Privacy Policy

1. Introduction

This Privacy Policy outlines how Evolving Technologies Pty Ltd (ABN 72 654 819 128), trading as Valory AI ("we", "us", or "our"), collects, uses, discloses, stores, and protects personal information in connection with our AI voice agent platform and related services (collectively, the "Service").

We are committed to protecting your privacy and managing your personal information in an open and transparent manner, in accordance with the Privacy Act 1988 (Cth) (the "Privacy Act") and the Australian Privacy Principles (APPs).

This Policy applies to:

• our customers (businesses and organisations who subscribe to the Service); and
• where applicable, their end-users (the individuals who interact with the Service, such as callers, customers, patients, clients, or other persons).

We will only collect, use, and disclose personal information in accordance with the APPs and for purposes that are directly related to our functions and activities. Where we use or disclose personal information for a secondary purpose, we will do so only where that secondary purpose is directly related to the primary purpose of collection and the individual would reasonably expect such use or disclosure, or where we have obtained consent or are otherwise authorised by law (APP 6).

Your Business Customer's Role

When we process personal information about end-users (such as callers to your business), we generally do so on behalf of the business customer as a service provider(or "data processor"). The business customer is typically responsible for:

• determining what personal information is collected and how it is used;
• providing appropriate privacy notices to end-users explaining how their personal information will be collected and used;
• obtaining any required consents from end-users (including consent for call recording and, where applicable, the handling of Sensitive Information such as health information);
• ensuring that they have a lawful basis to collect and disclose personal information to us; and
• complying with their own obligations under the Privacy Act and applicable privacy laws.

If you are an end-user with questions about how a particular business handles your personal information, we encourage you to contact that business directly or refer to their privacy policy.

Our Contact Details

• Company Name: Evolving Technologies Pty Ltd
• Trading As: Valory AI
• ABN: 72 654 819 128
• Registered Address: 3 Albert Coates Lane, Melbourne, VIC 3000, Australia
• Privacy Contact Email: legal@valory.com.au
• Phone: +61 483 919 051

2. Information We Collect

We collect information that is reasonably necessary to provide, secure, and improve our Service (APP 3). We do not collect personal information unless it is reasonably necessary for, or directly related to, one or more of our functions or activities. The types of personal information we may collect include:

2.1 Account Information

When you register for the Service, we collect information necessary to create and manage your account, including:

• business name and trading name
• contact name and job title
• email address
• phone number
• Australian Business Number (ABN) or other business identifiers
• business address
• account credentials (e.g. passwords, which are stored in encrypted or hashed format).

2.2 Payment Information

To process subscriptions and usage fees, we collect billing details such as billing address, billing contact name, and payment method type. Payment information is securely processed by our third-party payment processors (such as Stripe). We do not store your full credit card numbers, debit card numbers, or bank account numbers on our systems.

2.3 Call Data

As the core of our Service, we process data generated from phone interactions ("Call Data"), including:

• call recordings and real-time audio streams
• call transcripts and AI-generated summaries
• call metadata (e.g. caller's phone number, recipient's phone number, timestamps, call duration, caller ID information)
• information provided by the caller during the conversation (e.g. name, contact details, reason for call, booking requests, appointment preferences, or other personal information disclosed during the call)
• booking, reservation, and scheduling details captured or created during the call
• AI-generated outputs, classifications, and actions taken during or as a result of the call.

Call Data may contain personal information about end-users (callers) and, in some cases, may include Sensitive Information depending on the nature of the call and the business being contacted. Call Data applies to both inbound calls received by the Service and outbound calls or SMS messages initiated through the Service on your behalf.

2.4 Sensitive Information (including Health Information)

Depending on how you use the Service, callers may share Sensitive Information (as defined in the Privacy Act), which includes (without limitation):

• health information (information about a person's physical or mental health, disabilities, or health services provided to them)
• racial or ethnic origin
• political opinions or membership of political associations
• religious beliefs or affiliations
• philosophical beliefs
• membership of professional or trade associations or unions
• sexual orientation or practices
• criminal record
• genetic information or biometric information.

We do not intentionally solicit or request unnecessary Sensitive Information. However, we may collect and handle Sensitive Information where it is:

• provided by you or your end-users voluntarily in the course of using the Service (for example, to make or manage a health-related appointment, or where a caller discloses health information relevant to their enquiry); and
• reasonably necessary for us to provide the Service to you.

