Privacy Policy

1What information do we collect?

The kind of personal information we collect from you depends on how you use our products. This may include:

• Name, email address, phone number
• Business name, ABN, and trading details
• Delivery and billing address
• Payment information, processed securely through third-party payment providers (Stripe)
• Social media account information when you connect Facebook, Instagram, or other platforms to our products
• Order history, browsing behaviour, and product usage data
• IP address and device information
• Any other information voluntarily provided through contact forms, customer accounts, or communications with us

2Types of information

The Privacy Act 1988 (Cth) (“Privacy Act”) defines two relevant categories of information.

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable — whether the information is true or not, and whether it is recorded in a material form or not. If information does not disclose your identity or allow your identity to be reasonably ascertained, it is generally not considered Personal Information and is not subject to this policy.

Sensitive Information includes information such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, criminal record, or health information. We only use Sensitive Information for the primary purpose it was collected, for a directly related secondary purpose, or with your consent or as required by law.

3How we collect your information

• We collect personal information when you input it into our Website or apps, or otherwise provide it to us.
• We may use cookies to recognise repeat visits and customise your experience. We generally cannot identify you personally from cookie data alone.
• We generally don't collect Sensitive Information, but where we do, we handle it as described above.
• Where reasonable and practicable, we collect information from you directly. If we receive information about you from a third party — for example, via a social media login — we'll take reasonable steps to make you aware of this.

4Purpose of collection

• To provide, operate, and improve our products and the services you've signed up for
• To enable connected integrations you authorise — for example, publishing content to your Facebook Page or Instagram account through SMflow
• To process payments and manage your subscription
• To communicate with you about your account or developments in our business
• We only disclose personal information to service providers who help us operate the Website and our products, and to maintenance/support personnel acting in the normal course of their duties
• By using our products, you consent to receiving direct marketing material relevant to the services you use. We do not use Sensitive Information for marketing, and every marketing communication includes a simple unsubscribe option

5Social media and third-party platform data

Where you connect a Facebook Page, Instagram Business account, or other third-party platform to SMflow or another AIFlow360 product, we access only the data and permissions required to provide the service you've requested — such as publishing scheduled posts on your behalf, reading basic page information, or syncing engagement metrics. We do not sell this data, and we do not use it for any purpose beyond delivering the connected feature. You can disconnect any linked account at any time from within your product dashboard.

6Google Drive and YouTube data

Where you connect a Google Account to SMflow to use the Google Drive photo sync or YouTube publishing features, we request only the following limited permissions, and never any broader access to your Google Account:

• Google Drive (drive.file scope): we can only see, create, and manage the specific folder and files our app creates inside your own Google Drive — such as the SMflow photo folder set up for your business. We cannot see, access, or modify any other file or folder in your Drive, and we never request broader Drive access.
• YouTube (youtube.upload scope): we can upload videos to your connected YouTube channel on your behalf, only when you generate and approve a video post within SMflow. We do not access your existing YouTube content, subscriber data, or analytics beyond what's needed to confirm a successful upload.

Your use of SMflow's Google Drive and YouTube features, and our use of any data obtained through them, complies with the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We do not use data accessed through Google APIs to serve advertising of any kind, including retargeting or personalised advertising.
• We do not sell, rent, or transfer this data to third parties, data brokers, or advertising platforms.
• We do not use this data to determine creditworthiness or for lending purposes.
• We do not allow humans to read this data, except in the narrow circumstances Google's policy permits — such as with your explicit consent, for security purposes (e.g. investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.
• We use this data only to provide and improve the specific SMflow features you've connected — photo syncing for content creation, and video publishing you've approved — and for no other purpose.

You can disconnect your Google Drive or YouTube connection at any time from within your SMflow dashboard, or by revoking AIFlow360's access directly from your Google Account permissions page.

7Security, access, and correction

We store personal information in a way that reasonably protects it from unauthorised access, misuse, modification, or disclosure. When we no longer require information for the purpose it was collected, we take reasonable steps to destroy, anonymise, or de-identify it. Records are generally retained for a maximum of seven years to meet our record-keeping obligations.

Under the Australian Privacy Principles, you may:

• Request access to the personal information we hold about you (APP 12)
• Request correction of inaccurate personal information, subject to certain exceptions (APP 13)

To make such a request, please contact us using the details below.

8Complaints

If you have a complaint about how we handle your personal information, please contact us using the details below. All complaints are considered directly by our team, and we may seek further information to clarify your concerns. If your complaint is well founded, we will take appropriate steps to rectify the issue in consultation with you. If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner.

9Overseas transfer

Your personal information may be transferred to, or stored on, servers located overseas — including infrastructure providers such as Netlify and Supabase. We take reasonable steps to ensure that any overseas recipient handles your information in a manner consistent with the Australian Privacy Principles, including seeking contractual commitments where a destination country's data protection laws are less comprehensive than Australia's.