Privacy Policy

This Privacy Policy explains how Top Idea Australia Pty Ltd ACN 097 172 757 (ABN 15 097 172 757) ("Traleado", "we", "us", "our"), the operator of the Traleado platform at https://traleado.com and the Traleado mobile applications (collectively, the "Platform"), collects, uses, holds and discloses Personal Information.

Traleado is an "APP entity" under the Privacy Act 1988 (Cth) (the "Privacy Act"). This Policy is written to comply with the Australian Privacy Principles ("APPs") in Schedule 1 to the Privacy Act. By using the Platform, you confirm that you have read and understood this Policy.

1. Who this Policy is for

The Platform is a two-sided lead marketplace. The Personal Information we handle falls into several categories:

• Account users — sellers, buyers and their employees who hold a Traleado Account and use the dashboard, mobile app or API.
• End consumers — individuals whose contact details and project information are submitted to the Platform as a "Lead" by a seller (or by the individual themselves via a seller's intake form, Facebook lead ad, Zapier integration or other channel).
• Visitors — anyone who visits the Traleado website or marketing pages.

Different parts of this Policy apply to different groups. Section 8 is specifically for end consumers whose Personal Information is submitted as a Lead.

2. The Personal Information we collect

2.1 From account users

When you create or use an Account, we collect:

• Identification and contact details — name, email address, phone number, profile image and role (seller, buyer, admin or sub-user).
• Business details — company name, ABN, address, trading region, service categories, website, marketing preferences and business description.
• Authentication data — email and password hashes (we do not store passwords in plain text), magic-link tokens, multi-factor authentication state, and sign-in event metadata.
• Account configuration — workspace settings, pipelines, partners, deals, campaigns, forms, integrations, notification preferences and access tokens for connected services (for example, Facebook Pages, Zapier).
• Payment and payout data — billing address, payment method metadata (we do not store full card numbers — they are tokenised and stored by Stripe), Stripe customer and Stripe Connect identifiers, Wallet balance and transaction history, GST registration status and tax identifiers.
• Activity data — pages visited within the dashboard, actions performed (listing a lead, sending a deal offer, accepting an offer, etc.), audit-log entries and timestamps.
• Support communications — emails, in-Platform messages and any other communication with our team.

2.2 From end consumers (in Leads)

When a Lead is created on the Platform — whether by a seller manually entering it, by an end consumer completing a Traleado-hosted form, by a Facebook Lead Ads webhook, by Zapier, or via another integration — we collect the following information about the end consumer:

• name, email address, phone number;
• address or service area (street, suburb, city, state, postcode);
• the service category and any project details, requirements, preferred timing, budget, photos or other information the end consumer chose to provide;
• the source of the Lead (which form, integration, ad or seller channel it came from);
• a derived score and analysis produced by the AI Verification engine (see section 3); and
• in some cases, additional metadata captured by the form or webhook (for example, IP address, device or browser, marketing UTM parameters).

2.3 From verification activity

When we conduct AI Verification (see section 3), we collect and generate:

• the audio recording of the verification call;
• a written transcript of the call;
• analysis derived from the call, including a sentiment score, intent score, lead strength score, job-size score and short and detailed call summaries;
• the timestamp, duration and disposition of each call attempt (verified, unresponsive, unclear, disqualified, voicemail, requalification result, etc.); and
• the content of any SMS messages exchanged with the end consumer for verification purposes.

2.4 From your use of the Platform

We automatically collect technical information when you interact with the Platform, including:

• device information (operating system, browser type and version, screen size);
• log information (IP address, timestamps, pages requested, referring page, user agent — including the "TraleadoMobile" marker we use to detect the native mobile app);
• cookies and similar technologies (see section 11); and
• session data (sign-in state, session expiry).

2.5 From third parties

We may receive Personal Information from third parties, including:

• Stripe — payment confirmations, transaction outcomes, dispute and chargeback events, and Connected Account onboarding status;
• Email and SMS providers — delivery, bounce, unsubscribe and complaint events;
• Facebook Lead Ads — Lead submissions sent to our webhook by the seller's Facebook Page;
• Zapier and other integrations — Lead submissions and configuration data sent by the seller's connected workflows; and
• Google Maps — address geocoding and place lookups.

