Privacy Policy

1. Introduction

Welcome to KylieBot’s privacy policy (Privacy Policy). KylieBot is an AI-driven platform that helps scientists, technologists, researchers, and entrepreneurs articulate the impact of their work through interview-based narrative creation.

This Privacy Policy explains how STEM Matters Pty Limited (ABN 69 169 537 142) (“we”, “us”, “our”), the operator of KylieBot, collects, uses, discloses, and protects your personal information in accordance with the Australian Privacy Principles (APPs). We use ‘you’ or ‘your’ to mean you and, where the context permits, includes an Authorised User.

By signing up for a KylieBot Account or using KylieBot you agree to the collection, use, and disclosure of your personal information in accordance with this Privacy Policy. We also use ‘point of collection’ click through privacy notices and consents so that we can be certain that you have actively given your consent to our collection and use of your personal information at the time we ask for it. Without your consent to collect personal information in accordance with this Privacy Policy, we will be unable to provide you with the Service.

We will not sell, rent, or trade your personal information to third parties. We do not share your information for marketing purposes or provide it to data brokers.

In this Privacy Policy, capitalised words that aren’t defined in the policy have the meanings set out in our Terms of Service.

2. Information We Collect (APP 3, 5)

2.1 Information you provide to us directly

• Account information — first name, last name, email address, organisation name (if applicable) and a password (we encrypt passwords). Additional information may also be collected relating to account administration such as contact information for other persons you authorise on your Account and information we need for billing. Where your Account will include Authorised Users in addition to you, we collect personal information about those users: first name, last name, email address and a password.
• Professional profile information — often in the form of biography (each individual’s bio is of course different and you may have multiple versions, but typically it may contain information on your research areas, expertise, and career achievements; there may also be a crossover with information supplied in the interview).
• Interview content — via our AI-assisted interview process including transcripts generated from oral interviews, and typically may include professional stories and narratives, research descriptions, impact statements, grant application details, and career accomplishments shared during the AI-assisted interviews.
• Voice recordings — audio captured during voice-based interviews. Recordings are processed by VAPI (our voice orchestration provider) and are not stored on KylieBot servers. VAPI retains recordings, transcripts, and call logs for approximately 14 days, after which they are automatically deleted.
• Other user-generated or user-originating content — for example when you input edits to KylieBot’s generated reports, provide feedback on narrative drafts, and when you communicate with our support team.

2.2 Information we collect automatically

• Technical data — IP address, browser type and version, device type, operating system, and connection quality metrics. In common with many websites, we collect this data to assist us in the basic operation of the KylieBot website and platform. It also allows us to debug / monitor the service and improve it over time.
• Usage data — pages visited, features used, interview session durations, report generation requests, credit usage history, login timestamps, and session activity. We collect this data to assist with the security of the website and for personalisation of the service to offer more relevant content.
• Consent records — records of when you or an Authorised User indicated your agreement to this policy, including IP address, browser type, and policy version accepted.

3. How We Use Your Personal Information (APP 6)

3.1 Primary purposes

We use your personal information to provide and operate the KylieBot Service. This includes:

• Account management: opening and administering your Account, user authentication, and account security.
• Conducting your interview: running AI-driven voice interviews and transcribing the interview audio.
• Creating and delivering your content: generating AI-driven narrative content from your interview responses, such as profile pieces, impact narratives, grant narratives, and funding pitches, and delivering it to you via email and the platform dashboard.
• Communications: communicating with you about your account, interviews, outputs, and service updates.
• Analytics and service improvement: analysing usage patterns, user behaviour, and platform performance to diagnose issues, understand how the Service is used, and inform product improvements.
• Legal and compliance: maintaining compliance records and audit trails, and meeting our legal obligations.

Conducting your interview and generating your content involve disclosing your information to the third-party AI service providers described in Section 4, who act on our behalf and only for the purposes above.

3.2 Secondary purposes

De-identified industry reporting: we may use aggregated and/or de-identified information derived from the Service, including from interview content, to produce reports, insights, benchmarking materials and industry trend analyses that may be shared with our customers or other third parties. These materials are prepared so that they do not contain, and could not reasonably be used to identify, any individual. We do not attempt to re-identify de-identified information.

3.3 What we will not do

We will not use your personal information for direct marketing, profiling for third-party advertising, or any other secondary purpose not listed above without first updating this policy and, where required, seeking your consent.

4. Use of Artificial Intelligence and Third-Party Service Providers (APP 6)

The Service uses artificial intelligence (AI) technologies, including large language models (LLMs), to conduct structured interviews and generate narrative content.

In providing the Service, your personal information — including interview responses, voice recordings, and professional information — may be disclosed to and processed by the key third-party service providers set out below, who act on our behalf to deliver AI functionality, data processing, and related services:

• OpenRouter — our AI gateway, which routes interview and content-generation requests to Anthropic’s Claude language models. Zero Data Retention is enabled, so requests are routed to enterprise endpoints (AWS Bedrock and Google Vertex) and are not stored after processing.
• Anthropic — provides the Claude large language models used to conduct interviews and generate your content, accessed via OpenRouter. Your inputs and outputs are not used to train Anthropic’s models.
• VAPI — our voice orchestration provider (United States / European Union), which coordinates the real-time interview between the speech-to-text, language model, and text-to-speech services. VAPI retains recordings, transcripts, and call logs for approximately 14 days; during this period it may use this data in de-identified form to improve its own services.
• Deepgram — our speech-to-text provider (United States), which transcribes interview audio. We have opted out of model training, and data is retained only for the time needed to process each request.
• ElevenLabs — our text-to-speech provider (United States), which generates KylieBot’s interview voice. Zero Data Retention is enabled, so no interview data is stored, and data is not used for training.
• Supabase — our primary database (Sydney, Australia), which stores your account data, interview transcripts, and generated content.

