Privacy Policy

1. About this Policy

This Privacy Policy explains how Smart City Pty Ltd (“we”, “us”, “our”) collects, uses, stores, and shares your personal information when you use the bizzMate platform (smartcloudcrm.com and its subdomains, the “Service”). It also explains your rights and how to contact us about your privacy.

We are an Australian company subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where users are located in the European Union, the United Kingdom, or other regions with applicable privacy laws, this Policy is intended to comply with those laws as well, including the EU General Data Protection Regulation (GDPR) and the UK GDPR.

bizzMate is intended for business use only. We do not knowingly market to or collect personal information from individuals under 18 years of age.

2. Who we are

3. Information we collect

3.1 Information you provide directly

When you sign up for and use bizzMate, we collect information you provide to us, including:

• Name, email address, and password when you create an account.
• Workspace details such as company name, currency preference, time zone, and industry classification.
• Contact information for individuals you add to your CRM workspace (your customers, leads, contacts).
• Communications you send to us, including support requests and feedback.
• Billing details when you upgrade to a paid plan. Payment card information is collected directly by our payment processor (Stripe) and is not stored on our systems.

3.2 Information collected automatically

When you use the Service, we automatically collect certain technical information:

• IP address, browser type and version, operating system, and device identifiers.
• Pages or features accessed, actions taken, and timestamps.
• Session identifiers and authentication tokens (stored in cookies).
• Error logs and diagnostic information.

3.3 Customer data

As part of your use of bizzMate, you may upload or generate data about third parties (your contacts, leads, deal records, communications, files). We refer to this as “Customer Data”. Customer Data is processed by us on your instruction to provide the Service. You are responsible for ensuring you have a lawful basis to provide this data to us, and for complying with applicable privacy laws regarding the individuals it concerns.

4. How we use your information

We use the information we collect for the following purposes:

• Provide and maintain the Service: to operate bizzMate, deliver features you request, and authenticate your sessions.
• Process transactions: to bill subscriptions, manage trials, and handle conversions to paid plans through our payment processor.
• Send transactional emails: to verify your email, send magic-link logins, reset passwords, deliver workspace invitations, and notify you of important account events.
• Provide AI-assisted features: to generate summaries, suggestions, and other outputs using third-party AI providers (see section 5).
• Customer support: to respond to your enquiries and troubleshoot issues.
• Security and fraud prevention: to detect, prevent, and respond to security incidents, abuse of the Service, and unauthorised access.
• Improve the Service: to understand usage patterns, debug issues, and develop new features.
• Comply with legal obligations: where required by applicable law, including responding to lawful requests from authorities.

We do not sell your personal information or Customer Data to third parties. We do not use Customer Data to train AI models.

5. Sub-processors and third-party service providers

We share information with carefully selected service providers (“sub-processors”) to deliver the Service. Each sub-processor is bound by contractual obligations to protect data and use it only as instructed by us. Our current sub-processors are:

• Anthropic (United States): provides the AI model that powers bizzMate’s AI-assisted features. When you use AI features, relevant data (such as the text being summarised) is sent to Anthropic for processing. Anthropic does not retain this data to train its models when accessed via the API.
• Amazon Web Services (Australia): provides our transactional email infrastructure (Amazon SES) and is used to send verification, login, and notification emails. AWS data centres are located in the Asia Pacific (Sydney) region.
• Cloudflare (Global): provides DNS, content delivery and network security for bizzMate. Cloudflare may process limited technical data (IP addresses, request metadata) as part of these services.
• Cloudflare R2 (Global): provides off-site encrypted backup storage for our database and file backups.
• Stripe: processes payments and stores payment card information directly. We do not see or store your full payment card details. Stripe maintains its own PCI-DSS compliance; see Stripe’s documentation for the regions in which it processes payment data.
• Postmark (United States): provides fallback transactional email delivery in the event of primary email service issues.

We may engage additional sub-processors from time to time. Material changes to our sub-processor list will be communicated in advance via email and via the bizzMate dashboard.

6. International data transfers

Some of our sub-processors (Anthropic, Postmark) are located outside Australia, primarily in the United States. When personal information is transferred internationally, we rely on contractual safeguards such as the Standard Contractual Clauses approved by the European Commission (for EU/UK data subjects) and equivalent commitments under Australian law to ensure the data continues to be protected.

Backups are replicated off-site in encrypted form to Cloudflare R2, and transactional email is sent through Amazon SES in the ap-southeast-2 (Sydney) region. Sub-processor locations are set out in section 5 above.

