Privacy Policy

This Privacy Policy (“Policy”) explains how LithicBlue Pty Ltd (“LithicBlue,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal data when you visit our websites, use the LithicBlue platform, or otherwise interact with us (collectively, the “Services”). It also describes the rights and choices available to individuals with respect to their personal data.

We are committed to processing personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, and the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles. Our information security program is designed to align with the SOC 2 Trust Services Criteria and ISO/IEC 27001, as further described in our trust center at trust.lithicblue.com.

Section 1. Scope and Our Role

1.1. Scope

This Policy applies to personal data we process about visitors to our websites, prospective customers, authorized users of the Services, and other individuals who interact with LithicBlue. It does not apply to third-party websites, products, or services that may be linked to or integrated with the Services, which are governed by their own privacy notices.

1.2. Controller and Processor Roles

For personal data we collect about our own website visitors, account holders, and prospects (such as registration details, billing information, and usage information), LithicBlue acts as a controller and determines the purposes and means of processing. Where our customers upload or submit content to the Services in the course of using the platform (“Service Data,” as defined in our Master Service Agreement), our customer is the controller of any personal data contained in that Service Data and LithicBlue acts as a processor that processes such data on the customer's behalf and under its documented instructions. Our processing of Service Data on behalf of customers is governed by the Master Service Agreement and applicable data processing terms rather than by this Policy.

Section 2. Personal Data We Collect

2.1. Information You Provide

We collect personal data you provide directly, including: (a) account and profile information such as name, business email address, job title, organization, and, where you choose to provide them, phone number and profile image; (b) billing and business contact information provided in connection with an order form, such as billing contact name, email, and postal address, together with records of invoices and transactions (LithicBlue invoices customers directly and does not collect or store payment card details); (c) communications you send to us, including support requests, feedback, demo bookings, and correspondence; and (d) any information you choose to submit when responding to surveys or participating in marketing activities.

2.2. Information We Collect Automatically

When you use the Services, we automatically collect usage and device information, including IP address, browser and device type, operating system, pages and features accessed, referring URLs, timestamps, and diagnostic and log data. We collect this information using cookies and similar technologies, as described in Section 6.

2.3. Information From Third Parties

We may receive personal data from third parties, such as single sign-on and authentication providers you use to access the Services, our customers (who may provision accounts for their authorized users), and providers of business contact and analytics data. We combine this information with data we already hold only where we have a lawful basis to do so.

2.4. Service Data

Content submitted to the Services by our customers may contain personal data relating to the customer's own clients or personnel. We process such Service Data solely as a processor, in accordance with the Master Service Agreement and the customer's instructions. LithicBlue does not use Service Data to train machine learning models and does not use Service Data as an input to any advisory or consulting offering. More broadly, LithicBlue does not use or access Service Data for any purpose beyond provisioning the Services and, where you have explicitly consented to it, actioning your service requests. Provisioning the Services includes accessing Service Data only as reasonably necessary to provide technical support, maintain the security and integrity of the Services, or comply with applicable law.

Section 3. How We Use Personal Data and Legal Bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases for processing personal data in our capacity as a controller:

3.1. To Provide and Administer the Services

We process account, billing, and usage information to create and manage accounts, authenticate users, deliver and maintain the Services, administer billing and invoicing, and provide customer support. Legal basis: performance of a contract with you or your organization, or our legitimate interests in operating and administering the Services.

3.2. To Secure and Improve the Services

We process usage, log, and diagnostic data to monitor and protect the security and integrity of the Services, prevent fraud and abuse, diagnose problems, and develop and improve features and functionality. Where we use such data for analytics and improvement, we anonymize or aggregate personal data where practicable. Legal basis: our legitimate interests in ensuring the security, reliability, and continued improvement of the Services.

3.3. To Communicate With You

We use contact information to send transactional and service-related messages (such as billing notices, security alerts, and service notifications) and, where permitted, marketing communications about our products and services. You can opt out of marketing communications at any time using the unsubscribe mechanism in those messages or by emailing [email protected]. Legal basis: our legitimate interests in promoting our business, or your consent where required by law. Transactional messages are sent on the basis of performance of a contract.

3.4. To Comply With Legal Obligations

We process personal data to comply with applicable laws, regulations, legal process, and enforceable governmental requests, and to establish, exercise, or defend legal claims. Legal basis: compliance with a legal obligation, or our legitimate interests in protecting our rights.

3.5. Legitimate Interests

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights and freedoms. You may contact us to request further information about this balancing assessment.

Section 4. Automated Processing and Artificial Intelligence

The Services use artificial intelligence and machine learning to help advisors scope and deliver reports with traceable insights. Outputs are generated as tools to assist users and are subject to human review; LithicBlue does not make decisions that produce legal or similarly significant effects about individuals through solely automated means without human involvement. We maintain enterprise agreements with our AI providers that contractually prohibit training on customer data and require that data is not retained beyond processing.

Section 5. How We Disclose Personal Data

5.1. Service Providers and Sub-Processors

We share personal data with third-party service providers and sub-processors who perform services on our behalf, such as cloud hosting, infrastructure, analytics, communications, payment processing, and customer support. These providers are only given access to the personal data reasonably necessary to perform their functions and are bound by contractual obligations to protect personal data and to process it only in accordance with our instructions. A current list of sub-processors used to process personal data is maintained in our trust center at trust.lithicblue.com.

5.2. Corporate Transactions

If LithicBlue is involved in a merger, acquisition, financing, reorganization, or sale of all or a portion of its assets, personal data may be disclosed or transferred as part of that transaction, subject to standard confidentiality protections and the continued application of this Policy.