We handle Sensitive Information in accordance with this Policy and the Privacy Act. We will only collect, use, or disclose Sensitive Information where:

• we have obtained consent (or the business customer has confirmed that appropriate consent has been obtained from the end-user);
• the collection, use, or disclosure is required or authorised by or under an Australian law or court/tribunal order;
• a permitted general situation or permitted health situation exists under the Privacy Act; or
• it is otherwise permitted under the Privacy Act and APPs.

For training and service improvement purposes, we will only use Sensitive Information in de-identified or aggregated form, or where appropriate consent has been obtained in compliance with the Privacy Act. We will not use identifiable Sensitive Information for cross-customer training or improvement purposes.

2.5 Voice Data

Call recordings processed through the Service contain voice characteristics of callers. We acknowledge that voice recordings may contain characteristics that could constitute biometric information (as defined in the Privacy Act). We do not create, store, or process voiceprints, speaker identification templates, or other biometric templates derived from call recordings. Voice recordings are processed solely for the purposes of providing the Service (including transcription, AI response generation, and call analytics) and are retained and deleted in accordance with Section 6 of this Policy.

2.6 Integration Credentials

To connect Valory with your other business tools and systems, we may collect and store (in encrypted format):

• OAuth tokens and refresh tokens
• API keys and access credentials
• other authentication credentials for third-party services (e.g. calendar systems, booking platforms, practice management systems, CRMs).

These credentials are stored securely and are used solely to facilitate the integrations you have authorised.

2.7 Usage Data

We automatically collect information about how you and your end-users interact with the Service, including:

• log data (e.g. IP addresses, browser type, operating system, access times, pages and features viewed, referring URLs)
• feature usage and interaction data (e.g. which features are used, frequency of use, configuration settings)
• error logs, crash reports, and performance metrics
• device information (e.g. device type, device identifiers, operating system version).

2.8 Cookies and Similar Technologies

We use cookies and similar technologies (such as web beacons, pixels, and local storage) to operate, secure, and analyse our Service, authenticate users, remember your preferences, and improve user experience. You can control cookie settings through your browser.

We use Google Analytics for optional website measurement only after you select Allow analytics. Before that choice, the Google Analytics tag does not load and no request is sent to Google. If allowed, we send a query-free Valory page URL built from the fixed https://www.valory.com.au origin and page path, the bounded campaign fields utm_source, utm_medium and utm_campaign, and bounded booking or call-to-action events. We do not send booking form details, names, email addresses, phone numbers, URL query strings, external or referrer URLs, or User-ID to Google Analytics. Advertising storage, Google Signals and advertising personalisation are disabled.

Your versioned analytics preference is stored in local storage and can be changed at any time using Cookie/analytics preferences in the website footer. Declining optional analytics does not prevent essential site functions from working. We also use Vercel Analytics in parallel for aggregate website measurement.

3. How We Use Information

We use the information we collect for the following purposes:

3.1 Google API Services User Data (Google Calendar Integration)

If you connect your Google account to use Google Calendar features, we access and process Google user data only as needed to provide and improve those user-facing features (for example, checking availability and creating or updating calendar bookings at your direction).

Valory's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

• We do not use Google user data for advertising, marketing targeting, or sale to data brokers.
• We do not use Google user data to develop, improve, or train generalized AI or ML models.
• We only share Google user data with service providers where required to operate the requested feature and subject to strict confidentiality and security obligations.

The AI training and model improvement language in this Policy does not apply to Google API Services user data.