2.6 Sensitive information

We do not deliberately collect "sensitive information" (as defined in the Privacy Act). If sensitive information is provided to us, we will only use and disclose it for the purpose for which it was provided.

3. AI Verification — call recording and automated processing

A core feature of the Platform is AI Verification, in which an automated voice agent (currently operated using our voice provider's infrastructure) calls the phone number on a Lead, asks a short series of questions to confirm the end consumer's intent, and produces a transcript and scored analysis. The call may also be supported by SMS exchanges.

Important details:

• Notice at the start of the call — the AI agent identifies itself as calling on behalf of the relevant seller, explains that the call is being recorded for quality and verification, and gives the end consumer the opportunity to opt out.
• Recording laws — Australia has both Commonwealth and state-based surveillance devices laws. Sellers warrant in our Terms of Service that they have collected consent from the end consumer that covers being contacted by Traleado on the seller's behalf and that calls may be recorded for verification purposes.
• Use of recordings and transcripts — recordings and transcripts are used to verify the Lead, to allow buyers to assess the Lead before and after purchase, to support dispute resolution, to monitor quality, and to improve the verification engine.
• No fully automated decisions with legal effect — the AI Verification engine is a quality-assessment tool. Decisions that affect end consumers (such as whether a quote is offered, or at what price) are made by the buyer, not by Traleado's automation.

4. How we collect Personal Information

We collect Personal Information:

• Directly from you — when you create an Account, complete a form, submit a Lead, respond to a verification call, or contact our team.
• From sellers — when a seller submits a Lead about you (an end consumer).
• From integrations — Facebook Lead Ads, Zapier, embedded forms on seller websites, and similar channels.
• From our service providers — payment processors, voice/SMS providers, email providers, geocoding providers and hosting providers.
• Automatically — through cookies, server logs and analytics.

Where it is reasonable and practicable to do so, we collect Personal Information directly from the individual concerned. Where we collect Personal Information from a seller or integration about an end consumer, the seller is responsible under the APPs (and under our Terms of Service) for ensuring that the end consumer is properly notified and that the collection is lawful.

5. Purposes for which we use Personal Information

We use Personal Information to:

1. Operate the Platform — create and authenticate Accounts, provide the dashboard and mobile app, deliver the marketplace, deals, campaigns and partner-routing features, and process Lead submissions and purchases.
2. Verify Leads — place verification calls and SMS exchanges, record and transcribe those exchanges, score and analyse the resulting data, and surface verification results to sellers and buyers.
3. Match Leads with buyers — score the suitability of Leads against buyer requests, deal lines and partner arrangements, and present matching Leads in the marketplace.
4. Process payments and payouts — charge buyers, calculate and remit seller payouts via Stripe Connect, issue tax invoices and statements, and handle refunds, chargebacks and disputes.
5. Communicate with you — send transactional emails (purchase confirmations, lead delivery notifications, dispute updates, password resets, security alerts), respond to support enquiries, send notifications you have opted into, and send marketing communications (only with consent and subject to opt-out).
6. Maintain quality and safety — operate fraud, abuse and quality controls including the daily lead cap, pre-engine validators, duplicate detection, dispute investigations and the requalification engine.
7. Improve the Platform — analyse aggregated usage patterns, debug issues, develop new features and tune the AI Verification engine.
8. Comply with the law — meet our obligations under the Privacy Act, the A New Tax System (Goods and Services Tax) Act 1999 (Cth), the Corporations Act 2001 (Cth), the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (in connection with Stripe identity checks), the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and other applicable laws.
9. Enforce our Terms — investigate suspected breaches of our Terms of Service, suspend or terminate Accounts and pursue legal claims.

We will not use your Personal Information for a purpose that is not listed above without your consent, unless the use is required or authorised by law.

6. To whom we disclose Personal Information

We disclose Personal Information to:

1. Buyers — when a buyer purchases a Lead, we provide the buyer with the end consumer's contact and project details so the buyer can contact the end consumer about the relevant enquiry. The buyer is granted a limited, single-purpose licence (the Lead Licence) to use this information, and the buyer is then a separate APP entity in respect of the Personal Information they receive. We also share verification outputs (call recording, transcript, summary and scores) with buyers to help them assess Leads.