We do not currently publish a data-residency guarantee for the Service as a whole. If you need a written statement about where specific categories of data are held — for example for a procurement, tender or compliance process — please contact us at privacy@smartcloudcrm.com and we will provide one.

7. Cookies and similar technologies

Inside the bizzMate Service, we use only cookies and similar technologies that are strictly necessary to deliver it. These include:

• Authentication cookies: to maintain your logged-in session and identify your workspace.
• Security cookies: to prevent cross-site request forgery and other attacks.
• Preference cookies: to remember small interface choices such as dismissed banners or theme settings.

Analytics on our public website. Our public marketing website (www.bizzmatecrm.com) uses Google Analytics 4 to understand which pages people find useful, but only with your agreement (see Your choice below). If you agree, it sets Google Analytics cookies and shares usage data with Google. We have disabled Google’s advertising features, so this data is not used for advertising or ad personalisation, and we do not send Google your name, email address, phone number, company, the content of any enquiry, or any CRM data.

Analytics runs on the public marketing website only. It is not loaded inside your signed-in workspace or the administration console, so your CRM records and the pages you view inside bizzMate are never sent to Google.

Your choice. Analytics only runs if you agree to it. When you first visit the public website we ask, and Google Analytics is not loaded at all — no script, no cookies, no data sent to Google — unless you choose “Accept analytics”. If you choose “Reject analytics”, it stays off.

You can change your mind at any time using Cookie preferences in the website footer, which lets you make the choice again. Your preference is stored in your own browser (in local storage, not a cookie sent to us) and records only which choice you made, when, and the version of these categories — nothing that identifies you.

We do not use advertising cookies or third-party advertising pixels, and Google’s advertising features are switched off. If we introduce advertising or other tracking technologies in the future, we will update this Policy and seek your consent where required by law.

8. Your privacy rights

8.1 Australian users (Privacy Act 1988)

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Make a complaint about how we handle your personal information.

If we cannot resolve your complaint to your satisfaction, you may lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au).

8.2 EU and UK users (GDPR and UK GDPR)

If you are located in the European Union or United Kingdom, you have additional rights, including:

• The right to be informed about our processing.
• The right of access to your personal data.
• The right to rectification of inaccurate data.
• The right to erasure (“right to be forgotten”).
• The right to restrict processing.
• The right to data portability.
• The right to object to processing.
• Rights related to automated decision-making and profiling (we do not currently make decisions affecting you solely by automated means).

To exercise any of these rights, please contact us using the details in section 12. You also have the right to lodge a complaint with your local supervisory authority.

8.3 Self-service rights

Within bizzMate you can independently:

• Update your profile information at any time via Settings.
• Export your workspace data via the data export feature.
• Delete your workspace, which initiates removal of all associated data.

9. Data security

We take reasonable steps to protect your information against loss, misuse, unauthorised access, modification, and disclosure. Our security measures include:

• Encryption of data in transit using TLS.
• Encrypted off-site backups, using authenticated encryption applied as each backup is created.
• Workspace-level isolation of every customer’s records, enforced in the data layer.
• Multi-factor authentication for administrative access.
• Regular security reviews and dependency updates.

No system is perfectly secure. We will notify you and applicable regulators of any data breach affecting your personal information in accordance with the Notifiable Data Breaches scheme under the Privacy Act and other applicable laws.

10. Data retention

We retain personal information for as long as your account is active and for a reasonable period afterwards as follows:

• Account data and Customer Data: retained while your account is active, and removed from production systems within 30 days of account deletion.
• Backups: retained for 30 days locally and up to 90 days off-site, after which they are securely deleted.
• Audit logs: retained for 1 year, or up to 7 years for billing-related logs as required by Australian taxation law.
• Legal compliance: where we are required to retain certain information by law, we will do so for the period required.

11. Children’s privacy

bizzMate is intended for business use only. We do not knowingly collect personal information from individuals under 18 years of age. If you become aware that a person under 18 has provided us with personal information, please contact us and we will take steps to remove that information.

12. How to contact us

For any privacy-related questions, requests, or complaints, please contact us:

13. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. For material changes, we will notify you by email and via the bizzMate dashboard at least 30 days before the changes take effect. The “Effective” date at the top of this Policy indicates when it was last revised.

Continued use of the Service after the effective date of a revised Policy constitutes your acceptance of the changes.