Privacy policy.

1Introduction

This Privacy Policy of Trilogy Labs Pty Ltd (ACN 695 253 279) trading as "Cookify" (us, we, our) sets out our procedures regarding the handling of personal information, including the collection, use, disclosure and storage of information, as well as the rights available to you to access and correct that information.

We operate an AI-powered recipe and meal planning service that generates personalised recipes and meal plans tailored to user preferences, allergies and dietary goals (Services). Our Services do not process grocery payments or fulfil grocery delivery. Where users elect to purchase groceries, checkout occurs on the relevant retailer's platform.

Our Services are provided through our mobile application's interface, our website with the domain name cookify.com.au, and ancillary platforms that facilitate the operation of our Services (the Platform). We will handle personal information in accordance with the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs).

By using the Platform or our Services, or by providing any Personal Information or Sensitive Information to us, you consent to the collection, use and disclosure of your information as set out in this Privacy Policy. We are committed to protecting and ensuring the confidentiality and security of any Personal Information and Sensitive Information that we may collect, use and hold.

From time to time, we may revise or update this Privacy Policy or our information handling practices. If we do so, the revised Privacy Policy will be published on the Platform.

2Definitions

Personal Information has the meaning given to it under the Privacy Act.

Sensitive Information has the meaning given to it under the Privacy Act.

We may collect Personal Information and Sensitive Information in order to conduct our business, to provide and market our services and to meet our legal obligations.

3The types of information we collect

The types of Personal Information we may collect and hold include (but are not limited to):

Visitors of our Platform

Usage data General

Device identifiers, log data, IP address, and cookie/analytics data as described below.

Users of our Platform

Contact details General

Full name, email address and, where provided, telephone number.

Account & billing General

Usernames, emails, subscription status and transaction confirmations provided to us by the Apple App Store.

Usage analytics General

Device type, browser information, IP address, pages viewed, features used, session durations, error logs and diagnostics.

Communications & support General

Messages, attachments, screenshots, explanations of issues, email communications, chat logs and metadata related to your request.

Profile & preferences Sensitive

Dietary preferences, allergies and intolerances, age, gender, height, weight, body fat percentage, fitness goals, training intensity, activity levels, meals per day preferences and cooking skill level.

Other General

Other Personal Information required to provide our Services in specific cases.

You are not obliged to provide Personal Information to us. However, in many cases, if you do not provide Personal Information to us, we may not be able to supply our Services to you.

In some circumstances, you may provide to us, and we may collect from you, Personal Information about a third party. Where you provide the Personal Information of a third party, you must ensure that the third party is aware of this Privacy Policy, understands it and agrees to accept it. If you are providing us with Personal Information on behalf of a person who is under the age of 18 whom you are the parent or guardian of, you understand that you are consenting to this Privacy Policy on their behalf as their legal guardian.

4Anonymity and Pseudonymity

Where lawful and practicable, you may choose to remain anonymous or use a pseudonym when dealing with us. For example, you may browse our website without identifying yourself. However, if you do not provide certain Personal Information or Sensitive Information, we may not be able to provide you with our Services, respond to your enquiries, or otherwise engage with you in a meaningful way.

5How information is collected and held

We collect Personal Information and Sensitive Information in the following ways:

• when you submit information through our Platform, account set up processes, configuration settings, or provide it in correspondence by email, telephone or through our website;
• integration with third party providers' external systems, including retailer platforms and subscription processing platforms;
• automatically via cookies, pixels, automated syncing and similar technologies;
• from third parties such as referees, service providers and public sources; and
• in the course of providing our Services to you.

We store Personal Information and Sensitive Information in computer storage facilities. We take steps to protect your information against loss, unauthorised access, use, modification or disclosure, including:

• strong computer and network security protocols, including firewalls, encrypted connections, identification codes, access privileges, and password protection measures;
• continuous maintenance and monitoring of security systems to ensure information remains secure during transmission and storage;
• requiring any third parties engaged by us to handle your information in a manner consistent with Australian law and contractual requirements; and
• taking reasonable steps to destroy or de-identify information after we no longer need it for our business or to comply with the law.

6Data Breaches

We are required to comply with the Notifiable Data Breaches scheme under the Privacy Act. If we experience an eligible data breach involving your Personal Information or Sensitive Information, we will take reasonable steps to investigate the breach, and where required, notify you and the Office of the Australian Information Commissioner (OAIC) of the circumstances and the steps you can take to protect your information.