We take reasonable steps to ensure that these providers are subject to appropriate privacy and confidentiality obligations. Our AI providers do not use your interview inputs or outputs to train their models.

Our third-party providers may change from time to time as we improve or modify the Service. A current list of key service providers is also available upon request.

5. Cross-Border (Overseas) Disclosure (APP 8)

Some of our third-party service providers are located outside Australia. As a result, your personal information may be transferred to, and processed in, countries including (but not limited to) the United States and the European Union, and other jurisdictions in which our providers operate. Where AI processing occurs, it is routed through Zero Data Retention endpoints so that your interview data is not stored after processing. We take reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with Australian privacy laws.

Our primary database (Supabase) is hosted in Sydney, Australia (ap-southeast-2). All personal information is stored in Australia, and we are committed to maximising Australian data residency where practicable.

6. Data Sharing

We may share your personal information with:

• Your organisation — the organisation that arranged your access to KylieBot may have access to interview outputs and narratives generated on their behalf.
• Service providers — third-party vendors who assist us in operating the platform (as described in Section 4) and where that disclosure is reasonably necessary for us to provide the Service.
• Legal requirements — where we are required to disclose information by law, court order, or governmental authority, or to respond to Notifiable Data Breach requirements (see Section 9).

7. Data Security (APP 11)

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

• All data in transit is protected with HTTPS/TLS encryption.
• Database encryption at rest (Supabase AWS KMS).
• Passwords are hashed with bcrypt.
• Role-based access control (user, admin, super_admin) with least-privilege policies.
• Administrative actions are logged with timestamps for audit purposes.
• Regular security scanning and dependency vulnerability monitoring.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

8. Data Retention (APP 11)

We retain your personal information for the periods outlined below:

After retention periods expire, data is permanently deleted and cannot be recovered.

9. Data Breach Notification

In accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988, we have procedures to detect, assess, and respond to data breaches.

If we determine an eligible data breach has occurred, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) within 30 days.
• Notify affected individuals as soon as practicable.
• Provide a description of the breach, the kind of information involved, and recommended steps to mitigate potential harm.

If you suspect unauthorised access to your account, change your password immediately and contact us at privacy@kyliebot.com.

10. Your Rights (APP 12, 13)

10.1 Access your personal information

You can view your profile information in account settings and access generated reports in the dashboard. You may also email us at privacy@kyliebot.com to request a copy of your personal information; we will respond within 30 days.

10.2 Correct your personal information

You can update profile information directly in account settings. To correct inaccuracies in interview transcripts or other data, contact us and we will respond within 30 days.

10.3 Delete your account and data

You may request account deletion by contacting us at support@kyliebot.com, or via the account settings page. A 30-day grace period applies to allow cancellation. After that, all personal information is permanently deleted except audit logs (retained for 24 months) and financial transaction records (retained for 7 years as required by tax law).

10.4 Withdraw consent

You may withdraw consent in writing for AI processing of interview data or for non-essential email communications. To withdraw consent, contact us at privacy@kyliebot.com. You must not use the Service if you have withdrawn your consent. Because our use of personal information in accordance with this Privacy Policy is required to provide the Service, if you withdraw your consent you also consent to us suspending your access to Service and you acknowledge that under our Terms you may remain liable for payment of your subscription until the end of the subscription period.

11. Anonymity and Pseudonymity (APP 2)

Where practicable, you may interact with us anonymously or using a pseudonym (for example, for initial enquiries or general support questions). However, to provide our core services — interview processing, report generation, and account authentication — we require your real name and a valid email address.

12. Cookies

We use essential cookies to maintain your authenticated session. These cookies are necessary for the platform to function and cannot be disabled. We do not use advertising or tracking cookies.

13. Children’s Privacy

KylieBot is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a person under 18, please contact us immediately at privacy@kyliebot.com and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the platform and ask you to review and re-accept the updated policy before continuing to use the Service. Continued use after acceptance of an updated policy constitutes agreement to the revised Privacy Policy.

15. Complaints (APP 1)

If you have a concern about the way we handle your personal information under the Australian Privacy Principles, you may:

• Step 1: Contact us — email privacy@kyliebot.com. We will investigate and respond within 30 days.
• Step 2: Escalate to the OAIC — if you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, by phone on 1300 363 992, or by email at enquiries@oaic.gov.au.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or need to report a privacy concern, please contact us at:

STEM MATTERS PTY LTD
ABN 69 169 537 142
Email: privacy@kyliebot.com

Appendix: Australian Privacy Principles Coverage

This Privacy Policy addresses all 13 Australian Privacy Principles: