Privacy Policy

SMEC AI is operated by Boab AI Pty Ltd (ABN 60 640 047 007) as part of the Australian Government's AI Adopt program. This Privacy Policy explains how we collect, use, store, and safeguard personal information when you use smecai.com.au, book a consultation, call the AI Information Line, or use our self- service tools.

By using our website or services, you agree to the terms outlined in this Privacy Policy. If you do not agree, please do not use our website or submit your personal information through our forms.

Information We Collect

At SMEC AI, we are committed to building trust and ensuring that you have a clear understanding of your personal data's role in your journey with us. Here's a breakdown of the types of personal information we collect and the methods we use to gather it.

Types of Personal Information Collected

1. Contact Data

When you create an account with us, we ask for your name, email address, phone number, and billing/mailing addresses. This information allows us to communicate effectively with you, process your orders, and provide timely support.

2. Demographic Data

We collect information about your location, age, and other demographic details. This helps us understand our audience better and tailor our services to meet your needs.

3. Profile Data

As part of the account creation process, you'll set up a username and password. This information helps us manage your account securely and keep it accessible only to you.

4. Communications Data

Any correspondence between you and SMEC AI.au, whether through our website, email, SMS or social media, falls under this category. We gather this information to improve our services and respond to your inquiries.

5. User-Generated Content

We encourage you to share your thoughts and insights! Any materials you upload, such as documents, feedback, or course-related content, are considered user-generated content. This enriches our community and helps us improve our offerings based on your input.

6. Voice and Call Data

When you call the AI Information Line and speak with our AI voice assistant, we collect an audio recording of the call and a written transcript of what is said, along with related metadata such as the date, time and duration of the call.

Calls are recorded. We use recordings to answer your enquiry, to produce the written summary we send you, and for quality assurance. Recording is a condition of using the AI voice assistant: we ask for your consent at the start of the call, before we discuss your enquiry, and if you do not consent we will not continue on that call. You can instead contact us by email at info@smecai.au, or ask us to book you with a member of our team. You can also end the call at any time.

We do not use what you say to train AI models. Your call audio, transcripts and any content you provide are not used to train, fine-tune or improve any artificial intelligence model, whether ours or a third party's. The service providers that power the AI voice assistant are contractually bound not to use your content for model training, and are configured so that call content is not retained by them after the call.

Please avoid sharing sensitive information (such as health, financial account or government identifier details) during a voice call, as it is not necessary for us to assist you. We do not ask for sensitive information and our assistant is not designed to collect it. If you do provide it, we will handle it in accordance with this policy and will take reasonable steps to delete it where it is not required.

7. Other Information

We may collect additional information that isn't explicitly listed here, which we will use as described in this Privacy Policy or otherwise disclosed at the time of collection.

Methods of Data Collection

To ensure a seamless experience on SMEC AI.au, we use several methods to collect your information:

1. Direct Collection

We collect information directly when you fill out forms, register for an account, or sign up for our services. This is your opportunity to provide us with accurate details that help us serve you better.

2. Automatic Collection

We also automatically gather information as you navigate our website. This includes:

• Device Data: Information about the device you're using, such as its operating system, browser type, and IP address.
• Online Activity Data: Insights into your interactions with our website, including pages viewed, time spent on pages, and navigation paths.
• Communication Interaction Data: Information about your interactions with our emails, such as whether you opened them or clicked on links.

3. Cookies

We utilise cookies and similar technologies to enhance your experience on our site. These small data files help us remember your preferences and analyse user behaviour. You can manage or disable cookies through your browser settings, and this Privacy Policy explains how we use them.

How We Use Your Information

At SMEC AI.au, the information you share with us is used to create a more personalised and effective experience tailored just for you. We are committed to using your personal information responsibly and transparently. Here's a closer look at how we utilise your data:

Purpose of Data Usage

1. To Provide and Improve Services

We use your information to operate and enhance our platform, ensuring that our courses and AI products are effective and user-friendly. This includes everything from developing new features to troubleshooting issues that may arise. By analysing your feedback and usage patterns, we continuously strive to improve our offerings and create an exceptional learning experience tailored to your needs. As set out above, this does not include using your call content to train AI models.

2. To Create, Administer, and Teach Courses

Your data plays a crucial role in the development and delivery of our courses. We use the information collected to personalise your learning experience, assess your performance, and ensure you have access to all necessary materials. Whether you're engaging with course content or earning a certificate, your information helps us provide a seamless educational journey.

3. To Communicate with You

Staying connected is important! We use your contact details to send you important updates about our services, inform you of new courses, products, or features, and respond to any inquiries you may have. Whether it's a reminder about a course, a newsletter, or information about maintenance on our site, we aim to keep you informed and engaged.

