bodies where required or authorised by law.

7.2 We do not sell your personal information to third parties.

8. Overseas Disclosure

8.1 Some of our service providers and infrastructure partners, including Composio and its subprocessors, are located outside Australia. Your personal information may be disclosed to overseas recipients in the countries where those providers operate, which may include the United States and other jurisdictions.

8.2 Before disclosing personal information to an overseas recipient, we will take the reasonable steps required by Australian Privacy Principle 8 to ensure that the recipient does not breach the APPs in relation to that information, unless an exception under the Privacy Act applies.

8.3 Our reasonable steps may include conducting due diligence on recipients, reviewing data locations and subprocessors, requiring contractual privacy and security protections, limiting access permissions, and maintaining technical access controls.

8.4 Where we are unable to ensure APP-equivalent protection and no exception applies, we will seek your express informed consent before making the disclosure. If you consent, you acknowledge that we may not be able to take reasonable steps to ensure the overseas recipient's compliance, and we may not be accountable under the Privacy Act for that recipient's handling of your information.

8.5 Nothing in this clause excludes or limits any responsibility that applies to us under the Privacy Act for our own acts or practices in relation to your personal information.

9. Security

9.1 We take reasonable steps to protect your personal information from unauthorised access, misuse, modification, loss, or disclosure. Our security measures include:

(a) encryption of data in transit and at rest;

(b) access controls and authentication requirements, including multi-factor authentication;

(d) staff training on privacy and data security obligations.

9.2 Notifiable Data Breaches: We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. If we become aware of a data breach that is likely to result in serious harm to any affected individual, we will:

(a) contain the breach and assess the risk of harm as quickly as practicable;

(b) notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable after we form the view that an eligible data breach has occurred, having completed our assessment as soon as practicable and in any event within 30 days of becoming aware of a suspected eligible data breach; and

(c) notify affected individuals as soon as practicable, with information about the breach and the steps they should take to protect themselves.

9.3 While we take reasonable precautions, no data transmission or storage system is completely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately using the details in clause 14.

10. Cookies and Similar Technologies

10.1 We use cookies and similar technologies only to run the Platform, keep it secure and help prevent fraud. We do not use advertising cookies, we do not track you across other websites, and we do not use third-party analytics tools such as Google Analytics.

10.2 Our marketing site (www.savra.com.au) does not set cookies or store anything in your browser.

10.3 The Savra application at app.savra.app uses:

(a) sign-in cookies, which keep you signed in as you move between pages;

(b) your browser's storage, which remembers your settings and where you left off, such as the last chat you had open; and

(c) cookies set by Stripe, our payment provider, which Stripe uses to help prevent fraud. Stripe's own privacy policy governs that information.

10.4 The marketing site and the application load fonts from Google Fonts. When they do, your browser connects to Google's servers, which receive your IP address and browser details. Google's own privacy policy governs that information.

10.5 You can block or delete cookies through your browser settings. If you block the sign-in cookies, you will not be able to stay signed in to the application.

10.6 If we start using cookies or similar technologies for any other purpose, we will update this clause before we do.

11. Access, Correction, and Retention

11.1 Under the APPs, you have the right to:

(a) request access to the personal information we hold about you (APP 12); and

(b) request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13).

11.2 To make an access or correction request, please contact us in writing using the details in clause 14. We will respond to your request within a reasonable time and, in any event, within 30 days.

11.3 We may decline an access or correction request in limited circumstances permitted by the APPs, and will provide written reasons if we do so.

11.4 Retention: We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected. If you cancel your account, we make your Customer Data available for export for 30 days, after which we take reasonable steps to delete or de-identify it. We retain a limited set of records for longer only where the law requires it — for example transaction and billing records kept to meet taxation and corporate record-keeping obligations — and we destroy or de-identify those records once the applicable period ends.

12. Artificial Intelligence and Automated Processing

12.1 The Platform uses artificial intelligence, machine learning, and automated processing to analyse information supplied by you or obtained through connected platforms and to generate summaries, classifications, forecasts, recommendations, alerts, draft content, and business insights.

12.2 The personal information used in this processing may include account information, communications, documents, financial and transactional information, customer and supplier information, employee information, marketing information, usage information, and other information available through connections authorised by you.

12.3 Depending on the features used and the information provided, the Platform may infer or generate new information about an identifiable individual. We treat such information as personal information where required by the Privacy Act.

12.4 Unless we expressly state otherwise for a particular feature, Savra's automated outputs are intended to assist human decision-making and do not independently make decisions that have legal or similarly significant effects on individuals.

12.5 AI outputs may contain errors. AI-generated outputs may be inaccurate, incomplete, outdated, misleading, or unsuitable for your circumstances. Outputs may omit relevant context or produce different results from similar inputs. You are responsible for reviewing and independently verifying all outputs before relying on them or using them to make decisions. Savra does not guarantee that any AI-generated output is correct, complete, or fit for a particular purpose.

12.6 You must not use the Platform as the sole basis for decisions that could significantly affect an individual's rights or interests, including decisions about employment, credit, insurance, eligibility, access to essential services, or similar matters, without independently verifying the information, considering applicable legal requirements, and applying appropriate human review.

12.7 We may use interactions with the Platform to operate, secure, test, and improve our services. We will not use your personal information, uploaded files, or connected-platform data to train a general-purpose AI model unless we have clearly notified you and have a lawful basis to do so.

12.8 Automated decision-making transparency (from 10 December 2026): From 10 December 2026, additional obligations apply under the Privacy Act where a computer program uses personal information to make or substantially contribute to decisions that could reasonably be expected to significantly affect an individual's rights or interests. Where those obligations apply to Savra's AI features, this Privacy Policy will disclose:

(a) the kinds of personal information used in the operation of such programs;

(b) the kinds of decisions made solely by such programs; and

12.9 We will update this Privacy Policy before 10 December 2026 to include those disclosures in respect of any Savra features that meet the threshold described in clause 12.8.

12.10 You may contact us using the details in clause 14 to ask how personal information is used by Savra's AI features, or to raise a concern about an automated output.

13. Complaints

13.1 If you have a complaint about the way we have handled your personal information, please contact us using the details in clause 14. Your complaint will be reviewed by our Privacy Officer.

13.2 We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. We may seek further information from you to clarify your concerns.

13.3 If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to address the issue.

13.4 If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner (OAIC):

(a) Website: www.oaic.gov.au

(b) Phone: 1300 363 992

14. How to Contact Us

14.1 For any privacy queries, access or correction requests, or complaints, please contact us at:

Savra Technologies Pty Ltd

Email: support@savra-technologies.com

Website: www.savra.com.au

15. Governing Law

15.1 This Privacy Policy is governed by the laws of Queensland, Australia. Any disputes arising in connection with this Privacy Policy are subject to the jurisdiction of the courts of Queensland.

Privacy policy