• To Provide the Service:
  To set up and manage your account, process and manage phone calls (both inbound and outbound), handle bookings and scheduling, facilitate calendar and system integrations, generate AI outputs and responses, deliver call analytics and insights, and provide customer support.
• To Send Notifications:
  To send SMS confirmations, appointment reminders, and notifications to you and your end-users as part of the Service, in accordance with your configurations.
• To Facilitate Outbound Communications:
  Where you use the Service to initiate outbound calls or SMS messages, we process recipient phone numbers, call outcomes, call content, and related metadata to facilitate those communications at your direction. You are responsible for ensuring that all outbound communications comply with applicable laws, including the Do Not Call Register Act 2006 (Cth) and the Spam Act 2003 (Cth). Please refer to our Terms of Service for your full compliance obligations.
• To Manage Your Account and Process Payments:
  To process payments, manage subscriptions, track usage-based billing, send invoices, and send administrative communications about your account.
• To Communicate With You:
  To respond to support requests, enquiries, and feedback, and to send important updates about the Service (including security alerts, service changes, and policy updates).
• For Service Improvement and Analytics:
  To analyse usage patterns, diagnose technical issues, fix bugs, improve performance, develop new features, and enhance the overall quality of the Service.
  
  AI Training and Model Improvement: We may use Call Data to train, refine, and improve our AI models, voice processing capabilities, and natural language understanding. For clarity, this does not include Google API Services user data described in Section 3.1. When doing so:
  • We primarily rely on aggregated or de-identified information, including de-identified Call Data, for these purposes wherever reasonably practicable.
  • We do not use identifiable Call Data to train models for other customers in a way that would allow those customers to identify you, your business, or any individual end-user.
  • Cross-customer training and model improvement occurs only on data that has been aggregated or de-identified.
  • Where Sensitive Information is involved, we will only use it for training or improvement purposes in de-identified or aggregated form, or where we have obtained appropriate consent in accordance with the Privacy Act and APPs.
• For Direct Marketing (Customers Only):
  We may use your business contact details to send you information about our services, new features, product updates, and events. You can opt out of marketing communications at any time by following the unsubscribe instructions in our communications or by contacting us at legal@valory.com.au. We will process your opt-out request within a reasonable period (APP 7.7(a)). We do not use end-user personal information for direct marketing purposes.
• For Security and Compliance:
  To protect the security, integrity, and availability of our platform; prevent, detect, and respond to fraud, abuse, security incidents, and other harmful activities; enforce our Terms of Service; and comply with our legal and regulatory obligations.
• For Legal Purposes:
  To establish, exercise, or defend legal claims; to comply with court orders, subpoenas, and regulatory requests; to resolve disputes; and to protect our legal rights and interests.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share personal information under the following limited circumstances:

4.1 Third-Party Service Providers

We engage third-party companies and service providers to perform functions on our behalf. These providers are contractually required to protect your data, maintain confidentiality, and are restricted to using personal information only for the purposes we specify and in accordance with our instructions. Categories of service providers include:

• Payment Processors: To process subscription and usage payments securely (e.g. Stripe).
• Database Hosting and Authentication Providers: To host our application databases, provide authentication services, and secure user accounts (e.g. Supabase, Clerk).
• Telephony and SMS Service Providers: To provide phone call routing, SMS messaging, and related telephony infrastructure (e.g. Twilio, Vapi).
• AI and Voice Processing Providers: To provide AI voice generation, speech recognition, natural language processing, large language model (LLM) capabilities, and conversational AI features (e.g. ElevenLabs, OpenAI). These providers may process audio, transcripts, and related data to deliver the Service and are subject to contractual confidentiality and security obligations.
• Hosting and Infrastructure Providers: To provide application hosting, content delivery networks (CDNs), cloud computing, monitoring, logging, and other infrastructure services (e.g. Vercel, AWS).
• Analytics and Monitoring Providers: To provide analytics, error tracking, performance monitoring, and service improvement insights (e.g. Google Analytics, Sentry, Vercel Analytics). Google Analytics is consent-gated as described in Section 2.8.

We maintain a list of our material sub-processors (third-party service providers who process personal information on our behalf) and will make this list available upon reasonable written request to legal@valory.com.au. We will provide reasonable prior notice before engaging any new sub-processor that will have access to Customer Data, as described in our Terms of Service.

4.2 Your Connected Integrations

When you connect a third-party service (e.g. a calendar, booking platform, practice management system, or CRM) to your Valory account, we will share information with that service as directed by you and as necessary to facilitate the integration and provide the features you have enabled.

4.3 Professional Advisers

We may disclose personal information to our professional advisers (including lawyers, accountants, auditors, and insurers) where reasonably necessary for the purposes of obtaining professional advice, managing legal proceedings, or administering insurance claims. Such disclosures are made under obligations of professional confidence.

