PRIVACY POLICY

1. Introduction

This Privacy Policy applies to all personal information collected by Planfocus Consulting Pty Ltd (27 603 602 982), trading as Planfocus Labs (Planfocus, we, us or our), the owner and operator of the AdviceStudio.ai platform, via:

• the website located at www.advicestudio.ai (Website); and
• the AdviceStudio.ai platform and any associated applications (Platform).

Planfocus takes the privacy of its users seriously. We have implemented industry-accepted standards of technology and operational security to protect your personal information from loss, misuse, alteration, or destruction. This Privacy Policy explains what information we collect, how we use and protect it, and the rights you have in relation to it.

We will abide by the Australian Privacy Principles (APPs) as set out in the Privacy Act 1988 (Cth) (Privacy Act), and any other applicable law, in respect of your personal information. We will only collect, use, and disclose personal information for the purposes described in this Policy, or as otherwise permitted by law.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The date of the most recent revision appears at the top of this document. We encourage you to review this Policy periodically.

2. What Information Do We Collect?

The kind of personal information we collect from you will depend on how you use the Website and Platform. Personal information we may collect and hold about you includes:

• your name, email address, phone number and postal address;
• your professional details, including title, occupation, Australian Financial Services Licence (AFSL) number, and business or practice name;
• login credentials and account preferences;
• billing and payment information;
• technical information about your device, including IP address, device type, browser type, and geographic location;
• data on your browsing and usage activity on the Website and Platform;
• information about services you have enquired about or subscribed to;
• feedback you provide through surveys, support channels, or direct communications; and
• any other personal information you choose to provide to us through the Website, Platform, or other channels.

Where you use the Platform to generate, store, or transmit documents containing information about your clients, you are responsible for ensuring that you have all necessary consents and authorities to do so, and that you handle such information in accordance with your own obligations under applicable privacy law.

3. Types of Information

Personal Information

The Privacy Act 1988 (Cth) defines personal information as information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true, and whether or not it is recorded in material form. If the information does not disclose your identity or enable your identity to be ascertained, it will generally not be classified as personal information and will not be subject to this Policy.

Sensitive Information

Sensitive information is a subset of personal information and includes information or opinions about an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record, or health information.

We will not ask you to disclose sensitive information unless it is necessary for the conduct of our business with you. Where we do collect sensitive information, we will use it only:

• for the primary purpose for which it was obtained;
• for a secondary purpose that is directly related to the primary purpose; or
• with your consent, or where required or authorised by law.

4. How Do We Collect Your Personal Information?

We may collect personal information from you in a number of ways, including:

• when you register for an account or subscribe to the Platform;
• when you fill out a contact, subscription, or enquiry form on our Website;
• when you contact us by email, phone, or through our support channels;
• when you use the Platform to create or manage documents and records;
• automatically through cookies and similar tracking technologies when you visit our Website or Platform (see Section 5); and
• from third parties, such as referral partners or technology integration providers, where you have authorised them to share your information with us.

Where reasonable and practicable, we will collect your personal information directly from you. If we receive information about you from a third party, we will take reasonable steps to make you aware of that collection.

5. Cookies and Tracking Technologies

We use cookies and similar technologies when you visit our Website and Platform. A cookie is a small piece of data placed on your browser or device that helps us recognise you on return visits and improve your experience.

We use cookies and similar technologies for purposes including:

• authenticating your session and keeping you logged in;
• remembering your preferences and settings;
• understanding how visitors use our Website and Platform (analytics);
• improving the performance and security of our services; and
• enabling certain features and functionality of the Platform.

As a general rule, cookies alone cannot personally identify you. You may configure your browser to refuse cookies or to notify you when cookies are received. However, disabling cookies may affect your ability to use certain features of the Website or Platform.

