Privacy Policy

Effective date: 8 August 2026

1. Who We Are

Business Process Automate ("BPA", "the Platform") is a product of Norbrik Pty Ltd (ABN 70 600 064 631), a company registered in Australia. In this policy, "we", "us", and "our" refer to Norbrik Pty Ltd.

If you have questions about this policy, contact us at [email protected] or through our Contact page.

2. Information We Collect

2.1 Account Information

When you create an account or are invited to a team, we collect:

• Name and email address
• Organisation or team name
• Authentication credentials (managed via Microsoft, Google, or your configured SSO provider)
• Role and permission assignments within your team

2.2 Platform Data

As you use BPA, you and your team create and store data within the platform, including:

• Form submissions and entity records
• Workflow and process definitions
• Application configurations
• AI agent configurations, knowledge packs, and conversation history
• File attachments and documents

This data belongs to your team. We do not access it except as described in Section 5.

2.3 Usage and Analytics Data

We automatically collect:

• Service usage metrics (entity record counts, process runs, LLM calls, storage usage)
• Audit logs (login events, data access, security events) as described in your plan's retention period
• Performance and error telemetry to maintain and improve the service
• Browser type, device type, and IP address

2.4 Payment Information

Payment processing is handled by third-party payment providers. We do not store credit card numbers or bank account details on our servers. We retain transaction records (plan, amount, date) for billing and compliance purposes.

2.5 Mobile Application Data

If you install the BPA mobile app, it may access the following on your device. Each is used only for the purpose listed, only while you are using the relevant feature, and only after your device has asked your permission. Details are in Section 11.

• Camera, to take a photo or record a video when you attach one to a form or record
• Microphone, to record audio when you use a voice or audio-capture feature
• Location (approximate and precise), to stamp a single location on a record when a form or app you are using asks for one
• Notification registration token: a device identifier issued by your platform's push service, used solely to deliver notifications to your device
• Local device storage, to hold your session and any work queued while you are offline, so it is not lost if the app closes

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the BPA platform
• Authenticate your identity and manage access control
• Enforce usage quotas and billing in accordance with your plan
• Generate audit trails for security and compliance
• Send service-related communications (outages, security alerts, billing notices)
• Respond to support requests
• Detect and prevent fraud, abuse, and security threats

4. AI and Large Language Model (LLM) Usage

BPA includes AI-powered features such as AI Studio, AI agents, and knowledge packs. When you use these features:

• Your prompts and data are sent to third-party LLM providers (such as OpenAI or Anthropic) to generate responses. We send only the data necessary for the specific request.
• We do not use your data to train AI models. Your prompts, entity data, and AI conversations are not used for model training by us or our LLM providers.
• Bring Your Own Key (BYOK): All plans support BYOK, allowing you to route AI requests through your own API keys. When BYOK is enabled, requests go directly to your provider account under your own terms.
• AI credits and LLM call limits are tracked per team as part of your plan quota. Usage data (call counts, token usage) is retained for billing purposes.
• Knowledge packs and AI memory that you create are stored within your team's data and are not shared with other teams or used outside your workspace.

5. How We Access Your Data

We access your platform data only when:

• You request support
• Required to resolve a technical issue or outage
• Required by law, regulation, or valid legal process
• Necessary to enforce our Terms of Service or protect against harm

All access is logged in our platform audit system.

6. Data Sharing

We do not sell your personal information. We share data only with:

• LLM providers, to process AI requests (see Section 4)
• Infrastructure providers: cloud hosting and database services required to operate the platform
• Payment processors, to handle billing
• Legal authorities: when required by Australian law or valid legal process

All third-party providers are bound by data processing agreements and are prohibited from using your data for their own purposes.

7. Multi-Tenant Security

BPA is a multi-tenant platform. Each team's data is logically isolated:

• All data queries are scoped to your team ID
• Entity-level security policies (RBAC and ABAC) control who can access specific records and fields
• Row-level and field-level access controls ensure data visibility is limited to authorised users
• Security events are logged to the platform audit trail

Enterprise customers may opt for a dedicated instance or self-hosted deployment for additional isolation.

8. Data Retention

Retention periods depend on your plan:

• Free: 30-day audit retention
• Pro: 90-day audit retention
• Business: 1-year audit retention
• Enterprise: Custom retention periods

Your platform data (entity records, forms, workflows) is retained for as long as your account is active. When an account or team is deleted, its data is permanently removed as described in Section 12, except where we are required by law to retain it.