4.4 Legal Requirements

We may disclose your personal information if required to do so by law or in response to a valid legal process, such as a court order, subpoena, warrant, or government or regulatory investigation (including by the OAIC, ACMA, ACCC, or other regulatory body). We may also disclose information where we believe in good faith that disclosure is necessary to:

• comply with applicable laws, regulations, or legal processes;
• protect the rights, property, or safety of Valory, our customers, or others;
• prevent or investigate possible wrongdoing or illegal activity;
• enforce our Terms of Service or other agreements.

4.5 Business Transfers

In the event of a merger, acquisition, sale of assets, corporate restructuring, financing, change of control, or insolvency event, your personal information may be transferred as part of that transaction. We will take reasonable steps to ensure that any recipient continues to handle your personal information in accordance with this Policy and applicable law, and we will provide notice of any such transaction where required by law.

5. Data Security

We implement reasonable technical and organisational measures designed to protect the personal information we process against unauthorised access, modification, disclosure, destruction, or loss (APP 11). These measures include:

• Encryption: Personal information is encrypted in transit (using TLS/SSL) and at rest (using industry-standard encryption algorithms).
• Access Controls: We enforce strict access controls and the principle of least privilege, so that only authorised personnel can access personal information on a need-to-know basis.
• Secure Architecture: Our platform uses secure architecture with logical data isolation to ensure customer data is separated and protected.
• Credential Security: Sensitive credentials, such as passwords, API keys, and tokens, are stored in encrypted or hashed format and are never stored in plain text.
• Security Monitoring: We implement security monitoring, logging, and alerting to detect and respond to potential security threats.
• Incident Response: We maintain documented procedures to detect, respond to, contain, and mitigate potential security incidents and data breaches.
• Vendor Security: We assess the security practices of our third-party service providers and require them to maintain appropriate security measures.
• Personnel: Our personnel with access to personal information are subject to confidentiality obligations and receive guidance on privacy and security responsibilities.

While we take security seriously and strive to use commercially reasonable means to protect personal information, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, and we cannot warrant that the Service will be immune from security vulnerabilities, cyberattacks, or data breaches.

5.1 Data Breach Notification

In the event of a data breach involving personal information, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). This means:

• We will conduct a reasonable and expeditious assessment of any suspected data breach to determine whether it is likely to result in serious harm to any individual whose personal information is involved.
• If we determine that a breach is an "eligible data breach" within the meaning of the Privacy Act, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, in accordance with the requirements of the NDB scheme.
• Where we process personal information on behalf of a business customer (as a service provider), we will notify the affected business customer without undue delay after completing our initial assessment, to enable the business customer to meet its own notification obligations. The specific notification procedures are described in our Terms of Service.
• We will take reasonable steps to contain, investigate, remediate, and mitigate the effects of any data breach.

6. Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, to provide the Service, to comply with our legal obligations, resolve disputes, and enforce our agreements (APP 11.2). Our general retention practices are as follows:

• Account Information: Retained for as long as your account is active and for a reasonable period thereafter (typically up to 12 months) for legal, accounting, administrative, and record-keeping purposes, unless a longer period is required by law.
• Call Data: Retained for the period you configure in your account settings, or for a default period of ninety (90) days if no retention period is configured, unless we are required to keep it longer for legal, regulatory, or contractual reasons.
• Payment Records: Retained for at least seven (7) years as required by Australian taxation law.
• Usage Data and Logs: Retained for up to twenty-four (24) months for analytics, security monitoring, and service improvement purposes, unless a shorter or longer period is required for a specific purpose.
• Google Analytics Event and User Data: Retained in Google Analytics for fourteen (14) months. The retention period is not reset by new user activity.

6.1 De-identification

Where we refer to "de-identified" information in this Policy, we mean information from which we have removed or altered personal identifiers such that a reasonable person in our position would not be able to re-identify the individual to whom the information relates, having regard to all reasonably available means and the information available to us. Our de-identification processes may include removing names, phone numbers, email addresses, and other direct identifiers; generalising or aggregating data; and applying technical measures to reduce re-identification risk. We periodically review our de-identification practices in light of technological developments and emerging guidance from the OAIC.

