[LEGAL REVIEW REQUIRED] The text below is a conservative draft authored to spec §15. Specific clauses are flagged with [LEGAL REVIEW REQUIRED] in-line. Final wording must be reviewed and signed off by your legal counsel before this banner is removed (set LEGAL_DOCS_REVIEWED=true).

Neomeric Pty Ltd · NeoMind

Privacy Policy

Last updated:

Neomeric Pty Ltd (ACN [OWNER INPUT REQUIRED: Australian Company Number (ACN)], ABN [OWNER INPUT REQUIRED: Australian Business Number (ABN)]) handles personal information in accordance with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth). This Policy explains what we collect, why, who we share it with, and the choices you have.

1. Information we collect

We collect personal information you provide directly, including:

  • Account information — name, email address, organisation.
  • Phone number — optional; only if you give it to us.
  • Billing information — payment-card metadata (last 4 digits, expiry, brand) and tax identifiers; full card numbers are handled by our payment processor (Stripe) and never stored on Neomeric servers.
  • Content you upload to ground your agents — documents, FAQs, website crawls (“Customer Data”).
  • Operational metadata — IP address, browser, pages visited, actions performed inside the dashboard.

2. How we use it

We use personal information to:

  • Provide and improve the Service;
  • Process payments and provide receipts;
  • Communicate with you about your account and the Service;
  • Detect, investigate and prevent fraud, abuse and security incidents;
  • Comply with legal obligations.

We do not sell personal information. We do not train foundation models on Customer Data.

3. Sub-processors

We engage a small number of sub-processors to provide the Service. At the date of this Policy, those include:

  • Microsoft Azure (hosting, database, storage, Azure OpenAI language, image and voice models, and Azure Speech; Australia East where available).
  • Azure Communication Services (email).
  • Telnyx and Twilio (phone numbers and calls).
  • Rime (text-to-speech for some voice calls).
  • Stripe (payments).
  • PostHog Inc. (product analytics and session recording; EU-hosted cloud).
  • Microsoft Corporation, via Microsoft Clarity (session recording and heatmaps).
  • Cloudflare Turnstile (sign-up bot protection).
  • Meta and Google (only when you connect those accounts).
  • DataForSEO and SE Ranking (search keyword data — no personal information sent).
  • BytePlus ModelArk (image generation from prompts).

PostHog and Microsoft Clarity receive information about how the dashboard is used — pages viewed, clicks, and session recordings in which typed text and your customers’ conversation content are masked — linked to internal account identifiers rather than your name or email address. This information is processed outside Australia. See the Cookies notice for details and how to opt out.

3A. Connected accounts (Facebook, Instagram, Google, WordPress)

When you connect an outside account, we collect only what the features you switch on need:

  • Facebook and Instagram (Meta): your Page’s name and ID, the linked Instagram account’s ID, an access token (encrypted), the permissions you granted, and the app-scoped ID of the Facebook login that connected it (so we can act on a deletion request). We also hold the posts we publish for you; the comments, mentions and messages people send to your Page or Instagram account, including the name Meta shows for them; and, if you allow it, figures showing how your posts perform.
  • Google: the email address of the Google account you connect, a refresh token (encrypted), and the Analytics property, Search Console site, Tag Manager container, Business Profile location or calendar you choose. We also hold the reporting data we read (such as website traffic, search queries and positions), the configuration changes we make with your approval, your Business Profile reviews, the calendar events and free/busy times we read or create for bookings, and the Google Drive files you choose to share with NeoMind.
  • WordPress: your site address, an application credential (encrypted), and the posts and pages we create or update for you.

We use this data only to provide those features: drafting and publishing for you, answering your customers, and reporting to you. We do not sell it, use it for advertising, or use it to train generalised AI models. It is processed for us, under contract, by the providers listed in section 3, including our hosting provider (Microsoft Azure, Australia region) and our AI model providers.

Deletion. Disconnecting an account under Settings → Integrations immediately deletes the credential we stored for it (an access token, refresh token or application password) and, for Facebook and Instagram, the copy of direct messages stored with that connection. For WordPress, also delete the application password in your WordPress profile. If you remove NeoMind from your Facebook account, Meta tells us and we delete or anonymise what we received through it, as listed on how to delete your Facebook and Instagram data; you can track progress with the confirmation code Facebook gives you. You can also ask us to delete a connection’s data at any time by emailing privacy@neomeric.com. Technical copies of the notifications platforms send us are trimmed within 30 to 90 days.

3B. Google user data

NeoMind's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data we receive from Google:

  • We use it only to provide or improve features you can see and use in NeoMind.
  • We do not transfer it to anyone else, except as needed to provide those features, to comply with the law, to protect against fraud or abuse, or as part of a merger or sale of our business with your consent.
  • We do not use it for advertising, and we do not sell it.
  • No person at NeoMind reads it unless you ask us to (for example in a support request), it is needed for security or to comply with the law, or it has been aggregated and anonymised for internal operations.
  • We do not use it to train generalised AI or machine-learning models.
  • We do not use it to assess creditworthiness or for lending.

3C. Calls and help sessions with Aria

Aria is NeoMind’s AI assistant. Help sessions with Aria can happen in the app, by voice or chat, and — if you have agreed — by phone, from our Australian number +61 3 9003 0249.

  • Purpose: to help with your setup and your account, and to ask about your experience of NeoMind.
  • Aria always says it is an AI assistant, and that the call is transcribed.
  • We keep a written transcript and the outcome of the call, not an audio recording. Transcripts are kept in line with the Retention section of this Policy.
  • Phone calls are made only to Australian numbers, at reasonable hours on weekdays and Saturdays, never on Sundays or national public holidays.
  • You can withdraw your consent at any time in Settings → Profile, by asking Aria to stop calling, or by emailing privacy@neomeric.com. Withdrawal takes effect immediately.

4. Storage and security

Customer Data is stored in Australia by default. We apply commercially reasonable technical and organisational measures (encryption in transit, encryption at rest, network isolation, least-privilege access) appropriate to the sensitivity of the information.

5. Disclosure

We disclose personal information only to: (a) sub-processors who need it to deliver the Service; (b) law-enforcement or regulators where required by law; and (c) acquirers in the event of a merger or sale, subject to equivalent privacy obligations.

6. Your rights

Under Australian law you may request access to, or correction of, the personal information we hold about you. Contact privacy@neomeric.com.

If you are an end user of a NeoMind-powered service (e.g. a customer of one of our tenants), your primary point of contact is the tenant operating that service. We act as their processor.

7. Retention

Customer Data is retained while your account is active and for up to ninety (90) days after closure, after which it is permanently deleted from primary systems and rotated out of backups in line with our backup cycle.

8. Cookies

See our Cookies notice for details about session cookies, analytics, and consent management.

9. Complaints

If you believe we have mishandled your personal information you may complain to privacy@neomeric.com. If unresolved, you may escalate to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Changes

We may update this Policy from time to time. Material changes will be notified to the account owner at least fourteen (14) days in advance via email and a dashboard banner.