2. Sellers — sellers receive the outputs of the AI Verification engine for the Leads they submit. Sellers also see whether a Lead has sold, to which Partner it was routed (if applicable), and the high-level identity of the buyer.

3. Service providers, including:

   • Stripe (payment processing, including under Stripe Connect for seller payouts);
   • our AI voice provider (currently Retell AI) and SMS gateway;
   • SendGrid (email delivery);
   • Supabase (database hosting and authentication);
   • Vercel (web and API hosting);
   • Google Maps (geocoding and address lookups); and
   • other infrastructure, monitoring, error-tracking and analytics providers we engage from time to time.

   We enter into contractual arrangements with these service providers that require them to handle Personal Information consistently with the Privacy Act and only for the purposes for which we have engaged them.

4. Authorities — to law enforcement, regulators, courts and other governmental bodies where required or authorised by law.

5. Professional advisers — our lawyers, accountants and auditors, on a confidential basis.

6. Buyers of our business — if we are subject to a sale, merger, restructure or insolvency event, we may disclose Personal Information to the prospective acquirer (subject to confidentiality undertakings) and ultimately transfer it to them.

We do not sell Personal Information to third parties. Selling Leads to buyers is not "selling Personal Information" in the marketing sense — buyers receive only the Personal Information necessary to follow up the specific enquiry, under a restricted Lead Licence.

7. Overseas disclosure

Some of our service providers store or process Personal Information outside Australia. The countries most likely to be relevant are:

• the United States of America (Stripe, Retell, SendGrid, Vercel and certain Supabase services);
• the European Union, the United Kingdom and other countries where our service providers operate edge or backup infrastructure.

Our primary database and authentication services are hosted in Australia (Sydney — ap-southeast-2).

When we disclose Personal Information overseas, we take reasonable steps to ensure that the overseas recipient handles the information in a way that is consistent with the APPs (for example, by entering into contractual data-processing arrangements). Under Australian Privacy Principle 8.1, we accept accountability for the acts and practices of overseas recipients in relation to that Personal Information, except where APP 8.2 applies.

8. End consumers whose data was submitted as a Lead

If you are an individual whose contact details were submitted to Traleado as a Lead, this section applies to you. We collect, hold, use and disclose your Personal Information as described in this Policy. In particular:

• the seller who submitted the Lead is the party that first collected your Personal Information and is responsible for ensuring that they had your consent to do so and to share it with us;
• we may contact you (or our AI Verification agent may contact you on the seller's behalf) by phone, SMS or email to confirm the details of your enquiry. You may decline at any time;
• if the seller lists the Lead on our marketplace and a buyer purchases it, that buyer will receive your contact details and may contact you about your enquiry under a limited Lead Licence;
• you may, at any time:
  • ask us what Personal Information we hold about you (APP 12);
  • ask us to correct Personal Information we hold about you (APP 13);
  • ask us to delete your Lead from the marketplace and from our systems (subject to any legal obligation to retain it);
  • ask not to be contacted further by Traleado or by buyers who have received your Lead; or
  • lodge a complaint about the way your Personal Information has been handled (see section 16).

To exercise any of these rights, submit a request at traleado.com/privacy/request or email team@traleado.com. We will respond to your request within a reasonable time (and in any event within 30 days for access requests under APP 12).

9. Marketing communications

We may send you marketing communications about Traleado, including product updates, tips, new features and offers, where:

• you are an account user and have not opted out;
• you have given us your consent (for example, by ticking a marketing-opt-in box on a marketing form); or
• we are permitted by law to send the communication (for example, where the communication is "factual information" or has an established business-relationship basis under the Spam Act 2003 (Cth)).

Every commercial electronic message we send includes a functional unsubscribe option. You can also update your marketing preferences from your Account settings or by emailing team@traleado.com.

Transactional emails (purchase confirmations, payout notifications, dispute updates, password resets, security alerts) are not marketing and are sent regardless of marketing preferences.

10. Direct contact by buyers

Where a buyer purchases a Lead, the buyer is permitted by the Lead Licence to contact you (the end consumer) about your enquiry. The buyer must comply with the Privacy Act, the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) when doing so. If you do not want a buyer to contact you, you can ask the buyer to stop directly, or contact us at team@traleado.com and we will assist.

