Privacy Notice

PiVOTiQ Commercial Intelligence (ABN 90 666 355 666), an Australian entity ("PiVOTiQ", "we", "us"), handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. PiVOTiQ provides AI-enabled commercial intelligence on construction contracts from Australia to clients across Australia and internationally.

This notice explains what personal information we collect, how we use it, who processes it on our behalf (our operators), how long we keep it, and the rights available to you under the Privacy Act 1988 (Cth). It should be read with our Terms & Conditions and Disclaimer.

• Contract documents and project material you submit for review (which may contain personal information of your personnel or counterparties)
• Intake-form details describing the contract, trade, value band and the questions you want addressed
• Contact and account details — name, role, organisation, email, phone, city/province, and your accounts-payable contact
• Payment metadata — plan, tier, invoice and transaction references. Card details for month-to-month plans are handled directly by Stripe; PiVOTiQ does not store card numbers
• Correspondence with us, and the timestamp and IP address captured by our intake form as an audit record of submission and consent
• Where you use CRI Live — your messaging-channel identifier (for example, your Telegram chat ID), the mobile number or account you register for the service, and the questions you send together with the answers returned to you

We process the information above to deliver the service you have requested and to operate our business lawfully:

• To produce, quality-check and deliver your Contract Review Pack and reports
• To issue invoices, process payments and maintain financial and tax records
• To respond to your enquiries and provide support
• To meet our legal, regulatory and record-keeping obligations

We do not sell personal information, and we do not use it for advertising.

Automated report generation

PiVOTiQ's automated delivery pipeline uses Anthropic's Claude AI via PiVOTiQ's API account, governed by Anthropic's Commercial Terms of Service. Under those terms, data submitted via the API is not used to train Anthropic's AI models and is subject to a standard 30-day retention period for operational and abuse-monitoring purposes only.

Manual quality review and commercial extraction

Elements of PiVOTiQ's quality-review process may also involve Anthropic's Claude AI accessed through an individual Claude Max subscription (claude.ai). The Claude Max plan is governed by Anthropic's consumer Terms of Service and Privacy Policy. Under consumer terms, Anthropic may use conversation data to improve its models unless the account holder has opted out of model training in their account settings. PiVOTiQ operates this account with the training opt-out active.

In both pathways above, a person on the PiVOTiQ team reviews every report before it is delivered. AI processing supports the analysis; it does not make the final commercial determination presented to you.

CRI Live — real-time answers

Where you use CRI Live, your question is processed through Anthropic's Claude AI via PiVOTiQ's API account, on the same Commercial Terms described above, and answered strictly from the completed reports already issued for your contract. Unlike a report, an individual CRI Live answer is not reviewed by a person before it is returned to you — the human quality review sits upstream, on the reports the answer draws from. Your questions and the answers returned are transmitted through the messaging platform you use to access the service (see §5) and are subject to that platform's own privacy policy in addition to this notice.

We engage the following categories of operator to deliver the service. Each is engaged under contractual confidentiality and data-protection terms, and is not authorised to use your information for any purpose beyond delivering the service:

We keep this list current and update it when our operators change.

PiVOTiQ is an Australian entity. Several of our operators are located outside Australia — in the United States and the European Union (see the sub-processor table in §5). Where you use CRI Live, messages are also transmitted through a messaging platform operating outside Australia. By submitting information to PiVOTiQ, and by registering for CRI Live if you choose to use it, you consent to your information being processed by those operators for the purposes of delivering the service.

Before disclosing personal information to an overseas recipient, PiVOTiQ takes reasonable steps to ensure the recipient does not breach the Australian Privacy Principles in relation to that information, or the disclosure is permitted under APP 8. Electronic submissions are recognised under the Electronic Transactions Act 1999 (Cth).

We retain client contract documents and report records for 12 months after report delivery, after which they are deleted, unless we are required to keep them longer to meet a legal or tax obligation. We will delete submitted contract documents earlier on written request, subject to those obligations. Financial records are retained for the period required by applicable law.

For CRI Live, we retain the registration record linking your messaging-channel identifier to your contract for as long as the CRI Live subscription for that contract remains active. On cancellation, that registration record is deleted and access ends. Message content sent and received through the messaging platform remains in your own account on that platform and is governed by its retention settings, which are outside PiVOTiQ's control — you can delete it there at any time.

Under the Privacy Act 1988 (Cth), you have the right to:

• Request access to the personal information we hold about you (APP 12)
• Request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13)
• Make a complaint about a breach of the Australian Privacy Principles
• Have your complaint handled and investigated in a reasonable time
• Escalate unresolved complaints to the Office of the Australian Information Commissioner (OAIC)

To exercise any of these rights, contact us using the details below. We may need to verify your identity before acting on a request. Complaints may be lodged with the OAIC at www.oaic.gov.au.

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, and unlawful processing, and we require our operators to maintain a comparable standard. No system can be guaranteed completely secure; we manage this risk on an ongoing basis.

A decision on website analytics tooling has not yet been finalised. If a privacy-friendly, cookieless analytics tool is adopted (such as Plausible), no cookie banner will be required and this section will be updated to confirm that position. If a tool that sets cookies is adopted, a cookie banner will be added before go-live and this section updated accordingly. No analytics cookies are currently set on the PiVOTiQ website.

We may update this notice from time to time by publishing a revised version on this page. Material changes will be reflected in the version and effective date above.

Information Officer / Contact

• Email: enquiries@pivotiq.com.au
• Payments: payments@pivotiq.com.au
• Website: www.pivotiq.com.au
• Entity: PiVOTiQ Commercial Intelligence | ABN 90 666 355 666