6. Why Do We Collect and Use Your Personal Information?

We collect personal information to enable us to operate the Platform, provide our services, and maintain our business relationship with you. Specifically, we may use your personal information to:

• create and manage your account and subscription;
• provide, operate, and improve the Platform and our services;
• respond to your enquiries, requests, and support needs;
• process billing and payments;
• send you important notices, updates, and service communications;
• conduct direct marketing where we have your express or inferred consent — our marketing communications will always include a simple and clear means to opt out; and
• comply with our legal obligations and protect our legal rights.

We do not use sensitive personal information for direct marketing purposes. We will only use your personal information for direct marketing if we have collected it directly from you and it is material of a type you would reasonably expect to receive from us.

7. Do We Disclose Your Personal Information?

We may disclose your personal information to third parties only to the extent necessary to operate the Platform and deliver our services. This may include disclosure to:

• external service providers and contractors engaged to provide services on our behalf (such as cloud hosting, payment processing, customer support, and analytics providers);
• companies that provide information technology and infrastructure systems to us;
• your authorised representatives or advisers;
• investors, agents, or advisers with an interest in our business;
• third parties where you have provided your consent; and
• any other parties as required or permitted by law.

Before disclosing your personal information to a third party, we will take reasonable steps to ensure that the recipient is committed to protecting your personal information to a standard at least equivalent to our own obligations under the Privacy Act, or that you have consented to the disclosure.

We may disclose personal information where required by law, or where we reasonably believe that disclosure is necessary to protect our rights or property, your safety, or the safety of others.

We may also compile and share aggregated, de-identified data (which cannot identify you personally) for analytical and business improvement purposes.

8. Overseas Transfer of Personal Information

We store personal information in a combination of secure on-shore and cloud-based facilities. Our cloud storage and IT servers may be located outside Australia. Where we transfer your personal information overseas, we will take reasonable steps to ensure that any overseas recipients handle your information in accordance with the Australian Privacy Principles or an equivalent standard of protection.

If you expressly request that we transfer your personal information to an overseas recipient, please be aware that the overseas recipient may not be subject to the Australian Privacy Principles, and we may not be liable for any mishandling of your information in such circumstances.

9. How Do We Protect Your Personal Information?

We store your personal information in a way that reasonably protects it from unauthorised access, misuse, modification, or disclosure. We take reasonable technical and organisational steps to safeguard your personal information, including implementing access controls, encryption, and regular security reviews.

Most personal information stored in our records will be retained for a period of up to 7 years to fulfil our record-keeping obligations, after which we will take reasonable steps to destroy, anonymise, or de-identify it.

Despite these precautions, no method of data transmission or storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security against unauthorised access.

10. Accessing and Correcting Your Personal Information

The Australian Privacy Principles permit you to access the personal information we hold about you, and to request correction of any information that is inaccurate, out of date, incomplete, or misleading.

To request access to, or correction of, your personal information, please contact us using the details in Section 12. We will acknowledge your request within 7 days and will endeavour to resolve your request within 30 days. Where we are unable to provide access or make a correction, we will explain our reasons in writing.

11. Complaints

If you have a complaint about the way we have collected, used, or handled your personal information, or about our compliance with the Privacy Act, please contact us using the details in Section 12. We will:

• acknowledge your complaint promptly;
• consider and investigate your complaint; and
• provide you with a written response within 30 days.

If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner (OAIC). The OAIC can be contacted at www.oaic.gov.au or on 1300 363 992.

12. How to Contact Us About Privacy

If you have any questions about this Privacy Policy, wish to access or correct your personal information, or wish to make a complaint, please contact us at:

Planfocus Consulting Pty Ltd (trading as Planfocus Labs)

Product: AdviceStudio.ai

Website: www.advicestudio.ai

Email: hello@advicestudio.ai

Phone: 1300 361 973

Postal Address: Suite 1, Level 6, 377-383 Sussex St Sydney NSW 2000

We will respond to all enquiries as promptly as reasonably practicable.

© 2026 Planfocus Consulting Pty Ltd. All rights reserved.

AdviceStudio.ai is a platform operated by Planfocus Consulting Pty Ltd | www.advicestudio.ai