Privacy Policy

1. Introduction

Welcome to KylieBot’s privacy policy (Privacy Policy). KylieBot is an AI-driven platform that helps scientists, technologists, researchers, and entrepreneurs articulate the impact of their work through interview-based narrative creation.

This Privacy Policy explains how STEM Matters Pty Limited (ABN 69 169 537 142) (“we”, “us”, “our”), the operator of KylieBot, collects, uses, discloses, and protects your personal information in accordance with the Australian Privacy Principles (APPs). We use ‘you’ or ‘your’ to mean you and, where the context permits, includes an Authorised User.

By signing up for a KylieBot Account or using KylieBot you agree to the collection, use, and disclosure of your personal information in accordance with this Privacy Policy. We also use ‘point of collection’ click through privacy notices and consents so that we can be certain that you have actively given your consent to our collection and use of your personal information at the time we ask for it. Without your consent to collect personal information in accordance with this Privacy Policy, we will be unable to provide you with the Service.

We will not sell, rent, or trade your personal information to third parties. We do not share your information for marketing purposes or provide it to data brokers.

In this Privacy Policy, capitalised words that aren’t defined in the policy have the meanings set out in our Terms of Service.

2. Information We Collect (APP 3, 5)

2.1 Information you provide to us directly

• Account information — first name, last name, email address, organisation name (if applicable) and a password (we encrypt passwords). Additional information may also be collected relating to account administration such as contact information for other persons you authorise on your Account and information we need for billing. Where your Account will include Authorised Users in addition to you, we collect personal information about those users: first name, last name, email address and a password.
• Purchase information — where you buy KylieBot for yourself on our website (an Individual Purchase), your first name, last name and email address, an organisation name if you ask for one to be shown on your tax invoice, and a record of the order: what you bought, the amount, the date, your tax invoice number, the status of the payment, our payment provider’s reference for it, and any refund or dispute. We do not collect or store your card details. You enter them on a page operated by our payment provider (see Section 4).
• Professional profile information — often in the form of biography (each individual’s bio is of course different and you may have multiple versions, but typically it may contain information on your research areas, expertise, and career achievements; there may also be a crossover with information supplied in the interview).
• Interview content — via our AI-assisted interview process including transcripts generated from oral interviews, and typically may include professional stories and narratives, research descriptions, impact statements, grant application details, and career accomplishments shared during the AI-assisted interviews.
• Voice recordings — audio captured during voice-based interviews. Recordings are processed by VAPI (our voice orchestration provider) and are not stored on KylieBot servers. VAPI retains recordings, transcripts, and call logs for approximately 14 days, after which they are automatically deleted.
• Feedback — the ratings and written answers you give about your interview and the content you received. Where you answer using the personalised link we email you, your response is linked to your account and to the interview it concerns, so that we can act on it and know not to ask you again. Where the survey is opened without that link, the response is stored without any details identifying who gave it.
• Other user-generated or user-originating content — for example when you input edits to KylieBot’s generated reports, provide feedback on narrative drafts, and when you communicate with our support team.

2.2 Information we collect automatically

• Technical data — IP address, browser type and version, device type, operating system, and connection quality metrics. In common with many websites, we collect this data to assist us in the basic operation of the KylieBot website and platform. It also allows us to debug / monitor the service and improve it over time.
• Usage data — pages visited, features used, interview session durations, report generation requests, credit usage history, login timestamps, and session activity. We collect this data to assist with the security of the website and for personalisation of the service to offer more relevant content.
• Consent records — records of when you or an Authorised User indicated your agreement to this policy, including IP address, browser type, and policy version accepted.

3. How We Use Your Personal Information (APP 6)

3.1 Primary purposes

We use your personal information to provide and operate the KylieBot Service. This includes:

• Account management: opening and administering your Account, user authentication, and account security.
• Taking payment and fulfilling a purchase: for an Individual Purchase, arranging payment through our payment provider, issuing your tax invoice, creating your Account, emailing your personal interview link, and handling any refund or payment dispute.
• Conducting your interview: running AI-driven voice interviews and transcribing the interview audio.
• Creating and delivering your content: generating AI-driven narrative content from your interview responses, such as profile pieces, impact narratives, grant narratives, and funding pitches, and delivering it to you via email and the platform dashboard.
• Communications: communicating with you about your account, interviews, outputs, and service updates. This includes a single email, sent a couple of days after your content is delivered, inviting you to tell us what you thought. Answering is optional, and we do not send a reminder.
• Analytics and service improvement: analysing usage patterns, user behaviour, platform performance, and the feedback you give us, to diagnose issues, understand how the Service is used, and inform product improvements.
• Legal and compliance: maintaining compliance records and audit trails, and meeting our legal obligations.