7Collection through activity (Cookies)

Information that may identify you as a user may be gathered during your access of our Platform and use of our Services.

The Platform may include pages that use 'cookies'. A cookie is a unique identification number that allows the server to identify and interact more effectively with your computer or device. The cookie assists us in identifying what our visitors find interesting on our Platform.

A cookie may be allocated each time you use our Platform. Cookies do not generally identify you personally on their own, but they may identify your device and may become associated with you when linked with other information we hold. Cookies allow us to understand how visitors interact with our Platform and to improve functionality and performance.

You can configure your access to our Platform to refuse cookies. If you do so, you may not be able to use all or part of our Platform.

8Analytics

We may use analytics services provided by third-party service providers to help us analyse how visitors and enquirers use our Platform. Although the service providers record data such as your geographical location, device, internet browser and operating system, none of this information personally identifies you with us.

The information generated about your use of our Platform may be transmitted to and stored on servers operated by our analytics service providers, which may be located in Australia or overseas (including the United States or the European Union), depending on the provider. The service providers will use the information on behalf of us for the purpose of evaluating your use of our Platform and Services, compiling reports on activity for us and providing us with other services relating to activity and internet usage. The IP address collected will not be associated with any other data held by the service provider.

9The purposes for which we use information

We collect, hold, use and disclose Personal Information for a variety of business purposes, including:

• Providing and supporting our Services — to operate and improve the functionality of the Platform, process and respond to enquiries, generate insights and reports about your use of the Platform and selected meal plans, provide support to users, and any other ancillary function to provide our Services;
• Quality and safety — fraud prevention, abuse monitoring, troubleshooting, performance and security;
• Improving our business, products and services — including analytics, research, testing, diagnostics, product development and updates;
• Marketing by us — to promote our business, products and services;
• Enquiries and complaints — to handle and respond to enquiries, complaints and feedback;
• Disclosures to integrated platforms (including retailer checkout systems and subscription processing systems), and service providers (including hosting, storage, communications, payments and analytics providers, who are contractually restricted in their data access and use); and
• Legal, safety and corporate transactions — to comply with laws, detect/prevent fraud or security incidents, enforce our terms, and in connection with mergers, acquisitions or reorganisations.

We collect, hold, use and disclose Sensitive Information for the purpose of providing and supporting our Services — to operate and improve the functionality of the Platform, generate insights and reports about your past deliveries, provide support to users, and any other ancillary function to provide our Services.

We use your information for the purpose we collected, outlined above, or a related purpose you'd reasonably expect, or as permitted or required by law. Otherwise, we will ask for consent or rely on another APP exception.

10AI features

As part of our Services, we use AI services to filter and tailor recipes to the preferences, allergies and dietary goals of our users. We rely on third-party AI providers for these services and do not guarantee that the information, recommendations or recipes provided by the AI functionality is correct or suitable. User discretion and review are recommended when using the AI functionality.

When you request a recipe or meal plan, relevant profile and input information may be transmitted to the AI provider via application programming interface (API) for the purpose of generating a response. We understand that Personal Information and Sensitive Information processed through the Platform is not used to train public AI models.

We do not use Personal Information and Sensitive Information processed through the Platform to train public AI models. AI outputs may generate or infer information about an individual (including by drawing inferences from communications, recipes or other inputs). Where an AI output identifies an individual, or could reasonably identify an individual, we treat that information as Personal Information and handle it in accordance with this Privacy Policy.

11Direct marketing

We also collect, hold, use and disclose your Personal Information to:

• notify you about the details of new services and products offered by us;
• send you our newsletters and other marketing publications;
• administer our databases for client service, marketing and accounting purposes;
• otherwise promote our business; and
• to comply with our legal requirements regarding the collection and retention of information concerning the products and services that we provide.

We will only send you direct marketing communications where you have consented or where you would reasonably expect to receive such communications from us. We will not disclose your Personal Information to third parties for their own marketing purposes unless you expressly opt in.

You may opt out of receiving direct marketing communications from us at any time and at no cost by using the unsubscribe facility in our communications or by contacting us using the details set out below. We will action your opt-out request as soon as reasonably practicable.

