Privacy Policy

This policy applies to personal information handled through the STRATIFI website, platform, support channels, marketing activities and related business processes. It should be read together with any customer agreement, data processing terms, security schedule or implementation statement that applies to your organisation.

Where your organisation uses STRATIFI under a customer agreement, we may handle some information as a service provider or processor on behalf of that organisation. In that case, your organisation may also have its own privacy obligations and policies.

STRATIFI takes reasonable steps to implement practices, procedures and systems to comply with the Australian Privacy Principles, to handle privacy inquiries and complaints, and to keep this policy clearly expressed and up to date. This policy is reviewed at least annually, and each version is dated at the top of the page.

We only collect personal information that is reasonably necessary for STRATIFI's functions and activities described in this policy. We do not seek to collect more personal information than a stated purpose requires.

STRATIFI is designed for high-accountability environments, including Defence, government and critical-sector organisations. The marketing website is not intended to collect classified, export-controlled, national security, health, payment-card or other highly sensitive information.

Where sensitive information (as defined in the Privacy Act) is collected, for example limited health or identity-verification information provided in a support request, we will only do so with consent or where a permitted exception applies, and only to the extent reasonably necessary.

Customers must not upload classified, export-controlled or otherwise restricted information into STRATIFI unless the relevant contractual, security, data-handling and configuration arrangements have been expressly agreed in writing. References to OPEN or PROTECTED-equivalent handling are subject to the relevant customer deployment, security controls and assurance status.

• Provide, operate, maintain and improve the STRATIFI website and platform.
• Respond to enquiries, arrange demonstrations, provide support and manage customer relationships.
• Create and manage accounts, authenticate users, apply role-based access controls and enforce customer permissions.
• Process billing and refund requests, including checking eligibility against usage records.
• Enable STRATIFI workflows, including situational analysis, direction setting, alignment, execution tracking, governance review and reporting.
• Generate, review, approve and export AI-assisted content where authorised by the customer or user.
• Maintain audit trails, security logs, version history and governance evidence.
• Monitor system performance, diagnose issues, prevent misuse and protect STRATIFI, our customers and users.
• Send service communications, product updates and marketing communications where permitted by law and your preferences.
• Meet legal, regulatory, contractual, recordkeeping and dispute-resolution obligations.

We only use or disclose personal information for the purpose for which it was collected (the primary purpose), or for a related secondary purpose you would reasonably expect, for example with consent or where required or authorised by law.

STRATIFI uses AI-assisted workflows to support analysis, drafting, gap identification, summarisation, evidence synthesis and reporting. AI output is intended to assist authorised users and reviewers; it is not a substitute for professional judgement, executive decision-making, legal advice, security review or customer approval.

Where AI-assisted features are used, prompts, context, uploaded content, system instructions and generated outputs may be processed by STRATIFI systems and approved service providers to deliver the relevant feature. We do not permit customer content to be used to train public AI models unless expressly agreed in writing with the customer.

Customers remain responsible for reviewing, approving and using AI-assisted outputs in accordance with their own governance, classification, confidentiality and assurance requirements.

From September 2026, where STRATIFI uses a computer program (including AI) to make a decision that could reasonably be expected to significantly affect an individual's rights or interests, we will include the additional information required in this policy, such as the kinds of decisions involved and the kinds of personal information used in those decisions. As at the effective date above, STRATIFI's AI-assisted features support human decision-makers and do not themselves make such decisions.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

We may disclose personal information to:

• service providers who support hosting, authentication, analytics, email delivery, customer support, security monitoring, AI-assisted functionality, payment or billing, and professional services;
• the customer organisation that administers your STRATIFI access;
• authorised users within your organisation according to configured roles and permissions;
• professional advisers, insurers, auditors and legal representatives;
• regulators, law enforcement agencies or other parties where required or permitted by law, including the Australian Cyber Security Centre where required under the Security of Critical Infrastructure Act 2018.
• successors or counterparties in a business transfer, restructure or similar transaction, subject to appropriate confidentiality controls.

We do not sell personal information. We do not disclose customer strategy content for unrelated advertising purposes.

STRATIFI may use Australian-based hosting for production customer environments where agreed with the customer. The location of model inference, backups, logs, connected systems and support access may differ depending on the service configuration. Some service providers, support personnel or technology vendors may operate outside Australia, and STRATIFI does not make a blanket Australian-only processing assurance unless expressly agreed.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that recipient will handle the information consistently with the Australian Privacy Principles, generally through binding contractual arrangements covering collection, use, disclosure, storage, security, destruction or de-identification, and data breach notification.

Where practicable, we will identify in this policy, or on request, the countries in which overseas recipients are likely to be located.

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including to provide STRATIFI, maintain audit and security records, meet contractual and legal obligations, resolve disputes and support customer governance requirements. Where a customer agreement contains a specific retention and exit schedule, we apply that schedule to customer information, subject to legal holds and other lawful retention requirements.

When personal information is no longer needed for any purpose for which it may be used or disclosed, we take reasonable technical and organisational steps to destroy it or ensure it is de-identified. Some records, including audit logs, security records, transaction records, refund requests and backup copies, may be retained for defined periods where this is required for integrity, security, legal or governance purposes, or where the information is subject to a legal or regulatory retention obligation.

We take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These technical and organisational measures may include encryption in transit and at rest, role-based access controls, single sign-on, audit logging, secure development practices, monitoring, vulnerability management, backup and disaster-recovery processes, and incident-response procedures.

No system can be guaranteed to be completely secure. Users and customer administrators also play an important role by maintaining secure credentials, managing access carefully and ensuring that information entered into STRATIFI is appropriate for the customer's configured environment.

Depending on where you are located and the laws that apply, you have rights to:

• request access to personal information we hold about you, which we will provide within a reasonable period (for example, where access would have an unreasonable impact on the privacy of others, or is not required to be given by law);
• request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading, which we will act on, including by taking reasonable steps to notify any third party to whom we have previously disclosed the information, if you ask us to;
• unsubscribe from marketing communications at any time;
• object to or restrict certain processing activities where applicable;
• make a privacy complaint to us or to a relevant privacy regulator, and have that complaint dealt with in a reasonable period.

To make a request, contact us using the details below. We may need to verify your identity and may consult your organisation where the request relates to information held under its STRATIFI account. If we refuse a request for access or correction, we will provide written reasons and information about available complaint mechanisms, as required under APPs 12 and 13.

.If we become aware of a data breach involving personal information, we will assess whether the breach is likely to result in serious harm to any individual to whom the information relates (an 'eligible data breach'). We take all reasonable steps to complete that assessment within 30 calendar days. Where an eligible data breach has occurred and no exception applies, we will notify affected individuals as soon as practicable and any customer agreement that applies.

Where a data breach also constitutes a cyber security incident affecting the availability, integrity, reliability or confidentiality of a critical infrastructure asset, additional reporting obligations under the Security of Critical Infrastructure Act 2018 (Cth) may apply — see section 5.7 of the Security page.

Privacy contact: support@stratifi.global

Postal address: Office No. 1204, Floor No. 12, Manarat Lusail Tower, Building No. 23, Street No. 318, Area No. 002-Marina Mix, Lusail, Doha - Qatar