Privacy Policy

01Who this policy covers

This policy applies to personal information we collect and hold in connection with our website and application at app.paradino.ai and related services (the Platform). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy covers two groups of people.

• Users are staff at clients of the Platform (financial advice firms) who hold a Paradino account: advisers, paraplanners, support staff and administrators.

• Firm customers are people whose information our client places in the Platform in the course of providing financial advice. We hold that information on our client’s behalf and handle it on the client’s instructions.

If you are a Firm customer, your financial adviser (our client) decides what information is collected about you and why, and its own privacy policy governs that collection. This policy explains how we handle the information while it is with us.

02What we collect

About Users

• Name, work email address, phone number, role and firm.

• Login credentials and multi-factor authentication enrolment.

• Billing contact, billing address and payment details. Payment card details are collected and held by our payment provider; we do not store full card numbers.

• Device, browser and IP address information, and how you use the Platform.

• Correspondence with us, support requests and feedback.

About Firm customers ("Customer Information")

As provided by our client (through a User), Customer Information may include:

• Name, contact details and date of birth.

• Financial information, including assets, liabilities, income, superannuation and insurance.

• Documents the User uploads, and information drawn from systems the User connects, such as Microsoft 365, Google Workspace or financial planning platforms.

• Recordings, transcripts and summaries of meetings that the User records.

• Notes, tasks and correspondence the User keeps about the Firm customer.

We collect Customer Information from the User, not from Firm customers directly, except where a User invites its customers to provide documents through our Platform. In that case we collect only what the customer chooses to provide, together with the customer’s email address for verification.

03Sensitive information and government identifiers

Customer Information may include ‘Sensitive Information’ (as defined in the Privacy Act), for example health information disclosed for insurance advice. We process Sensitive Information only to provide the Platform to the firm. We do not use it for any other purpose, and we never use it for marketing.

Customer Information may also include tax file numbers and other government identifiers. We do not use or disclose these for any purpose of our own. The Platform automatically detects identifiers such as tax file numbers, in text, and irreversibly replaces them with placeholders before that text is stored in a searchable index or sent to an AI model.

A firm’s administrator can also turn on a setting to de-identify all client data before AI processing. While it is on, the Platform restricts all AI processing to text and replaces Firm customers’ identifiers including names, contact details, addresses and dates of birth with placeholders before any text is sent to an AI model and restores them once the response returns.

04How we use information

We do not sell personal information. We do not use Customer Information to train, test or fine-tune AI models. No client data is used in evaluation or tuning datasets.

We use personal information to:

• provide and operate the Platform, and produce the transcripts, summaries, drafts and documents the firm asks for;

• secure the Platform, detect misuse and investigate incidents;

• provide support, administer accounts and process billing;

• communicate with Users about the service and send marketing messages to our Users; and

• comply with our legal obligations, resolve any disputes that we may have with any of our Users and enforce our agreements with third parties.

AI processing

The Platform uses artificial intelligence to transcribe, read, index and draft. Transcription, speaker identification, document reading and indexing run on infrastructure we operate in Australia. Drafting and summarisation use large language models provided by a third party under contract. Information sent to those models is used only to produce the output requested, on the terms set out in section 6.

Automated processing

We do not use automated processing to make any decisions about our Users.

Our Platform is an automated service that our Users make use of to help them give advice to Firm Customers as part of their financial advice services. We make clear to our Users that any advice or recommendations made by the Platform is not financial product advice, and that our Users must review, using a human, every output of the Platform. Further, our Users give financial advice to the Firm Customers, and it is up to the Firm Customer if they rely on that advice or not. As such, we do not believe that our automated processing makes decisions that will have significant legal effects on the Firm Customers.

05Where information is stored

All personal information we hold at rest, including Customer Information , User information and backups, is stored in data centres in Australia, operated by the cloud hosting provider listed at trust.paradino.ai. Our product analytics and error reporting run on infrastructure we operate in the same location.

06Disclosure, including overseas disclosure

We disclose personal information only:

• to our staff, contractors and service providers who help us operate the Platform, as described below;

• to systems the firm connects to the Platform, at the firm’s instruction and within the access the firm grants;

• anyone to whom our assets or businesses (or any part of them) are transferred;

• other persons, including government agencies, regulatory bodies and law enforcement agencies, or as required, authorised or permitted by law; or

• anyone you have specifically agreed can receive Personal Information, or where such consent can be reasonably inferred from the circumstances.

Service providers and the countries they operate in

We use service providers (also known as sub-processors) to help us operate the Platform. The current list is published at trust.paradino.ai. We update that list before a new provider begins handling personal information.

Some of our service providers are located, or process information, outside Australia. The categories are:

• Cloud hosting and storage. Located in Australia.

• AI model processing. Requests may be routed through the provider’s global infrastructure and processed in a country other than Australia.

• Identity and sign-in, billing, email delivery, customer support, internal notifications and web search. These providers receive User account information such as name, work email, firm, role and billing details. Notification emails sent to Users may include a Firm customer’s name in the subject line, and client portal invitations are emailed to Firm customers the firm invites. Web search providers receive search queries generated by the Platform. None of these providers receives documents, recordings or transcripts.

• Systems the firm connects. For example Microsoft 365, Google Workspace or financial planning platforms. The firm controls whether these are connected and what access is granted.

Our commitments, whichever providers we use

• Every provider of artificial intelligence models we use to process personal information is engaged on terms under which the content of requests and responses is not retained after the request is processed, is not logged, and is not used to train the provider’s models. We will not engage a model provider on lesser terms.

• Personal information we hold at rest remains in Australia, as described in section 5.

• To the extent any of our sub-processors disclose information overseas, then we will take steps reasonably necessary to ensure that your Personal Information is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Information will take place to an organisation or a country unless there are adequate controls in place including the security of your data and Personal Information.

07Data from connected Google and Microsoft accounts

Paradino lets you connect your Google Workspace or Microsoft 365 account so that Paradino can work with your files, calendar, meeting recordings and email on your behalf. This section explains what we access from a connected account, how we use, store and share it, and how you can stop that access. It applies in addition to the rest of this Privacy Policy.

What we access

When you connect an account and grant the permissions requested on Google’s or Microsoft’s consent screen, Paradino accesses only the following, and only to provide the features you use:

• Basic profile (your name and email address) to identify the connected account and show you which account is connected.

• Files (Google Drive, or OneDrive and SharePoint) in the specific client folders you choose to link, so Paradino can sync those documents into that client’s knowledge base, and can save documents you generate in Paradino back into a Paradino folder inside that client folder.

• Calendar events and meeting recordings (Google Calendar and Google Meet, or Microsoft Teams) so you can import a recording of a client meeting to generate a meeting summary.

• Email (Gmail or Outlook), only if you separately turn on email access, and then only messages exchanged with the client email addresses you have enabled email sync for. Paradino syncs those conversations into that client’s knowledge base and, if you turn it on, creates unsent reply drafts in your mailbox. Paradino never sends email on your behalf.

How we use it

Data from a connected account is used solely to provide and improve the Paradino features described above and visible in the product: building your clients’ knowledge bases, generating meeting summaries and other advice documents, answering your questions about a client, drafting client communications for your review, and keeping your linked folders up to date. Paradino does not use data from connected accounts for advertising, does not sell it, and does not use it to determine credit-worthiness or for lending purposes.

How we store it

Synced files, meeting recordings and email conversations are stored in Paradino’s secure cloud environment, encrypted in transit and at rest, and are associated with the client you linked them to. Access tokens for your connected account are stored encrypted and are used only to make the requests described above. Data from a connected account is processed by artificial intelligence models in order to provide the features above (for example, summarising a meeting or answering a question about a client). Paradino does not use data obtained through Google Workspace APIs or Microsoft APIs to develop, improve or train generalised (non-personalised) artificial intelligence or machine learning models.