5.3. Legal and Safety Reasons

We may disclose personal data where we believe in good faith that disclosure is necessary to comply with applicable law or legal process, to enforce our agreements, to protect the rights, property, or safety of LithicBlue, our customers, or others, or to detect, prevent, or address fraud, security, or technical issues.

5.4. No Sale of Personal Data

LithicBlue does not sell, rent, or lease personal data to third parties, and does not disclose personal data for third-party advertising purposes.

Section 6. Cookies and Similar Technologies

We use cookies and similar technologies to operate our websites, remember your preferences, authenticate users, measure and analyze usage, and improve the Services. Strictly necessary cookies are required for the Services to function. Where required by law, we obtain consent before setting non-essential cookies and provide a mechanism to manage your preferences. You can also control cookies through your browser settings, although disabling certain cookies may affect the functionality of the Services.

Some browsers offer a “Do Not Track” (DNT) signal. Because there is no common industry standard for interpreting DNT signals, our websites do not currently respond to them. Where applicable law requires, we treat a valid Global Privacy Control (GPC) signal as a request to opt out of the sale or sharing of personal data; we note that, as described in Section 5.4, LithicBlue does not sell or share personal data in any event.

Section 7. Data Residency and International Transfers

LithicBlue offers regional hosting, and your organization is assigned a single hosting region, currently North America, Europe, or Oceania, when it is provisioned. Your Service Data, including your documents, projects, and associated AI processing, is stored and processed within that region and is not transferred outside it. For more detail on our regions and how data residency works, see our regions documentation at lithicblue.com/docs/hosting/regions.

To the extent we process account, profile, or usage data for which LithicBlue acts as a controller, that data may be handled by us or our sub-processors in another country. Where such processing involves a transfer of personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we implement appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), together with supplementary measures where required. You may contact us to obtain further information about the safeguards we use.

Section 8. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, including to provide the Services, comply with our legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. Retention periods are determined based on the type of data, the purpose of processing, and applicable legal requirements. When personal data is no longer needed, we delete or anonymize it in accordance with our retention schedules. For Service Data processed on behalf of customers, retention and deletion are governed by the Master Service Agreement, including our obligation to make Service Data available for export for a period following termination before deletion.

Section 9. Information Security

We maintain administrative, physical, and technical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. Our information security program is designed to align with the SOC 2 Trust Services Criteria and ISO/IEC 27001 and includes measures such as encryption of data in transit and at rest, role-based access controls and least-privilege access, network security controls, logging and monitoring, secure software development practices, vendor risk management, and regular testing and review of our controls. Further detail about our security practices and current certifications is available in our trust center at trust.lithicblue.com. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will notify affected individuals and relevant authorities where required by applicable law.

Section 10. Your Privacy Rights

Depending on your location and applicable law, you may have some or all of the following rights with respect to your personal data:

• Access: to request confirmation of whether we process your personal data and to obtain a copy of it.
• Rectification: to request correction of inaccurate or incomplete personal data.
• Erasure: to request deletion of your personal data in certain circumstances.
• Restriction: to request that we restrict processing of your personal data in certain circumstances.
• Portability: to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Objection: to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Withdrawal of consent: where we rely on consent, to withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise these rights, please contact us at [email protected]. We will respond within the timeframes required by applicable law and may need to verify your identity before acting on your request. There is generally no charge for exercising your rights, though we may charge a reasonable fee or decline to act on requests that are manifestly unfounded or excessive, as permitted by law. If your personal data is processed by LithicBlue as a processor on behalf of a customer, we will refer your request to the relevant customer, who is the controller, and support them in responding.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority. If you are in Australia, you may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. We would, however, appreciate the opportunity to address your concerns before you do so.

Section 11. US State Privacy Rights

If you are a resident of California or another US state with a comprehensive consumer privacy law, you may have additional rights with respect to personal data that LithicBlue processes as a controller (or “business”). Over the preceding twelve months, we have collected the categories of personal data described in Section 2, namely: identifiers (such as name, business email address, and account identifiers); professional or employment information (such as job title and organization); commercial information (such as billing contact and transaction records); internet or other electronic network activity (such as usage, log, and device information); and the contents of communications you send to us. We collect this personal data from the sources, and use and disclose it for the business purposes, described in Sections 2, 3, and 5.

Subject to applicable law, you may have the right to: (a) know and access the categories and specific pieces of personal data we have collected about you; (b) request deletion of your personal data; (c) correct inaccurate personal data; (d) opt out of the “sale” or “sharing” of personal data and of targeted advertising; and (e) not receive discriminatory treatment for exercising your rights. As described in Section 5.4, LithicBlue does not sell personal data and does not share personal data for cross-context behavioral advertising, and we do not use or disclose sensitive personal data for purposes that would require the ability to limit such use under applicable law.

To exercise these rights, contact us at [email protected]. You may use an authorized agent to submit a request on your behalf, provided the agent supplies proof of authorization and we are able to verify your identity. Where applicable law provides a right to appeal a decision on your request, you may submit an appeal by replying to our response or contacting us at the same address.

Section 12. Children's Privacy

The Services are intended for use by businesses and their personnel and are not directed to children. We do not knowingly collect personal data from children under the age of 16. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete it.

Section 13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date above and, where required by law, provide additional notice. Your continued use of the Services after the effective date of any updated Policy constitutes your acknowledgment of the changes to the extent permitted by law.

Section 14. How to Contact Us

If you have questions, concerns, or requests regarding this Policy or our processing of your personal data, please contact us at:

LithicBlue Pty Ltd
Level 9, 276 Flinders Street, Melbourne, VIC 3000, Australia
Email: [email protected]