Privacy Policy

1.1 Introduction

At Supreme AI Pty Ltd, we are bound by the Privacy Act 1988 (Cth) (‘Privacy Act’) and the thirteen Australian Privacy Principles (‘APPs’) contained in Schedule 1 to that Act. We are also subject to the Notifiable Data Breaches (‘NDB’) scheme established under Part IIIC of the Privacy Act.

1.2 Definitions

‘Personal Information’ has the meaning given in the Privacy Act; information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in material form or not.

‘Customer Data’ means personal information that you upload, input or generate on the Platform about your own clients in the course of your AML/CTF compliance activities.

‘Sensitive Information’ includes information about health, racial or ethnic origin, religious beliefs, sexual orientation, criminal record, financial information, and biometric data, it is afforded additional protections under APP 3.

1.3 Information We Collect

Account and Identity Information

1. Full legal name, preferred name, and job title
2. Business name, ABN, ACN, Australian Financial Services Licence number, or professional registration number
3. Email address, telephone number, and postal address
4. Username, password (stored in hashed, salted form), and multi-factor authentication data

Customer Data (Uploaded by client)

1. Identification documents of your clients (e.g. passport copies, driver licence images, birth certificates)
2. Beneficial ownership records, including names, dates of birth, addresses, and ownership percentages
3. Risk assessment outputs, customer due diligence records, and transaction monitoring data
4. Suspicious Matter Report (‘SMR’) drafts and Threshold Transaction Report (‘TTR’) drafts
5. Records relating to politically exposed persons (‘PEPs’) and sanctions checks

Technical and Usage Data

1. IP address, device type, operating system, browser type and version
2. Pages visited, features used, session duration, click-stream data, and error logs
3. API access logs and integration audit trails

Communications Data

1. Support tickets, live chat transcripts, AI chatbot conversations, and email correspondence
2. Call recordings (where you are notified at the time)
3. Survey responses, feedback submissions, and community posts

1.4 How We Collect Information

1. Directly from the client when they register, complete onboarding, use the Platform, or contact us
2. Automatically via cookies, web analytics, and server logs
3. From third-party identity verification, PEP/sanctions screening, and payments providers when you engage those integrations
4. From publicly available sources such as ASIC, ABR, and government registers, where relevant to platform functionality

1.5 Why We Collect and Use Your Information

We collect and use personal information for the following purposes, relying on the legal bases noted:

1.6 Disclosure of Your Information

We do not sell personal information. We may disclose personal information to:

1. Cloud, infrastructure, and hosting providers under contractual data-processing agreements with AUS-equivalent protections
2. Identity verification, screening, and payments partners only when you initiate the relevant function
3. Professional advisers including accountants, lawyers, auditors, and insurers, under confidentiality obligations
4. AUSTRAC, the OAIC, the ATO, ASIC, or other regulators where required by law or lawful request
5. Courts, tribunals, or law enforcement agencies where compelled by legal process
6. A successor entity in the event of a merger or acquisition, subject to equivalent privacy commitments and user notification

1.7 Cross-Border Disclosure

Production data is hosted exclusively in Australian Government certified data centres located in Queensland. Some support and infrastructure service providers may have personnel located overseas (for example, offshore-hosted help desk software) who can access metadata for support purposes. Where personal information is disclosed overseas, we take reasonable steps under APP 8 to ensure the overseas recipient handles it in a manner consistent with the APPs. By using the Platform, you consent to this limited cross-border access where contractually necessary.

1.8 Information Security

1. Multi-factor authentication enforced for all accounts
2. Role-based access controls and least-privilege principles
3. Continuous logging, monitoring, and intrusion detection
4. Regular independent penetration testing and vulnerability assessments
5. Staff security vetting and annual security awareness training

1.9 Your Rights

Under the Privacy Act and the APPs, you have the right to:

1. Access the personal information we hold about you (APP 12)
2. Request correction of information that is inaccurate, out of date, or misleading (APP 13)
3. Withdraw consent to marketing communications at any time
4. Request deletion of personal information (subject to legal retention obligations pursuant to Section 5)
5. Make a privacy complaint pursuant to Section 11)

To exercise any of these rights, contact our Privacy Officer at [email protected]. We will respond within 30 calendar days. We may charge a reasonable cost-recovery fee for access requests in accordance with APP 12.

1.10 Notifiable Data Breaches

If Supreme AI suffers an eligible data breach under Part IIIC of the Privacy Act, i.e, a breach that is likely to result in serious harm to any affected individual, we will notify affected individuals and the Office of the Australian Information Commissioner (‘OAIC’) as soon as practicable. We will include the nature of the breach, the type of information involved, and the steps we recommend to mitigate the risk of harm.

1.11 Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or data-handling practices. We will notify you of material changes by publishing an in-platform banner and, where appropriate, by email, at least 14 calendar days before the change takes effect. Continued use of the Platform after the effective date constitutes acceptance.