Investor Pilot Pty Ltd, ABN 96 101 887 272, PO Box 2502 Graceville, Qld 4075 (“Investor Pilot”, “we”, “us”, “our”) provides tools to plan, track and analyse investments via our website and web application / Progressive Web App (the “Services”).

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have in relation to it. It applies to all users of the Services regardless of location, and is supplemented by the Regional Addenda below where local law requires additional disclosures.

By using the Services you acknowledge you have read this Privacy Policy. If you do not agree, please discontinue use of the Services.

• Account information: name, email address, password (stored as a one-way hash — we never store your plain-text password), and country or region preference.
• Usage information: pages and features accessed, device type, operating system, browser type and version, approximate location derived from IP address, session timestamps, and crash or error logs.
• Investment data you provide: holdings, transactions, purchase prices, portfolio targets, notes, and any other financial information you choose to enter into the Services. This data belongs to you and is not used for any purpose other than providing the Services to you.
• Support information: messages, feedback, bug reports, and related metadata you submit when contacting us.
• Optional information: marketing preferences, cookie consent choices, referral codes, and any additional profile information you voluntarily provide.
• Payment information: if you subscribe to a paid plan, billing is handled by our payment processor. We receive confirmation of payment and your billing plan details but do not store full card numbers or bank account details.

We collect information directly from you when you register or use the Services, automatically through cookies and similar technologies (see our Cookie Policy), and from third parties such as our payment processor and, where you enable it, broker integrations.

We use personal information only for the purposes described below. We do not use your investment data for advertising, profiling for third parties, or any purpose unrelated to providing the Services to you.

• Providing and operating the Services: to create and manage your account, process transactions, deliver features, and communicate essential service information.
• Personalisation: to apply your region, currency, and display preferences and to tailor the experience to your use of the Services.
• Alerts and notifications: to send the alerts, signals, and portfolio notifications you enable. You can manage these in your account settings at any time.
• Performance and improvement: to measure how the Services are used, diagnose technical problems, fix bugs, and develop new features. Where possible we use aggregated or anonymised data for this purpose.
• Marketing communications: to send product updates, newsletters and offers, but only if you have opted in. You may unsubscribe at any time using the link in any marketing email or via your account settings.
• Security and fraud prevention: to detect, investigate and prevent unauthorised access, fraud, abuse, and other security incidents, and to enforce our Terms of Service.
• Legal compliance: to meet applicable legal and regulatory obligations, respond to lawful requests from authorities, and protect the rights, property or safety of Investor Pilot, our users, or others.

Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data, we rely on the following legal bases:

• Contract (Article 6(1)(b)): processing necessary to provide the Services you have signed up for, including account management, delivering features, and sending essential service communications.
• Legitimate interests (Article 6(1)(f)): processing necessary for our legitimate interests, including improving the Services, preventing fraud and abuse, and maintaining security — provided these interests are not overridden by your rights and interests.
• Consent (Article 6(1)(a)): where you have given us your specific, informed consent — for example, for optional marketing emails or non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Article 6(1)(c)): processing required to comply with applicable law, including financial record-keeping and responding to lawful authority requests.

For EU/UK users, additional details are set out in Regional Addendum B below.

We use strictly necessary cookies to operate the Services (including session management and security) and, with your consent, preference and performance cookies to improve your experience. If you install our Progressive Web App, we may also use local storage and service workers.

For full details of the cookies we use, how long they are retained, and how to manage your preferences, please see our Cookie Policy.

We do not sell, rent or trade your personal information. We share data only in the following circumstances:

• Service providers: we use vetted third-party providers who process data on our behalf under written contracts that include data protection obligations. Categories of providers include: cloud hosting and infrastructure, analytics, transactional and marketing email delivery, payment processing, error monitoring, and (where you enable it) broker data integrations.
• Legal requirements: we may disclose information if required to do so by law, court order, or valid government request, or where necessary to protect the rights, safety or property of Investor Pilot, our users, or the public.
• Business transfers: if Investor Pilot is involved in a merger, acquisition, restructure or sale of assets, personal information may be transferred as part of that transaction. We will notify you via email or an in-app notice before your personal information is transferred and becomes subject to a different privacy policy.
• With your consent: we will share your information for any other purpose with your explicit consent.

Investor Pilot is based in Australia. Our service providers may be located in other countries, meaning your personal information may be processed outside Australia or your country of residence, including in the United States and the European Economic Area.

Where we transfer personal data outside Australia or the EEA, we take steps to ensure an adequate level of protection, including:

• Transferring to countries with an adequate level of data protection as recognised by relevant authorities;
• Using Standard Contractual Clauses (SCCs) approved by the European Commission or UK equivalents where applicable; or
• Relying on other lawful transfer mechanisms permitted by applicable law.

You may contact us to request further information about the safeguards we apply to international transfers.