9. Data Storage and Transfers

Your data is stored on servers located in Australia. If data is transferred outside Australia (for example, to process an AI request via a US-based LLM provider), we ensure appropriate safeguards are in place consistent with the Australian Privacy Principles.

10. Cookies and Tracking

BPA uses cookies and similar technologies for:

• Authentication: Session cookies to keep you logged in
• Preferences: Remembering your settings and workspace state

We do not use third-party advertising or tracking cookies within the platform. The marketing website may use analytics cookies to understand visitor behaviour; these do not identify individual users.

The mobile app uses the same session cookies within its embedded browser view. It sets no additional cookies of its own.

11. Mobile Application

The BPA mobile app is a container for the same platform described above: the screens you see are the hosted BPA service, and the data you enter is handled exactly as set out in the rest of this policy. This section covers only what the app additionally asks of your device, and applies to the app on both Android and iOS.

11.1 Device Permissions

Your device asks your permission before any of these is used, and you can withdraw permission at any time in your device settings. Declining a permission disables that feature only; the rest of the app continues to work.

• Camera, taking a photo or recording a video to attach to a form or record. Used only when you choose to capture something.
• Microphone, recording audio when you use a voice or audio-capture feature.
• Location, approximate and precise, capturing a single location reading at the moment a form or app requests one.
• Notifications, showing notifications you have chosen to receive. The app does not ask for this on first launch.

11.2 What the App Deliberately Does Not Do

• No background location. The app cannot access your location while it is closed or not in use. It requests location only while you are using it, and does not ask for the always-on permission that would allow otherwise.
• No access to your photo library. When you attach an existing image, your device's own photo picker returns only the item you select. The app never receives access to the rest of your photos.
• No tracking. We do not track you across other companies' apps or websites, and we do not use advertising identifiers, advertising, or third-party analytics or tracking software. We do not ask for permission to track, because we do not.
• No data brokers. We do not sell, share, or disclose your information to data brokers.
• No purchases. Plans, billing and payment are not available in the app.

11.3 Push Notifications

Notifications are delivered through your platform's push service: Google Firebase Cloud Messaging on Android, and the Apple Push Notification service on iOS. That service issues your installation of the app a registration identifier, which we store against your account so we can send notifications to your device. It is used for no other purpose, is not combined with advertising data, and is discarded when you sign out or uninstall the app. The content of a notification passes through that platform service to reach your device.

11.4 Signing In

Sign-in opens in a secure browser view provided by your device rather than inside the app, so your credentials are entered with your identity provider (Microsoft, Google, or your organisation's own provider) and are never visible to the app. The app receives only the resulting session.

12. Account and Data Deletion

You may request deletion of your BPA account and its associated personal information at any time, whether you signed up on the web or through the mobile app.

To request deletion, email [email protected] from the address associated with your account, stating that you wish to delete your account. We will confirm your identity and action the request.

What is deleted: your user account, your profile information, your team memberships and role assignments, and any notification registration identifiers held for your devices.

What may be retained: data belonging to a team you were a member of remains with that team, since it is the team's record rather than yours. Where you are the sole owner of a team, we will confirm with you whether the team and its data should also be deleted, or ownership transferred to someone else. Audit log entries and transaction records are retained where we are required to keep them by law; these are retained no longer than necessary and are not used for any other purpose.

Timeframe: we respond to deletion requests within 30 days. Once actioned, data is permanently removed within a further 30 days, except where retention is legally required.

Team owners can additionally delete an entire team, and all of its data, from Team Settings within the platform.

This applies however you obtained the app, including installations from Google Play and the Apple App Store. Deleting the app from your device does not delete your account; use the request above.

13. Your Rights

Under the Australian Privacy Principles (APPs) and applicable laws, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your account and associated data
• Export your platform data
• Withdraw consent for optional processing (e.g., marketing communications)

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

14. Children's Privacy

BPA is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

15. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you via the platform or email. The "Effective date" at the top of this page indicates when the policy was last revised.

16. Contact Us

For privacy-related questions or requests:

• Email: [email protected]
• Web: bpautomate.com/contact
• Entity: Norbrik Pty Ltd (ABN 70 600 064 631), Australia