6.2 What Happens After the Retention Period

We take reasonable steps to delete or de-identify Call Data after the applicable retention period. In practice, this may include deleting call recordings (where stored), deleting transcripts and call-linked execution logs, and scrubbing personal identifiers (such as phone numbers) from call records, while retaining minimal metadata needed for billing, security, and legal compliance.

We may retain aggregated or de-identified information (which does not identify you or any individual) indefinitely for analytics, research, benchmarking, and service improvement purposes.

For clarity, this retention statement does not expand how we use Google API Services user data, which remains subject to Section 3.1 and applicable law.

6.3 After Account Termination

Following termination of your account, we will take reasonable steps to delete or de-identify your personal information within a reasonable timeframe (subject to any applicable retention period you have configured), except where we are required or permitted to retain it for:

• compliance with applicable law (including taxation, accounting, and regulatory requirements);
• legitimate record-keeping and audit purposes;
• dispute resolution, enforcement of our Terms of Service, or protection of our legal rights;
• backup, disaster recovery, and business continuity purposes (subject to eventual deletion in the ordinary course).

You may request the deletion of your account and associated personal information by contacting us at legal@valory.com.au. We will process such requests in accordance with our obligations under the Privacy Act. For information about exporting your data before or after account termination, please refer to our Terms of Service.

7. Your Rights (Australian Privacy Act)

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have certain rights regarding your personal information. These rights apply to both customers and individuals (including end-users) whose personal information we may hold.

7.1 Right to Access

You may request access to the personal information we hold about you (APP 12). We will respond to access requests within a reasonable period (usually within 30 days) and will provide access to the information in the manner you request, if it is reasonable and practicable to do so. We may charge a reasonable fee for providing access in certain circumstances. We may refuse access in limited circumstances permitted by law, in which case we will provide you with written reasons for the refusal and information about how to make a complaint.

7.2 Right to Correction

You may request correction of any personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13). We will take reasonable steps to correct the information if we are satisfied that the information is inaccurate, out of date, incomplete, irrelevant, or misleading, having regard to the purpose for which it is held. If we refuse to correct the information, we will provide you with written reasons and information about how to make a complaint.

7.3 Right to Request Deletion

Where we hold personal information about you that is no longer needed for any purpose for which it may be used or disclosed under the APPs, and we are not required by law to retain it, we will take reasonable steps to destroy or de-identify that information (APP 11.2). You may request that we delete your personal information by contacting us at legal@valory.com.au. We will assess each request on its merits and inform you of the outcome.

7.4 Right to Opt Out of Direct Marketing

You have the right to opt out of receiving direct marketing communications from us at any time (APP 7.6). You can do so by: (a) following the "unsubscribe" link in any marketing email; (b) contacting us at legal@valory.com.au; or (c) updating your communication preferences in your account settings. We will process your opt-out request as soon as practicable and will not charge you for making such a request. You may also request that we provide you with the source of the information used for direct marketing purposes (APP 7.6(c)).

7.5 Right to Anonymity and Pseudonymity

Where practicable, you have the option of not identifying yourself or using a pseudonym when dealing with us (APP 2). However, given the nature of the Service (which requires account registration, payment processing, and business identification), it is generally not practicable for customers to use the Service anonymously or under a pseudonym. End-users who call your business may choose not to identify themselves during a call, but this may affect the service they receive from your business.

7.6 Right to Make a Complaint

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, you may make a complaint by contacting us at legal@valory.com.au with the details of your complaint. We will investigate your complaint and respond within a reasonable time (usually within 30 days).

If you are not satisfied with our response or how we have handled your complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Post: GPO Box 5288, Sydney NSW 2001

7.7 Exercising Your Rights

To exercise any of the above rights, please contact us at legal@valory.com.au. We may need to verify your identity before processing your request to protect the security of personal information. We will not charge you for making a request (except where a reasonable fee for access is permitted under APP 12.8).

Note for End-Users: If you are an end-user (e.g. a caller) whose personal information has been collected by a business using our Service, you should first contact that business directly to exercise your privacy rights. We will assist businesses in responding to legitimate privacy requests from their end-users as required.

8. International Data Transfers

Our Service is primarily hosted and operated in Australia. However, in providing the Service, we use third-party service providers (as described in Section 4.1) that may be located in or process personal information from data centres located outside Australia.