11. Cookies and similar technologies

We use cookies and similar technologies to operate the Platform, to keep you signed in, to remember your preferences, and to understand how the Platform is used. The categories of cookies we use include:

• Strictly necessary cookies — required for sign-in, security and core Platform functionality.
• Functional cookies — remember your preferences (for example, the last pipeline you viewed).
• Analytics cookies — help us understand aggregate usage patterns (for example, page views, conversion funnels) so we can improve the Platform.
• Advertising and marketing cookies — on the marketing site, we may use cookies and pixels from advertising platforms (for example, Meta/Facebook, Google) to measure the effectiveness of our marketing.

You can control cookies through your browser settings. Disabling some cookies may prevent parts of the Platform from working correctly.

12. Children

The Platform is not intended for individuals under the age of 18 and we do not knowingly collect Personal Information from people under 18. If you become aware that a child has provided us with Personal Information without their parent's or guardian's consent, please contact us at team@traleado.com and we will take steps to delete that information.

13. Security of Personal Information

We take reasonable steps to protect Personal Information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including:

• encryption of data in transit (TLS) and at rest;
• access controls and authentication on production systems, with the principle of least privilege;
• separation of environments (development, staging, end-to-end test and production each run on isolated databases);
• service-role keys held server-side only and never exposed to client-side code;
• a documented incident response process; and
• contractual security obligations on our service providers.

No security control is perfect. If, despite our efforts, a data breach involving your Personal Information occurs, we will assess it under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act and, where the scheme requires, notify you and the Office of the Australian Information Commissioner.

14. Retention

We retain Personal Information for as long as it is reasonably needed for the purposes set out in this Policy or for as long as we are required to retain it by law. Specifically:

• Account data — retained while the Account is open and for a reasonable period after closure to allow for support, dispute resolution and tax reporting (currently up to 7 years after Account closure for transactional records, in line with ATO record-keeping obligations).
• Lead data and verification outputs (recordings, transcripts, analysis) — retained while the Lead is active in our system and for a reasonable period afterwards to support disputes, audits and improvements to the verification engine. Recordings and transcripts are subject to a shorter retention review than the underlying Lead record where retention is no longer necessary.
• Payment data — handled by Stripe and retained in accordance with Stripe's policies; retained by us only to the extent necessary to operate Wallets, reconcile transactions and meet tax obligations.
• Marketing data — retained while you remain subscribed and for a reasonable period after unsubscribe to prevent re-subscription in error.

When Personal Information is no longer needed and we are not required to retain it, we will take reasonable steps to destroy or de-identify it.

15. Your rights (Australian Privacy Principles 12 and 13)

You may, at any time, ask us to:

• provide you with access to the Personal Information we hold about you (APP 12); and
• correct Personal Information we hold about you that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13).

To make a request, submit our privacy request form or email team@traleado.com. We may need to verify your identity before processing the request. We will respond within a reasonable period (and in any event within 30 days for APP 12 access requests).

We do not charge a fee for making a request, but we may charge a reasonable fee for providing access where the access requires significant work on our part. We will tell you the fee before we provide the access.

There are some limited circumstances in which we may refuse access or correction (for example, where doing so would be unlawful, or would unreasonably impact the privacy of other individuals). Where we refuse a request, we will explain why and tell you how to complain.

16. Complaints

If you believe we have breached the Privacy Act or the APPs, you may make a complaint to us at team@traleado.com. Please include enough detail for us to investigate (what happened, when it happened, the Personal Information involved, and how you would like the matter resolved).

We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

If you are not satisfied with our response, or if at least 30 days have passed without a response, you may complain to the Office of the Australian Information Commissioner (OAIC):

• Website: https://www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

17. Changes to this Policy

We may update this Privacy Policy from time to time. The current version is always available at https://traleado.com/privacy. If we make a material change, we will notify you (for example, by email, an in-Platform notice, or a banner on the marketing site).

The "effective from" date at the top of this page tells you when the current version came into effect.

18. Contact

If you have any questions about this Privacy Policy, or about how we handle Personal Information, please contact:

Top Idea Australia Pty Ltd (trading as Traleado) ABN 15 097 172 757 Email: team@traleado.com Web: https://traleado.com