Conducting your interview and generating your content involve disclosing your information to the third-party AI service providers described in Section 4, who act on our behalf and only for the purposes above.

3.2 Secondary purposes

De-identified industry reporting: we may use aggregated and/or de-identified information derived from the Service, including from interview content, to produce reports, insights, benchmarking materials and industry trend analyses that may be shared with our customers or other third parties. These materials are prepared so that they do not contain, and could not reasonably be used to identify, any individual. We do not attempt to re-identify de-identified information.

3.3 What we will not do

We will not use your personal information for direct marketing, profiling for third-party advertising, or any other secondary purpose not listed above without first updating this policy and, where required, seeking your consent.

We advertise KylieBot through Google Ads. To measure how well those advertisements work, our public website (not the signed-in platform or your interview) carries Google’s advertising tag, described in Sections 4 and 12. We never share your account details, interview content, or generated content with Google or any other advertiser.

4. Use of Artificial Intelligence and Third-Party Service Providers (APP 6)

The Service uses artificial intelligence (AI) technologies, including large language models (LLMs), to conduct structured interviews and generate narrative content.

In providing the Service, your personal information — including interview responses, voice recordings, and professional information — may be disclosed to and processed by the key third-party service providers set out below, who act on our behalf to deliver AI functionality, data processing, and related services:

• OpenRouter — our AI gateway, which routes interview and content-generation requests to Anthropic’s Claude language models. Zero Data Retention is enabled, so requests are routed to enterprise endpoints (AWS Bedrock and Google Vertex) and are not stored after processing.
• Anthropic — provides the Claude large language models used to conduct interviews and generate your content, accessed via OpenRouter. Your inputs and outputs are not used to train Anthropic’s models.
• VAPI — our voice orchestration provider (United States / European Union), which coordinates the real-time interview between the speech-to-text, language model, and text-to-speech services. VAPI retains recordings, transcripts, and call logs for approximately 14 days; during this period it may use this data in de-identified form to improve its own services.
• Deepgram — our speech-to-text provider (United States), which transcribes interview audio. We have opted out of model training, and data is retained only for the time needed to process each request.
• ElevenLabs — our text-to-speech provider (United States), which generates KylieBot’s interview voice. Zero Data Retention is enabled, so no interview data is stored, and data is not used for training.
• Supabase — our primary database (Sydney, Australia), which stores your account data, interview transcripts, and generated content.
• Resend — our email provider (United States), which delivers the emails we send you, including your content and the invitation to give feedback on it. It receives your email address and the contents of those emails, and retains delivery logs for approximately 30 to 90 days.
• Airwallex — our payment provider (Australia and overseas), which takes card payments for Individual Purchases on a payment page that it operates. It collects your card details and the other payment information you enter there directly from you, and handles that information under its own privacy policy. We send it the amount and a reference for your order, and it tells us whether the payment succeeded, is under review, was refunded or was disputed. We never receive or store your card details.
• Vercel — our web hosting provider (global edge network), which serves the KylieBot website and application and keeps access logs for 30 days.
• Google (Google Ads, United States), our advertising provider. Its tag runs on our public website only, never on signed-in pages or during an interview. When you visit a public page, Google receives the page address (with everything but campaign and ad-click details removed), your IP address, and details of your browser and device, and uses them to tell us whether people who clicked one of our advertisements went on to contact us or buy. Google handles this information under its own privacy policy.

We take reasonable steps to ensure that these providers are subject to appropriate privacy and confidentiality obligations. Our AI providers do not use your interview inputs or outputs to train their models.

Our third-party providers may change from time to time as we improve or modify the Service. A current list of key service providers is also available upon request.

5. Cross-Border (Overseas) Disclosure (APP 8)

Some of our third-party service providers are located outside Australia. As a result, your personal information may be transferred to, and processed in, countries including (but not limited to) the United States and the European Union, and other jurisdictions in which our providers operate. Where AI processing occurs, it is routed through Zero Data Retention endpoints so that your interview data is not stored after processing. We take reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with Australian privacy laws.

Our primary database (Supabase) is hosted in Sydney, Australia (ap-southeast-2). All personal information is stored in Australia, and we are committed to maximising Australian data residency where practicable.

