Privacy Policy – Agentive®

1.1 Personal Information

We may collect the following types of personal data when you interact with us:

• Contact details: Name, email address, phone number, postal address
• Account credentials: Username, password
• Professional details: Company name, job title
• Billing information: Payment method, invoicing details
• Preferences: Communication and marketing preferences
• Usage data: Dates, times, and pages visited on our site; feature usage metrics

1.2 Information we process on behalf of our customers

Our customers use MyAgentive to process information about their own clients, staff and contacts. We hold that information on the customer's instructions, in the customer's dedicated instance, and we use it only to provide the Services to that customer. The customer, not Agentive, decides what is collected and why, and is responsible for the notices and consents that its own clients receive. If your information is held in a customer's MyAgentive instance and you want to access, correct or delete it, contact that customer directly; we will assist them to respond.

• Direct Interactions: Web forms, live chat, email, and phone communications
• Automated Technologies: Cookies, web beacons, tracking pixels, server logs
• Third-Party Integrations: Google Analytics, payment processors

We use your information to:

• Deliver, maintain, and improve our services
• Process payments and manage your account
• Respond to enquiries and provide customer support
• Conduct fraud prevention and security checks
• Comply with legal, regulatory, and contractual obligations
• Analyse usage trends to enhance user experience

We implement industry-standard safeguards, including:

• Encryption of data in transit (TLS) and at rest
• Secure servers and data centres with restricted physical access
• Regular vulnerability assessments and security audits
• Employee training on privacy best practices

We may share your personal data with:

• Service Providers: Hosting, payment processing, analytics partners
• Legal Authorities: When required by law, regulation, or court order
• With Your Consent: Any other third parties you explicitly approve

We do not sell or rent your personal information for third-party marketing. Agentive's personnel, meaning our employees and the contractors we engage (who may be located outside Australia), are not third parties: each is bound by written confidentiality obligations and accesses your personal information only on Agentive-controlled systems hosted in Australia, and only as needed to provide and support the Services.

For Agentive AI Employee customers, your operational data at rest, including your MyAgentive instance, agent memory, conversations, files and backups, is stored in Australia on Amazon Web Services (AWS) in the Sydney (ap-southeast-2) or Melbourne (ap-southeast-4) region. AI inference is performed on Amazon Bedrock, in Australia by default, under our zero data retention arrangement with AWS (see section 12).

Some data may be processed outside Australia in the following limited circumstances:

• In transit: traffic may pass through Cloudflare's global edge network for TLS termination, DDoS protection and delivery. Cloudflare does not store the content of your requests at rest as part of this transit path.
• Optional features: certain features you choose to enable (such as Telegram messaging, voice synthesis, SMS or outbound calling) transmit data to providers outside Australia. These are engaged only if you turn them on.
• United States processing: AI inference may run on Amazon Bedrock in the United States where the AI model we have chosen is not available on Amazon Bedrock in Australia, or temporarily where AWS cannot provide sufficient AI capacity in Australia, in each case with the same zero data retention and no-training terms. We notify affected customers when this happens, your data at rest remains in Australia, and customers who have elected Australia-only processing under clause 6A(c) of our Terms & Conditions are never routed outside Australia; their AI Employee uses only models available in Australia and may pause when Australian capacity is short.

Where data is processed outside Australia, we rely on appropriate contractual safeguards and technical measures to protect it. The providers we use are listed in section 14 (Sub-processors). If you require that your data never leave Australia, you may make a written Australia-only election under clause 6A(c) of our Terms & Conditions.

Subject to applicable law, you may:

• Access the personal data we hold about you
• Correct inaccuracies or update information
• Request deletion of your data where lawful
• Object to or restrict certain processing activities
• Withdraw consent at any time for processing you previously agreed to
• Opt-out of marketing communications

To exercise these rights, please contact us via the details below.

If you believe we have handled your personal information in breach of the Australian Privacy Principles, contact us at the address in Contact Us with "Privacy complaint" in the subject line. We will acknowledge your complaint within 5 business days, investigate it, and respond in writing within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.

We retain your personal information only as long as necessary to:

• Fulfil the purposes described in this Policy
• Comply with legal, tax, and accounting obligations
• Resolve disputes and enforce our agreements

When retention is no longer required, we will securely delete or anonymise your data.

Export on termination. If your service is terminated, you may request an export of your data within 15 days of termination, and we will provide it in a standard machine-readable format (such as CSV, Markdown or JSON) at no additional cost. We retain your data for at least 30 days after termination, after which it may be deleted.

We comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). In the event of an Eligible Data Breach, we will:

1. Notify affected individuals as soon as practicable
2. Notify the Office of the Australian Information Commissioner (OAIC) where required, and any affected customer without undue delay
3. Provide guidance to help you mitigate potential harm
4. Take immediate steps to contain and remediate the breach
5. Where a breach involves information we hold on behalf of a customer, notify that customer without undue delay and coordinate with them so that individuals and the OAIC receive a single, consistent notification, as the Notifiable Data Breaches scheme permits

We may update this Privacy Policy to reflect changes in our practices or legal requirements.

• Each update is published on this page with a new version number and effective date.
• We will notify you by email or in-service announcement if changes materially affect your rights.

Version history. Version 2.2 (16 October 2026): AI inference now runs only on Amazon Bedrock under a zero data retention arrangement with AWS, in Australia by default, using AI models we choose from those available on Amazon Bedrock in Australia or the United States. Removed the fallback to an AI service outside AWS, and removed that provider from the sub-processor list. Amazon Bedrock in the United States may now also be used where the model we have chosen is not available in Australia, with notice to you; the Australia-only election is unchanged (sections 6, 12 and 14). Earlier version-history entries now describe the former fallback generically; the full text of earlier versions is available on request. Added section 12(e), About Amazon Web Services, with links to AWS's security and compliance information. Version 2.1 (24 September 2026): clarified the AI inference location and the United States fallback (AWS Bedrock in the United States, then a US-hosted AI service outside AWS), named countries for all sub-processors, added Google Analytics, added a complaints process (section 7A), added information processed on behalf of customers (section 1.2), restated telemetry (section 13) and removed collection methods no longer used (social login, public sources). Version 2.0 (7 September 2026): added data residency, AI service data practices, telemetry and the sub-processor list. On agentive.au, Version 2.1 also replaced the earlier agentive.au Privacy Policy (effective 2 July 2025), including its Social Media Data section, as we no longer offer social login. This Privacy Policy is published on both agentive.au and myagentive.ai and carries the same version number.

Please review this page periodically. Earlier versions are available on request from [email protected].

We use cookies and similar technologies to:

• Analyse site usage and performance
• Personalise content and remember your preferences
• Enhance site functionality and security

You can manage or disable cookies through your browser settings.

We collect application telemetry about how the Services operate: feature and skill usage counts, error and issue reports, integration failures, latency and performance metrics, and system events. We use it to detect and fix faults, support our customers, secure the Services and improve them. Telemetry is aggregated and anonymised on your instance before it is sent to our central management infrastructure. It never includes your operational data, your clients' data, the content of any conversation or task, the names or contents of your files, or any personal information.

We engage the following third-party sub-processors to deliver the Services. We may add, replace or remove sub-processors from time to time, and will give at least 30 days' notice of material changes via email or in-product notification.

Always in Australia

May route outside Australia in normal operation

Engaged only if you enable the relevant feature