12Disclosures to Third Party Service Providers

We may disclose your Personal Information and Sensitive Information to third parties who work with us in our business to promote, market or improve the services that we provide, including:

• cloud hosting providers;
• cybersecurity and monitoring partners;
• software vendors and AI providers;
• consultants, payment processors and delivery partners;
• data storage providers;
• analytics providers; and
• professional advisers who assist us in operating our business and delivering our Services.

We use third-party payment service providers to process transactions securely. These providers may collect and store your payment details in accordance with their own privacy policies.

We may also combine your Personal Information and Sensitive Information with information available from other sources, including the entities mentioned above, to help us provide better services to you.

Where we do share information with third parties, we require that there are contracts in place that only allow use and disclosure of Personal Information and Sensitive Information to provide the service and that protect your information in accordance with Australian law. Otherwise, we will disclose Personal Information and Sensitive Information to others if you've given us permission, or if the disclosure relates to the main purpose for which we collected the information and you would reasonably expect us to do so.

13Overseas Disclosure

We may disclose your Personal Information and Sensitive Information to overseas recipients, including our cloud hosting providers, analytics service providers, AI providers, email and communications platforms, payment processors, delivery service providers, and other technology service partners who assist us in providing our Services.

These recipients may be located in countries including, but not limited to, the United States, the United Kingdom, member states of the European Union, Singapore and other jurisdictions in which our service providers operate.

Where we disclose information to an overseas recipient, we take reasonable steps to ensure that the recipient complies with the Australian Privacy Principles or is otherwise bound by privacy and security obligations, including contractual and technical safeguards appropriate to the circumstances. This may include contractual arrangements, technical safeguards, and due diligence on the recipient's privacy and security practices.

By providing your Personal Information and Sensitive Information to us, you acknowledge that, despite such protections, overseas recipients may not be subject to Australian privacy laws.

14Data Retention

We store, process, and retain Personal Information and Sensitive Information for as long as reasonably necessary to provide our Services and to comply with our legal obligations, including obligations under taxation, corporate and record-keeping laws. After the applicable retention period has expired, we will take reasonable steps to destroy or de-identify the information unless we are required or authorised by law to retain your information for a longer period.

We may ask you to verify your identity before acting on any of your requests.

15How we handle requests to access your information

You have a right to request access to your Personal Information and Sensitive Information which we hold about you and to request its correction. You can make such a request by contacting us using the contact details set out in this policy.

We will respond to any such request for access as soon as reasonably practicable. Where access is to be given, we will provide you with a copy or details of your information in the manner requested by you where it is reasonable and practicable to do so.

We will not charge you a fee for making a request to access your information. However, we may charge you a reasonable fee for giving you access to your Personal Information and Sensitive Information.

In some cases, we may refuse to give you access to the information you have requested or only give you access to certain information. If we do this, we will provide you with a written statement setting out our reasons for refusal, except where it would be unreasonable to do so.

Before providing access or making any corrections, we may need to verify your identity to ensure the security of your information. We aim to respond to all access and correction requests within 30 days, or otherwise within a reasonable period.

16How we handle requests to correct your information

We will take such steps (if any) as are reasonable in the circumstances to make sure that the Personal Information and Sensitive Information we collect, use or disclose is accurate, complete, up to date and relevant.

If you believe the information we hold about you is inaccurate, irrelevant, out of date or incomplete, you can ask us to update or correct it. To do so, please contact us using the contact details listed below.

Where we correct information that we previously disclosed to another entity, we will take reasonable steps to notify that entity of the correction, unless it is impracticable or unlawful to do so.

17How to contact us or make a complaint

If you have any questions about this Privacy Policy, if you wish to correct or update information we hold about you or if you wish to request access or correction of your Personal Information or Sensitive Information or make a complaint about a breach by us of our privacy obligations (including the way we have collected, disclosed or used your information), please contact us at the details below.

We will acknowledge your complaint promptly and will respond to you in writing within 30 days, or such longer period as may be agreed with you, outlining the outcome of our investigation and any steps we will take to address your concerns. We will take reasonable steps to remedy any failure to comply with our privacy obligations. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem.

If you are not satisfied with our response, you have the right under Section 36 of the Privacy Act to lodge a complaint with the OAIC at:

• Website: www.oaic.gov.au
• Phone: 1300 363 992