We retain personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Our general retention periods are:

• Account and investment data: retained for the duration of your account and for up to 7 years after account closure for tax, legal and accounting purposes.
• Usage and analytics data: anonymised or aggregated within 26 months; raw event logs deleted sooner where possible.
• Support communications: retained for up to 3 years to help resolve future queries and improve our Services.
• Marketing preferences: retained until you opt out or request deletion, and for a reasonable period thereafter to honour opt-out requests.
• Invoices and payment records: retained for 7 years in accordance with Australian tax and accounting obligations.

You can request deletion of your account and associated data at any time. We will action such requests within 30 days, subject to retention obligations imposed by law.

We implement reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest;
• One-way hashing of passwords (we never store plain-text passwords);
• Access controls limiting data access to authorised personnel on a need-to-know basis;
• Regular security reviews and vulnerability assessments;
• Audit logging of access to sensitive data.

No system is 100% secure. You should keep your login credentials confidential and notify us immediately if you suspect unauthorised access to your account. In the event of a data breach that is likely to result in a risk to your rights, we will notify affected users and relevant authorities as required by law.

Depending on your location and applicable law, you may have some or all of the following rights regarding your personal information:

• Access: to request a copy of the personal information we hold about you.
• Correction: to request correction of inaccurate or incomplete information.
• Deletion: to request deletion of your personal information, subject to our legal retention obligations.
• Restriction: to request that we restrict processing of your information in certain circumstances.
• Portability: to receive a copy of your personal information in a structured, commonly used, machine-readable format (where applicable).
• Objection: to object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please use our Contact Us form. We will respond within 30 days. We may need to verify your identity before actioning a request.

Region-specific rights are described in the Regional Addenda below.

The Services are not directed at or intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal information from a child under 16, we will take steps to delete it as soon as practicable. If you believe we may have information from or about a child under 16, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. We will post the updated version on this page with a new effective date. Where changes are material, we will provide reasonable advance notice via email or an in-app notification. Your continued use of the Services after the effective date of an updated policy constitutes your acceptance of the changes.

If you have any questions, concerns or complaints about this Privacy Policy or how we handle your personal information, please contact us:

• By email: support@investorpilot.au
• By post: Investor Pilot Pty Ltd, PO Box 2502, Graceville, Qld 4075, Australia

We will acknowledge receipt of your query and respond within 30 days.

Investor Pilot Pty Ltd is an Australian company and complies with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

Access and correction: you may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. We will respond within 30 days. We may charge a reasonable fee for access requests reflecting the cost of retrieving and providing the information.

Complaints: if you are not satisfied with how we have handled your personal information or responded to your complaint, you may contact the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

Controller: Investor Pilot Pty Ltd is the data controller for personal data processed under this Privacy Policy.

Legal bases: as described in Section 4 above — contract, legitimate interests, consent, and legal obligation.

International transfers: where personal data is transferred outside the EEA or the UK, we use appropriate safeguards including Standard Contractual Clauses (SCCs) as approved by the European Commission or the UK Information Commissioner’s Office (ICO), or other lawful transfer mechanisms.

Your rights: in addition to the rights in Section 10 above, EU and UK data subjects have the right to:

• Lodge a complaint with their national data protection supervisory authority. In the UK this is the Information Commissioner’s Office (ico.org.uk). EU users may contact the supervisory authority in their EU member state.
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, where applicable.

Retention: personal data is not retained longer than necessary for the purposes described in Section 8, subject to any legal obligations.

To exercise your rights or raise a concern, please email support@investorpilot.au.

This addendum applies to California residents and supplements the information in this Privacy Policy in accordance with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of personal information collected: in the preceding 12 months we may have collected the following categories as defined by the CCPA:

• Identifiers (name, email address, IP address, account ID);
• Internet or other electronic network activity (usage logs, pages viewed, device information);
• Financial information you voluntarily provide (portfolio holdings and transactions you enter — this is not collected from third-party financial institutions without your explicit authorisation);
• Inferences drawn from the above to create a profile reflecting your preferences within the Services.

Purposes: personal information is used for the business purposes described in Section 3 above.

Sale and sharing: we do not sell personal information. We do not share personal information for cross-context behavioural advertising.

Your California rights:

• Right to know / access: you may request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months, the sources, the business purposes, and the categories of third parties with whom we share it.
• Right to delete: you may request deletion of personal information we have collected from you, subject to certain exceptions permitted by law.
• Right to correct: you may request correction of inaccurate personal information.
• Right to opt out of sale or sharing: as noted above, we do not sell or share personal information for advertising purposes. No opt-out is therefore required, but you may contact us to confirm this.
• Right to limit use of sensitive personal information: we do not use sensitive personal information (as defined by the CPRA) for purposes beyond those permitted without limitation under the CPRA.
• Non-discrimination: we will not discriminate against you for exercising any of your California privacy rights.

To exercise your rights, please email support@investorpilot.au. We will respond within 45 days as required by the CCPA/CPRA, with the possibility of a 45-day extension where reasonably necessary. We may need to verify your identity before processing your request.