If you have used the AI Information Line, we will send you an SMS containing your written AI Information Summary and, where relevant, a link to book a session. These messages relate to the enquiry you made and identify us as the sender. We will not send you promotional SMS messages unless you have consented to receive them, and any promotional message we do send will include a way to opt out.

4. To Personalise User Experiences

Every user is unique, and so are your preferences. We analyse your interactions with SMEC AI.au to tailor your experience to better suit your interests. From suggesting relevant courses to providing personalised recommendations, our goal is to make your time with us as enjoyable and beneficial as possible.

5. For Marketing Purposes

We may use your information to send you promotional communications about our services, upcoming events, and special offers that align with your interests. You can opt out of receiving these marketing emails at any time by clicking the “unsubscribe” link included in our messages. We want to ensure that you only receive information that you find valuable.

6. To Support Research and Development

Your participation in our courses helps us understand how learners engage with our content. Also, your request for consultation and productivity tools, help us to understand the pain points and major issues SMEs face. We use this information to conduct research and improve our offerings, ensuring that we continue to provide high-quality resources that meet the needs of SMEs.

7. To Maintain Security and Compliance

We take your privacy and security seriously. Your information helps us track and prevent fraudulent activities, ensure compliance with legal obligations, and maintain the integrity of our platform. We may use your data to investigate suspicious behaviour and protect both you and our services from potential threats.

8. With Your Consent

In certain situations, we may ask for your explicit consent to collect, use, or share your personal information for specific purposes. Your trust is important to us, and we will only proceed with your data as described at the time of collection.

Automated Decision-Making

From 10 December 2026, Australian privacy law requires us to tell you when we use computer programs to make, or to do something substantially and directly related to making, a decision that could significantly affect your rights or interests. We want to be upfront about where automation sits in our services.

1. How Our AI Voice Assistant Works

When you start a voice call, several automated systems work together, and personal information moves between them:

• You speak, and your speech becomes text. Our voice platform captures the call audio and converts what you say into a written transcript in close to real time.
• An AI language model interprets it. The transcript is processed by an AI model that works out what you are asking and decides how to reply.
• A recommendation engine selects what you are told. The assistant passes what you have told it to an internal recommendation service. That service — not a member of our team — determines which of our courses, AI products, consultations and next steps are surfaced back to you during the call. It may also surface categories of third-party tools, and occasionally named examples of them, as options for you to consider.
• Automation routes the outcome to us. The call details, transcript and any enquiry you raise are passed through our workflow automation so that we can follow up with you.

The practical point is this: the information you provide during a call shapes what the assistant tells you, and that selection is made automatically.

2. What Information the Automated Systems Use

The recommendation engine acts on what you tell the assistant during the call — how you describe your business, its size and industry, the problems you are trying to solve, and the questions you ask — together with the contact details you provide and basic call metadata such as date, time and duration. It does not draw on credit reporting information, and we do not buy personal information about you from data brokers to feed it.

3. Third-Party Tools Are Examples, Not Endorsements

Where the assistant or your written summary refers to a third-party product, tool or vendor, it is provided as an example of the kind of option available to you. It is not a recommendation, endorsement or assurance that the product is suitable for your business, and you should carry out your own assessment before purchasing or adopting anything. SMEC AI does not receive any commission, fee or other benefit from any vendor for referring you, and no vendor pays to be mentioned by our service.

4. Where Else We Use Automated Processing

We also use automated processing to personalise course and product recommendations on our website, to analyse how our website is used, and to help detect fraudulent or suspicious activity that could threaten your account or our platform.

5. What These Decisions Do and Do Not Determine

These recommendations are informational. They exist to help you find services that are relevant to you. They are not used to decide whether you are eligible for a service, what you are charged, or whether we will work with you. We do not use automated decision-making to assess creditworthiness, employment suitability, or entitlement to any benefit. Decisions that carry a material commercial effect for you — engagement terms, scope and pricing — are made by our team, and a person is always involved before we enter into an arrangement with you.

6. AI Output Can Be Wrong

Our AI voice assistant can misunderstand you, and it can be confidently incorrect. What it tells you is general information about our services and about AI adoption generally. It is not professional, legal, financial, tax or technical advice, and you should not rely on it as the sole basis for a business decision. If something the assistant says matters to your decision, please confirm it with us, or with a suitably qualified professional, before acting on it.