How we share it

Data from a connected account is shared only with the service providers that Paradino uses to deliver the features above, such as cloud hosting and artificial intelligence model providers, acting on our instructions; where required for security investigations or to comply with applicable law; or with your explicit consent. Within your organisation, it is visible only to the people your organisation’s settings allow, in the same way as any other client data you hold in Paradino. Paradino personnel do not read data from your connected accounts except with your explicit consent (for example, when you ask us for support), for security or abuse investigations, to comply with applicable law, or where it has been aggregated and de-identified for internal operations.

Google API Services User Data Policy

Paradino’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it, and how to stop access

You can disconnect a connected account at any time from Settings, Connectors in Paradino, or turn off email access on its own. Disconnecting immediately deletes the access tokens Paradino holds for that account and stops all syncing. You can also revoke Paradino’s access directly with the provider, at myaccount.google.com/permissions for Google, or account.live.com/consent/Manage or myapps.microsoft.com for Microsoft. Copies of files, recordings and email conversations that were already synced remain in the client’s knowledge base so that your records stay complete; you can delete them individually, or by unlinking the folder, turning off email sync, or deleting the client, at any time. Data that has not been deleted by you is otherwise retained and destroyed in accordance with section 8.

08Retention and deletion

Our client controls how long Customer Information is kept in the Platform.

• Meeting audio. The client’s administrator chooses whether recordings are kept for 7 days, 30 days, or until deleted. The default is 30 days. Deletion at the end of the chosen period is enforced automatically by the storage system.

• Source documents. The client’s administrator chooses whether source documents are kept for 7 days, 30 days, or until deleted. The default is 30 days. Deletion at the end of the chosen period is enforced automatically by the storage system.

• Transcripts, summaries, generated documents, notes and tasks. Kept while the client’s account is active, or until the client deletes them.

When a client closes its account, we delete or de-identify its Customer Information and User information within 90 days of the account closure, except where we are required by law to retain it. Record-keeping obligations that apply to financial advice, including any seven-year retention requirement, are the client’s obligations and not ours. Clients should retrieve the records they need before closing an account, and we will assist on request.

09Security

We protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Measures include encryption of data at rest and in transit, logical separation of each client’s data from every other client’s, multi-factor authentication for Users, least-privilege access for our staff, and independent assurance including SOC 2 Type 2 and regular penetration testing. Details are published at trust.paradino.ai.

Data breaches

We comply with the Notifiable Data Breaches scheme under the Privacy Act. If a data breach affects Customer Information, we will notify the affected client without undue delay and give it the information it needs to meet its own obligations to its customers.

10Cookies and analytics

We use cookies to keep Users signed in and to remember preferences. Our product analytics run on infrastructure we operate in Australia and associate usage with the User’s account so that we can support Users and improve the Platform. We do not share usage data with third-party analytics providers. Analytics on the client portal do not identify individuals.

11Direct marketing

We may send Users information about the Platform and related services where they would reasonably expect to receive it. Every such message includes a simple way to opt out.

We do not use Customer Information or Sensitive Information for marketing.

12Exclusions

Links: Our Platform may contain links to websites operated by third parties. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content on, those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage individuals to read them before using those websites.

Personal Information Provided to Others: This Privacy Policy does not apply to any Personal Information that you provide to another user or visitor through the Platform or through any other means.

13Access, correction and complaints

Users may ask to access or correct the personal information we hold about them by contacting us at the details below.

Firm customers should direct requests to access or correct their information to their financial adviser (our client), which controls that information. We will assist our client to respond.

If you think we have breached the Privacy Act or any other relevant privacy law, or you wish to make a complaint about the way we have handled your Personal Information, you can contact us. Please include your name, email address and/or telephone number and clearly describe your complaint. We will acknowledge your complaint and respond to your complaint within a reasonable period of time. If you think that we have failed to resolve the complaint satisfactorily, we will provide you with information about the further steps you can take.

If you remain unsatisfied with the way in which we have handled a privacy issue, you may approach an independent advisor or contact the Office of the Australian Information Commissioner (www.oaic.gov.au) for guidance on alternative courses of action which may be available.

14Changes to this policy

We may update this policy from time to time. The current version is always available on the Platform, with the date it was last updated.

15Contact

Privacy queries, access requests and complaints: support@paradino.ai. Security and compliance documentation: trust.paradino.ai.