mo.moBlood Communications Pty Ltd (ABN 32 110 481 457) ("we", "us", or "our") operates BrandVoice at brandvoice.com.au (the "Platform"). We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, and your rights in relation to it. By using the Platform, you consent to the practices described in this policy.

1. What Information We Collect

1.1 Information You Provide

When you create an account or use the Platform, we collect:

•       Name and email address (at registration)

•       Payment information — we do not store card details directly; these are handled by Stripe, our payment processor

•       Brand copy and content you submit to the Platform for analysis ("Your Content")

•       Account preferences, including your marketing email opt-in status

1.2 Information Collected Automatically

When you visit or use the Platform, we automatically collect:

•       Usage data: pages visited, features used, Check results viewed, drop-off points

•       Device and browser information: browser type, operating system, screen resolution

•       IP address and approximate location (country/city level)

•       Session data and authentication cookies necessary to keep you logged in

•       Analytics data collected via Google Analytics (see clause 5)

2. How We Use Your Information

We use your personal information to:

•       Create and manage your account

•       Provide the brand voice analysis services you request

•       Process subscription payments and send billing-related communications

•       Send transactional emails (account confirmations, password resets, delivery notifications)

•       Send marketing emails, including product updates, tips, and offers from Pete Watman, where you have opted in — you may withdraw consent at any time

•       Analyse platform usage to improve the Platform's features and performance

•       Comply with our legal obligations

We do not use Your Content (the copy you submit for analysis) for any purpose other than delivering your Check results. We do not use Your Content to train AI models or for any commercial purpose beyond the service.

3. Your Content and AI Processing

When you submit content for a Check, that content is transmitted to the Anthropic Claude API to generate your analysis results. This transmission is necessary to provide the service. Anthropic processes your content as a data processor on our behalf. Anthropic's API terms explicitly state that API-submitted content is not used to train Anthropic's models.

Your Content is stored in our Platform database associated with your account. You may delete individual Checks or your entire account at any time. On account deletion, Your Content is removed from active systems within a reasonable period, and from encrypted backups within 30 days.

4. Disclosure of Your Information

We do not sell your personal information. We disclose personal information only in the following circumstances:

4.1 Service Providers

We share personal information with trusted third-party service providers who assist us in operating the Platform. Each provider acts as a data processor under our instructions:

•       Base44 (platform infrastructure, US): Hosts the Platform and stores user data, including Your Content, on servers located in the United States. Base44 is SOC 2 Type II and ISO 27001 certified. We have entered into a Data Processing Agreement (DPA) with Base44, which incorporates Standard Contractual Clauses (SCCs) for international data transfers.

•       Anthropic (AI inference, US): Processes Your Content to generate brand voice analysis. Anthropic does not use API content for model training.

•       Stripe (payment processing, US): Processes subscription payments. Stripe stores payment card data; we do not. Stripe is PCI-DSS certified.

•       Resend (transactional email, US): Delivers transactional emails including account and billing notifications.

•       Google Analytics (analytics, US): Collects anonymised usage and traffic data via cookies. See clause 5.

4.2 Legal Requirements

We may disclose your personal information where required by law, court order, or a request from a government or regulatory authority, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of our business, our users, or the public.

4.3 Business Transfers

If Blood Communications Pty Ltd is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

5. Cookies and Analytics

5.1 Cookies We Use

The Platform uses the following types of cookies:

•       Essential cookies: Required for authentication and session management. The Platform cannot function without these. No consent required.

•       Analytics cookies (Google Analytics): Used to measure site visits, page drop-offs, and usage patterns. These cookies send data to Google's servers in the United States. Google Analytics is configured to anonymise IP addresses.

5.2 Your Choices

You can control or disable cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the Platform. Disabling essential cookies will prevent you from logging in.

For more information on Google Analytics and how to opt out, visit: tools.google.com/dlpage/gaoptout

6. International Data Transfers

Your personal information is stored and processed in the United States by our service providers (Base44, Anthropic, Stripe, Resend, and Google). We are an Australian entity and the APPs apply to our handling of your information regardless of where it is processed.

In transferring data to Base44 (our primary infrastructure provider), we rely on the following safeguards under APP 8:

•       Base44 is SOC 2 Type II and ISO 27001 certified

•       We have executed a Data Processing Agreement with Base44 incorporating Standard Contractual Clauses (SCCs) and coverage under the EU-US Data Privacy Framework (DPF)

We have taken reasonable steps to ensure that our overseas service providers handle your information in a manner consistent with the APPs. By using the Platform, you acknowledge that your information will be transferred to and processed in the United States.

7. Data Retention

We retain your personal information for as long as your account is active or as necessary to provide the service. Specifically:

•       Account data (name, email, preferences): retained for the life of your account

•       Check content and results: retained for the life of your account and deleted on account closure

•       Payment records: retained for seven (7) years as required by Australian taxation law

•       Backup data: purged within 30 days of account deletion

You may request deletion of your personal information at any time. See clause 9 for how to exercise this right.

8. Security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

•       Encryption of data in transit (TLS) and at rest

•       Authentication controls and access restrictions

•       Use of SOC 2 Type II and ISO 27001 certified infrastructure (Base44)

•       API key management to prevent client-side exposure of credentials

No method of transmission over the internet is completely secure. While we take reasonable precautions, we cannot guarantee absolute security.

9. Your Rights

Under the Australian Privacy Principles, you have the right to:

•       Access: Request a copy of the personal information we hold about you. You can download your data directly from your account settings.

•       Correction: Request correction of inaccurate or incomplete personal information.

•       Deletion: Request deletion of your account and associated personal information. You can do this directly through account settings, or by contacting us.

•       Withdrawal of consent: Withdraw consent to marketing emails at any time via the unsubscribe link in any marketing email, or by updating your notification preferences in account settings.

To exercise any of these rights, contact us at the details in clause 11. We will respond within 30 days.

10. Children

The Platform is not directed at persons under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately, and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you via email at least 14 days before the changes take effect. Your continued use of the Platform after the effective date of an updated policy constitutes acceptance of the changes.

The current version of this Privacy Policy is always available at brandvoice.com.au/privacy.

12. Complaints

If you have a complaint about how we have handled your personal information, please contact us in the first instance at the details below. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au

Phone: 1300 363 992

13. Contact Us

For any privacy-related questions, requests, or complaints:  hi [at] brandvoice [dot] com [dot] au

Our website is: brandvoice.com.au