7. Human Review and Your Options

You can always speak to a person instead of relying on an automated recommendation. Before we discuss your enquiry we ask for your consent to the call being recorded, and you can decline or end a call at any time. Where you accept our Privacy Policy and Terms through one of our web forms, we keep a record of that acceptance, including the date and time, as proof of your consent. If you would like a human to review anything the AI voice assistant has told you, or if you object to your information being processed in this way, please contact our Privacy Officer at info@smecai.au. Choosing not to use the voice assistant does not affect your access to our services; you can reach us by email instead.

User Rights

At SMEC AI.au, we believe that you should have control over your personal information. Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to access and to correct the personal information we hold about you. Beyond those two rights, and as a matter of good practice rather than because Australian law currently requires it, we also offer the further options set out below.

1. Right to Access Personal Information

You have the right to know what personal information we hold about you. This means you can request access to your data at any time. We want to be transparent, so if you want to see what information we have collected, just let us know, and we'll provide it to you in a clear and understandable format.

2. Right to Correct Inaccurate Information

If you find that any of the personal information, we have about you is incorrect or outdated, you have the right to request corrections. It's important to us that your data is accurate, so if something doesn't seem right, please reach out and we'll help you make the necessary updates.

3. Requesting Deletion of Your Information

Australian privacy law does not give a general right to erasure, but you can ask us to delete the personal information we hold about you, and we will do so unless we are required to keep it for a legal or contractual reason. This includes asking us to delete a specific call recording and transcript.

4. Asking Us to Limit How We Use Your Information

You can ask us to limit or stop a particular use of your personal information. If you feel that your data is being used in a way you do not agree with, let us know and we will consider your request and take your concerns seriously, subject to our legal obligations.

5. Requesting a Copy of Your Information

Although Australian privacy law does not currently include a general data-portability right, we will, where practicable, provide a copy of the personal information you have given us in a commonly used format so you can keep it or share it with another provider. Just let us know if you need this.

6. Dealing with Us Anonymously

Where it is lawful and practicable, you have the option of dealing with us anonymously or under a pseudonym, for example when you make a general enquiry. Some services, such as creating an account or receiving a consultation report, do need identifying details in order for us to provide them.

Data Sharing and Disclosure

At SMEC AI.au, we value your trust, and we want to be transparent about how your personal information may be shared. While we take great care to protect your data, there are certain circumstances where we may need to disclose your information. Here's a closer look at when and why we might share your information:

Circumstances Under Which Information May Be Shared

1. With Third-Party Service Providers

To provide you with the best possible experience, we work with trusted third-party service providers. This includes payment processors who handle your financial transactions securely, IT support that helps us host, maintain, and improve our platform, and the voice, language-model and workflow-automation providers that power our AI voice assistant. These partners assist us in delivering our services, and while they have access to your information necessary for their roles, they are required to protect your data, to use it only for the intended purposes, and not to use it to train AI models.

2. For Legal Obligations

Sometimes, we may need to share your information to comply with legal requirements. This includes responding to subpoenas, court orders, or other legal processes. We also share information when necessary to protect our rights or the rights of others, or to investigate and prevent illegal activities. Ensuring compliance with laws is essential, and we take these responsibilities seriously.

3. With Business Partners and Affiliates

We may have the need to collaborate with business partners and affiliates for co-marketing initiatives or events that may benefit our users. When this happens, we might share your information with them to enhance your experience, such as informing you about new courses or special product offers. Rest assured; we only work with partners who share our commitment to protecting your data.

4. In the Context of Business Transactions

If we undergo any significant business changes, like mergers, acquisitions, or reorganizations, your information may be shared as part of that process. In these situations, your data could be transferred to the new entity or partner, but we will ensure that any successor continues to protect your information in accordance with this Privacy Policy.

While we may share your information in these circumstances, we always strive to do so responsibly and in a way that respects your privacy.

Overseas Disclosure (Cross-Border)

Some of the service providers we rely on to run SMEC AI.au — in particular our AI voice assistant, workflow automation, hosting, analytics and communications tools — store or process personal information outside Australia. Where practicable we keep your information in Australia, but the providers that power these features are likely to process it in the United States, the European Union and the United Kingdom, and potentially other countries where those providers or their sub-processors operate.

Before disclosing your information to an overseas recipient, we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles, including through contractual data-protection commitments. We remain accountable for how your personal information is handled by these providers, and we do not ask you to waive that accountability as a condition of using our services.

Data Retention

We keep your personal information only for as long as it is reasonably necessary for the purposes described in this policy, or as required by law. When information is no longer needed for a purpose permitted under this policy, we take reasonable steps to destroy it or to de-identify it.

For the AI Information Line specifically, we retain call recordings, transcripts and the written summary we send you for 12 months from the date of the call, after which they are deleted or de-identified. We may keep them for longer only where we are required to by law, or where they are needed in connection with a complaint, dispute or investigation. You can ask us to delete a call recording and transcript sooner by emailing info@smecai.au.