6. Data Sharing

We may share your personal information with:

• Your organisation — the organisation that arranged your access to KylieBot may have access to interview outputs and narratives generated on their behalf. This does not apply to an Individual Purchase. Where you bought KylieBot for yourself, we do not share your purchase, your interview or your content with your employer or institution, even if you bought it using an email address they issued to you.
• Service providers — third-party vendors who assist us in operating the platform (as described in Section 4) and where that disclosure is reasonably necessary for us to provide the Service.
• Legal requirements — where we are required to disclose information by law, court order, or governmental authority, or to respond to Notifiable Data Breach requirements (see Section 9).

7. Data Security (APP 11)

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

• All data in transit is protected with HTTPS/TLS encryption.
• Database encryption at rest (Supabase AWS KMS).
• Passwords are hashed with bcrypt.
• Role-based access control (user, admin, super_admin) with least-privilege policies.
• Administrative actions are logged with timestamps for audit purposes.
• Regular security scanning and dependency vulnerability monitoring.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

8. Data Retention (APP 11)

We retain your personal information for the periods outlined below:

After retention periods expire, data is permanently deleted and cannot be recovered.

9. Data Breach Notification

In accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988, we have procedures to detect, assess, and respond to data breaches.

If we determine an eligible data breach has occurred, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) within 30 days.
• Notify affected individuals as soon as practicable.
• Provide a description of the breach, the kind of information involved, and recommended steps to mitigate potential harm.

If you suspect unauthorised access to your account, change your password immediately and contact us at privacy@kyliebot.com.

10. Your Rights (APP 12, 13)

10.1 Access your personal information

You can view your profile information in account settings and access generated reports in the dashboard. You may also email us at privacy@kyliebot.com to request a copy of your personal information; we will respond within 30 days.

10.2 Correct your personal information

You can update profile information directly in account settings. To correct inaccuracies in interview transcripts or other data, contact us and we will respond within 30 days.

10.3 Delete your account and data

You may request account deletion by contacting us at support@kyliebot.com, or via the account settings page. A 30-day grace period applies to allow cancellation. After that, all personal information is permanently deleted except audit logs (retained for 24 months) and financial transaction records (retained for 7 years as required by tax law).

If your Account was created through an Individual Purchase, deleting it from the account settings page takes effect immediately. There is no grace period and the deletion cannot be undone. Your interviews and content are removed, and the record of your purchase and its tax invoice is kept for the period above. You cannot delete your Account while you hold an interview you have paid for and not yet taken, or while a payment is under review or in dispute. Contact us first so that we can resolve it.

10.4 Withdraw consent

You may withdraw consent in writing for AI processing of interview data or for non-essential email communications. To withdraw consent, contact us at privacy@kyliebot.com. You must not use the Service if you have withdrawn your consent. Because our use of personal information in accordance with this Privacy Policy is required to provide the Service, if you withdraw your consent you also consent to us suspending your access to Service and you acknowledge that under our Terms you may remain liable for payment of your subscription until the end of the subscription period.

11. Anonymity and Pseudonymity (APP 2)

Where practicable, you may interact with us anonymously or using a pseudonym (for example, for initial enquiries or general support questions). However, to provide our core services — interview processing, report generation, and account authentication — we require your real name and a valid email address.

12. Cookies

We use essential cookies to maintain your authenticated session. These cookies are necessary for the platform to function and cannot be disabled.

On our public website only, the Google Ads tag sets advertising cookies, which Google uses to recognise that a visit came from one of our advertisements and to measure whether it led to an enquiry or purchase. These cookies are not set on signed-in pages or during an interview. You can block or delete them in your browser settings, and manage how Google uses them for advertising at myadcenter.google.com. Our website analytics (Vercel Web Analytics) does not use cookies.

13. Children’s Privacy

KylieBot is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a person under 18, please contact us immediately at privacy@kyliebot.com and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the platform and ask you to review and re-accept the updated policy before continuing to use the Service. Continued use after acceptance of an updated policy constitutes agreement to the revised Privacy Policy.

15. Complaints (APP 1)

If you have a concern about the way we handle your personal information under the Australian Privacy Principles, you may:

• Step 1: Contact us — email privacy@kyliebot.com. We will investigate and respond within 30 days.
• Step 2: Escalate to the OAIC — if you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, by phone on 1300 363 992, or by email at enquiries@oaic.gov.au.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or need to report a privacy concern, please contact us at:

STEM MATTERS PTY LTD
ABN 69 169 537 142
Email: privacy@kyliebot.com

Appendix: Australian Privacy Principles Coverage

This Privacy Policy addresses all 13 Australian Privacy Principles: