Privacy Policy — BuildMate

1. Who We Are

• Entity: Light Tune Pty Ltd (ABN 20 684 152 618)
• Contact: info@lighttune.com.au
• Website: https://buildmate.lighttune.com.au

2. Information We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

2.3 Sensitive Information

We do not intentionally collect sensitive information (as defined in the Privacy Act), such as health information, racial or ethnic origin, or political opinions. You must not submit sensitive, confidential or personal information (yours or other people's) into AI chat or analysis features — see section 3.1 for how AI inputs are processed.

2.4 What we do not collect

We do not collect full payment card numbers (Stripe collects and stores these under its own terms and privacy policy), government identifiers, or biometric information.

3. How We Use Your Information

We use your personal information for the following primary purposes:

• Providing the Service: processing your queries, property details and uploads to generate AI-assisted results, site analyses, reports and documents
• Account management: authentication, security, and account maintenance
• Billing: subscriptions and pay-per-use purchases via Stripe; GST and accounting records
• Service improvement: analysing usage patterns to improve accuracy and user experience; and, where you have not opted out, we may use de-identified inputs and outputs to improve the Service (see sections 3.3 and 3.4)
• Communication: service updates, renewal reminders for paid plans, security alerts, and support responses; and, where permitted under the Spam Act 2003 (Cth), product updates and offers
• Legal compliance: meeting our obligations under applicable laws

3.1 AI Processing Disclosure — read this section carefully

Important — How your queries and property details are processed:

When you submit a query, property details, or upload files, the following occurs:

1. The relevant inputs are transmitted to Google AI (Gemini API) for processing
2. Google AI processes the input and returns a response to us
3. We display the AI-generated result to you

Data handling by our AI provider (current tier):

We currently use the paid tier of Google's Gemini API. Under Google's terms for paid services:

• Your inputs and the AI-generated responses are not used by Google to train or improve its models or products
• Inputs are processed to generate your response and retained by Google only for a limited period for safety, abuse monitoring and legal compliance purposes
• Your inputs are processed on servers located outside Australia, primarily in the United States

If we change AI providers or move to a different service tier in a way that materially affects how your data is handled (for example, a tier under which inputs and outputs may be used for provider product improvement or may be subject to human review), we will update this policy and notify you at least 30 days before the change takes effect.

Regardless of the tier in use, do not submit personal information about yourself or others, commercially sensitive material, or confidential documents into AI features — this reduces privacy risk to you and to other people referenced in your inputs. If you are not comfortable with your inputs being processed under these conditions, please do not use the AI features of the Service.

3.2 Automated and AI-assisted processing (APP 1.7 — transparency about automated decisions)

We use computer programs (including AI) to generate informational outputs (answers, indicative site analyses, reports and drafts) using the personal information described in section 2.1 (for example, your queries and property/site details).

• These outputs do not constitute legally binding decisions about you. We do not use automated decision-making to refuse services, set prices for you individually, or determine your rights.
• Outputs may significantly affect your projects or decisions if you rely on them; that is why our Terms require independent verification and professional advice before reliance.
• You may obtain an explanation of the role of AI in your results, and request human review of any AI-related issue affecting your account, by contacting info@lighttune.com.au.

This section is provided in anticipation of the transparency obligations for automated decisions under privacy law amendments commencing 10 December 2026, and we will update it as those obligations commence.

3.3 Product improvement and de-identified use

Where you have not opted out (section 3.4), we may use de-identified inputs and outputs to improve the Service (for example, to improve retrieval quality, prompts and answer accuracy, including fine-tuning our own models using de-identified data). Our de-identification steps include:

• removing or altering direct identifiers such as names and account details;
• generalising street addresses to suburb or planning-area level and removing lot/DP identifiers; and
• excluding data that could be re-identified through combination with other sources.

De-identified data is generally not personal information under the Privacy Act; we take reasonable steps (including assessing re-identification risk before new uses such as model fine-tuning) to ensure that individuals are not reasonably identifiable in the data used for product improvement.

3.4 Consent management and opt-out

• Your product improvement preference is available in your account settings ("Data controls") and can be changed at any time; changes take effect for future processing.
• We keep a record of your consent choices (including the policy version and timestamps) so we can honour them.
• If you opt out, your content will be excluded from future product improvement datasets on a forward-looking basis; content already included in past de-identified datasets is not retrospectively removed.
• Opting out does not affect the processing needed to provide the Service to you.
• We do not use raw (non-de-identified) content to train our own models. If we ever propose to do so, we will ask for your express opt-in consent first, and you may decline or withdraw consent at any time (see our Terms, clause 9.3).