Data Security

At SMEC AI.au, we understand that your personal information is sensitive, and we take reasonable steps to protect it. Here's how we work to keep your information secure:

1. Technical Safeguards

We protect your information in transit using encryption (HTTPS/TLS), and information at rest is held on encrypted storage. Access to our systems is restricted through authentication and network controls. These measures are designed to reduce the risk of unauthorised access, though no method of transmission or storage is completely secure.

2. Organizational Safeguards

We have internal policies and procedures that govern how personal information is handled, and we restrict access to your data to those who need it to perform their role. We work to keep our team aware of good data-protection practices.

3. Physical Safeguards

Your information is stored on infrastructure we operate or that is operated by established cloud providers, in Australia where practicable. Where we rely on cloud providers, their data centres are physically secured with controlled access and monitoring. Where we operate infrastructure ourselves, we apply equivalent access, network and physical controls.

4. Commitment to Monitoring and Auditing

Security is an ongoing process. We review our security practices and work to address vulnerabilities as we identify them, and we update our measures as our systems and the threat landscape change.

5. Acknowledgment of Inherent Risks

While we do everything, we can to protect your information, it's important to acknowledge that no system is entirely foolproof. There are inherent risks associated with any online service, including the possibility of cyberattacks or data breaches. We want you to be aware of these risks and assure you that we are continuously working to mitigate them through our security practices and by staying informed about the latest threats.

Data Breaches and Notification

Because we hold personal information — including voice recordings and transcripts processed through our AI voice assistant and the automation systems behind it — we maintain a data breach response plan aligned with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth). If a system that holds your information were compromised, this is how we respond.

1. Contain

As soon as we become aware of a suspected breach, we act quickly to contain it — for example, by shutting down or isolating the affected system, revoking compromised credentials, and taking steps to recover or secure the data and prevent any further unauthorised access.

2. Assess

We promptly assess what happened, what personal information was involved, and whether the breach is likely to result in serious harm to any affected individuals. We take all reasonable steps to complete this assessment within 30 days of becoming aware of the grounds for suspecting a breach, and sooner wherever possible.

3. Notify

If we determine that an eligible data breach has occurred — one likely to result in serious harm that we cannot prevent through remedial action — we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. Our notification will describe the nature of the breach, the kinds of information involved, and the steps you can take to protect yourself, along with the steps we have taken in response.

4. Review

After responding to a breach, we conduct a review — including a root-cause analysis — and update our systems, policies and staff training to reduce the likelihood of a similar breach happening again.

If you believe your information may have been affected by a data breach, please contact our Privacy Officer at info@smecai.au. You can also learn more about the NDB scheme and your rights at the OAIC's website, oaic.gov.au.

Changes to This Privacy Policy

At SMEC AI.au, we understand that privacy is an evolving matter. As we continue to grow and adapt, our Privacy Policy may need to change to reflect new practices or comply with laws. We want you to be fully informed about how we handle your personal information, so here's how we'll communicate any changes to this policy:

1. Procedure for Updating the Privacy Policy

Whenever we make updates to our Privacy Policy, we'll take the necessary steps to review and revise the document carefully. We aim to ensure that any changes are clear, transparent, and beneficial for our users. Our goal is to keep the policy up-to- date with the latest practices and legal requirements.

2. Methods of Notifying Users About Significant Changes

We believe in keeping you in the loop! If there are significant changes to our Privacy Policy that might impact how we handle your personal information, we'll make sure to notify you in a timely manner. Here's how we'll do it:

• Website Notices: You'll see a prominent notice on our website, alerting you to the changes. We want to ensure you have easy access to the updated policy whenever you visit SMEC AI.au.
• Emails: For those subscribed to our newsletters or other communications, we'll send out an email detailing the updates. This way, you'll receive direct information about what's changed and how it might affect you.

3. Date of Last Update for Transparency

To maintain transparency, we will always include the date of the last update at the top of the Privacy Policy. This way, you can easily see when the document was last reviewed or modified. We encourage you to check back regularly to stay informed about our practices.

Contact Information

If you have any questions, concerns, or feedback regarding our Privacy Policy or how we handle your personal information, please don't hesitate to reach out. Your thoughts are important to us, and we want to ensure you feel supported and informed.

For general inquiries or specific questions about your personal data — or to access or correct your information — you can reach our Privacy Officer by email at info@smecai.au. We strive to respond promptly to all messages.

If you wish to make a complaint about how we have handled your personal information, please email us at info@smecai.au with the details of your concern. We will acknowledge your complaint, investigate it, and aim to respond within a reasonable time. If you are not satisfied with our response, you can escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.