These providers may be based in or process data from countries including the United States (e.g. Google Analytics, Stripe, Twilio, OpenAI, ElevenLabs, Vercel, AWS, Sentry) and the European Union, among others. The specific countries may change from time to time as we engage new providers; our current sub-processor list (available upon request) identifies the countries in which each material sub-processor operates.

When we transfer personal information internationally, we take reasonable steps to ensure that overseas recipients do not breach the Australian Privacy Principles (APPs) in relation to such personal information, in accordance with APP 8. These steps may include:

• entering into appropriate contractual arrangements with overseas recipients that require them to handle personal information in a manner consistent with the APPs;
• conducting due diligence and security assessments of overseas service providers;
• selecting providers that are subject to privacy laws or frameworks that provide comparable protections to the Privacy Act;
• implementing technical and organisational safeguards to protect personal information during and after transfer.

We only transfer personal information overseas where it is necessary for the purposes described in this Policy, where we have taken appropriate safeguards, or where we are required to do so by law.

Important: Where we disclose personal information to an overseas recipient and we have taken reasonable steps under APP 8.1 to ensure the recipient does not breach the APPs, we remain accountable under the Privacy Act if the overseas recipient handles the information in a way that breaches the APPs. By using our Service, you acknowledge the transfer of personal information to locations outside Australia as described in this Section, subject to the safeguards described above and in accordance with the Privacy Act.

9. AI and Automated Processing

The Service uses artificial intelligence and automated processing to handle calls, generate responses, create bookings, and perform other actions. In the interests of transparency, we provide the following information about how AI processing relates to your personal information:

• How AI processes personal information: When a call is handled by the Service, the caller's voice is processed in real time by AI speech recognition and language models to generate transcripts, understand intent, and produce spoken responses. Personal information disclosed during the call (such as names, contact details, and appointment preferences) is extracted and processed by AI to perform actions configured by the business customer (such as creating bookings or sending confirmations).
• AI limitations and accuracy: AI outputs are generated probabilistically and may be inaccurate, incomplete, or inappropriate. The Service does not make autonomous decisions that produce legal effects or similarly significant effects on individuals without human oversight by the business customer. Business customers are responsible for reviewing, validating, and overseeing AI outputs.
• AI disclosure to callers: Business customers are required under our Terms of Service to inform callers that they are interacting with an AI-powered voice agent, not a human being.
• Data minimisation: We process only the personal information that is reasonably necessary to provide the Service and to fulfil the purposes described in this Policy. We do not retain raw audio streams beyond the period necessary for real-time processing, unless call recording has been enabled by the business customer.

10. Children's Privacy

Our Service is designed for use by businesses and is not intended for, or directed at, individuals under the age of 18. We do not knowingly collect personal information directly from children.

If you are a business customer whose end-users may include minors (for example, a medical practice where parents call to book appointments for their children), you are responsible for ensuring that you have obtained appropriate parental or guardian consent for the collection of any personal information about minors and for providing appropriate privacy notices.

If we become aware that we have inadvertently collected personal information from a child without appropriate consent, we will take reasonable steps to delete such information as soon as practicable. If you believe we have collected personal information about a child inappropriately, please contact us at legal@valory.com.au.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational or business reasons. When we make material changes to this Policy, we will notify you by:

• posting the updated Policy on our website with a new "Last Updated" date; and/or
• sending an email to the contact email address associated with your account; and/or
• providing a notice within the Service.

We will endeavour to provide at least thirty (30) days' notice of material changes where practicable. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

The updated Policy will take effect from the date it is posted (as indicated by the "Last Updated" date), unless otherwise stated. If you do not agree to a material change, you may terminate your use of the Service by providing written notice to us before the updated Policy takes effect. Your continued use of the Service after the updated Policy takes effect constitutes your acknowledgement of the updated Policy and your agreement to be bound by its terms.

12. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise any of your privacy rights, please contact us:

• Privacy Contact: Privacy Officer
• Email: legal@valory.com.au
• Phone: +61 483 919 051
• Post: Evolving Technologies Pty Ltd, 3 Albert Coates Lane, Melbourne, VIC 3000, Australia

We will endeavour to respond to your enquiry as soon as reasonably practicable and within any timeframes required by law.