3.5 Aggregated and derived data

We may also create aggregated or statistical data derived from your use of the Service (for example, usage trends and anonymised analytics), and use and share such aggregate data for our legitimate business purposes (including commercial purposes), provided it does not identify you or any other individual. Aggregate data of this kind is not personal information under the Privacy Act. This section is separate from the product improvement preference in section 3.4 (which covers de-identified inputs and outputs), and does not limit your rights to access, correct, delete or export personal information under section 8.

4. Disclosure of Your Information

We may disclose your personal information to the following parties:

4.1 Service Providers

4.2 Channel Partners

If you access the Service through, or your account is provided under, a Channel Partner (for example, a buyer's agency that offers BuildMate to its clients), we may disclose to that partner:

• your account status (active/cancelled) and plan tier, and
• the reports or documents generated for you under that arrangement, where needed to deliver the Service.

Otherwise, your outputs and queries are not shared with the partner unless you direct us to or the partner arrangement expressly provides for it (in which case this policy and the partner's privacy policy both apply).

4.3 Other Disclosures

We may also disclose your information:

• Legal requirements: when required by law, regulation, or legal process
• Protection of rights: to protect our rights, privacy, safety, or property
• Business transfers: in connection with a merger, acquisition, or sale of assets
• With your consent: when you direct us to share your information

We do not sell your personal information to third parties.

5. Overseas Disclosure (APP 8)

Some of our service providers are located outside Australia. When we disclose your personal information overseas, we take reasonable steps to ensure that the overseas recipient handles your information in accordance with the Australian Privacy Principles.

Current overseas disclosures:

By using the Service, you acknowledge that your personal information may be disclosed overseas as described above.

6. Data Security (APP 11)

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

• Encryption in transit: all data transmitted using TLS/SSL encryption
• Encryption at rest: stored data encrypted using industry-standard algorithms
• Authentication: secure authentication protocols via Supabase Auth
• Access controls: strict access controls limiting who can view your data
• Data minimisation: we ask you not to submit sensitive or confidential information into AI features (see section 3.1), which reduces privacy risk to you
• Regular security assessments: periodic review of our security practices
• Data breach response: we maintain a data breach response plan so that suspected breaches can be assessed and, where required, notified without delay

However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

If a data breach occurs that is likely to result in serious harm to any individuals (an eligible data breach), we will assess it and, where required under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988 (Cth)), notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable. Suspected eligible breaches are assessed within 30 calendar days.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

When your personal information is no longer needed, we will take reasonable steps to destroy or de-identify it. Where personal information is de-identified or aggregated, the resulting de-identified or aggregate data may be retained and used after your account is closed or your personal information is deleted, as it is no longer personal information under the Privacy Act.

8. Your Rights

Under the Privacy Act, you have the right to:

8.1 Access (APP 12)

Request access to the personal information we hold about you. We will respond within 30 days.

8.2 Correction (APP 13)

Request correction of any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

8.3 Deletion

Request deletion of your account and associated personal information.

8.4 Data Export

Export your conversation history and generated reports in a machine-readable format.

8.5 Opt-Out

• Manage your product improvement preference (opt out of de-identified product improvement) at any time in your account settings (see section 3.4), or by contacting us
• Unsubscribe from marketing communications at any time. We send product updates and offers only where permitted under the Spam Act 2003 (Cth) (including where we have an existing relationship with you), and every marketing email includes an unsubscribe link

8.6 Explanation of AI processing

Ask us to explain the role of AI in your results or raise a concern about an AI-generated output affecting you (see section 3.2).

To exercise any of these rights, contact us at info@lighttune.com.au. We may need to verify your identity before processing your request. We will not charge you for making a request and will respond within 30 days. If we refuse your request, we will provide reasons and inform you of your right to complain.

9. Cookies and Tracking Technologies

We use cookies and similar technologies for:

You can control cookies through your browser settings. Note that disabling certain cookies may affect Service functionality.

10. Children's Privacy

BuildMate is not intended for individuals under 18 years of age, and our Terms require users to be 18 or older. We do not knowingly collect personal information from people under 18. If we become aware that we have collected personal information from someone under 18, we will take steps to delete it.

11. Complaints

If you believe we have breached the Australian Privacy Principles, you may:

1. Contact us first: email info@lighttune.com.au with details of your complaint
2. Our response: we will acknowledge your complaint within 5 business days and aim to resolve it within 30 days
3. External review: if you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Post: GPO Box 5218, Sydney NSW 2001

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• posting the updated policy on this page with a new "Last updated" date
• posting a notice in the Service, including in the Service's changelog
• where a change relates to how our AI providers or service tiers handle your data, giving you at least 30 days' notice before the change takes effect (see section 3.1 and our Terms, clause 13.1)

Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related enquiries, requests, or complaints:

• Email: info@lighttune.com.au
• Post: Wolli Creek NSW 2205