Welcome to Thryvve. This Privacy Policy explains how we collect, use, and protect your personal information when you use our website and chat assistant application. This policy applies to all services provided by Thryvve Group Pty Ltd, ABN 22 689 026 408. Last Updated: 1 September 2025

1. WHAT INFORMATION DO WE COLLECT?

Thryvve follows data minimization principles and only collects information necessary to provide our mortgage broking assistance platform. The Personal Information we collect includes: Account Information: - Email address (required for account access and platform communications) - First name and last name (optional, for personalized experience) Usage Analytics: - City-level location data (for service monitoring and compliance purposes only) - Platform usage data including pages visited and features accessed - Invitation and referral activity for team collaboration features Payment Processing: - Payment and billing information is collected and processed solely by our third-party payment processor (Stripe) - Thryvve does not store or have access to your credit card details or full billing information - We only receive confirmation of successful payment transactions We do not collect sensitive personal information such as detailed financial records, client information, or precise location data beyond city level. All data collection is limited to what is necessary for platform functionality, security, and legal compliance.

2. TYPES OF INFORMATION

The Privacy Act 1998 (Cth) (Privacy Act) defines types of information, including Personal Information. Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not. If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as “Personal Information” and will not be subject to this privacy policy.

3. HOW WE COLLECT YOUR PERSONAL INFORMATION

(a) We may collect Personal Information from you whenever you input such information into the Website, related app or provide it to Us in any other way. (b) We may also collect cookies from your computer which enable us to tell when you use the Website and also to help customise your Website experience. As a general rule, however, it is not possible to identify you personally from our use of cookies.

4. PURPOSE OF COLLECTION AND USE

We collect and use your Personal Information for the following specific purposes: Platform Services: - Providing access to our mortgage policy assistant - Facilitating team collaboration and invitation features - Processing subscription payments and managing billing - Providing customer support and technical assistance Platform Improvement: - Analyzing usage patterns to improve platform functionality - Monitoring service performance and identifying technical issues - Conducting research and development for new features Legal and Compliance: - Meeting our legal obligations under Australian financial services regulations - Preventing fraud and maintaining platform security - Enforcing our terms of service and resolving disputes Communications: - Sending service-related notifications and platform updates - Providing direct marketing communications (with consent and opt-out options) - Responding to your inquiries and support requests We will not use your Personal Information for purposes beyond those disclosed without obtaining your consent, unless required or authorized by law.

5. SECURITY, ACCESS AND CORRECTION

(a) We store your Personal Information in a way that reasonably protects it from unauthorised access, misuse, modification or disclosure. When we no longer require your Personal Information for the purpose for which we obtained in, we will take reasonable steps to destroy and anonymise or de-identify it. Most of the Personal Information that is stored in our client files and records will be kept for a maximum of 7 years to fulfill our record keeping obligations. (b) The Australian Privacy Principles: - (i) permit you to obtain access to the Personal Information we hold about you in certain circumstances (Australian Privacy Principle 12); and - (ii) allow you to correct inaccurate Personal Information subject to certain exceptions (Australian Privacy Principle 13). (c) Where you would like to obtain such access, please contact us in writing on the contact details set out at the bottom of this privacy policy.

6. DISCLOSURE AND OVERSEAS TRANSFER

Service Providers: We may disclose your Personal Information to trusted third-party service providers who assist us in operating our platform, including: - Cloud hosting providers (for secure data storage and platform operation) - Payment processors (Stripe for billing and subscription management) - Analytics services (for platform improvement and monitoring) - Customer support tools (for providing assistance) Overseas Transfers: We prioritize storing your Personal Information within Australia. Your core account data and platform information is hosted on Australian servers. Only the following services process Personal Information outside Australia: - Payment Processing: United States - processes payment transactions and billing information - Analytics: United States - processes usage analytics and platform performance data Both providers maintain security standards equivalent to or exceeding Australian requirements and are bound by contractual obligations to protect your Personal Information. We regularly review these arrangements to ensure ongoing compliance with Australian privacy standards. Legal Disclosures: We may disclose your Personal Information if required by law, court order, or to comply with legal processes, or to protect our rights, property, or safety, or that of our users or the public. We do not sell, rent, or trade your Personal Information to third parties for their marketing purposes.

7. DATA RETENTION AND DELETION

Retention Periods: - Account information: Retained while your account is active and for 2 years after account closure - Usage analytics: Retained for 3 years for platform improvement purposes - Payment records: Retained for 7 years to meet Australian tax and financial record obligations - Support communications: Retained for 3 years for quality assurance and legal compliance Data Deletion: You may request deletion of your Personal Information at any time by contacting us. We will process deletion requests within 30 days, except where retention is required by law or for legitimate business purposes (such as outstanding payments or legal disputes). When we delete your Personal Information, we ensure it is permanently removed from our active systems and backups within a reasonable timeframe.

8. DATA SECURITY AND BREACH NOTIFICATION

Security Measures: We implement industry-standard security measures to protect your Personal Information, including: - Encryption of data in transit and at rest - Regular security assessments and monitoring - Access controls and authentication measures - Secure cloud infrastructure with redundant backups Data Breach Response: In the event of a data breach that is likely to result in serious harm, we will: - Notify the Office of the Australian Information Commissioner within 72 hours - Notify affected individuals as soon as practicable - Take immediate steps to contain and remediate the breach - Provide clear information about the breach and steps being taken to address it

9. COOKIES AND TRACKING TECHNOLOGIES

Essential Cookies: We use necessary cookies for platform functionality, including: - Authentication and session management - Security and fraud prevention - Basic analytics for service provision Optional Cookies: We may use additional cookies for: - Enhanced analytics and platform improvement - Personalized user experience You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

10. YOUR PRIVACY RIGHTS

Under Australian privacy law, you have the right to: - Access: Request access to your Personal Information we hold - Correction: Request correction of inaccurate or incomplete information - Deletion: Request deletion of your Personal Information (subject to legal requirements) - Portability: Request your data in a portable format where technically feasible - Withdraw Consent: Withdraw consent for marketing communications or optional data processing - Complaint: Lodge a complaint about our privacy practices To exercise these rights, contact us using the details provided in this policy. We will respond to requests within 30 days.

11. POLICY UPDATES

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will: - Notify users of material changes via email or platform notification - Post the updated policy on our website with the effective date Your continued use of the platform after policy updates constitutes acceptance of the revised terms.

12. COMPLAINT PROCEDURE

If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us as on the contact details set out at the bottom of this policy. All complaints will be considered and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner.

13. HOW TO CONTACT US ABOUT PRIVACY

If you have any queries, or if you seek access to your Personal Information, or if you have a complaint about our privacy practices, you can contact us through support@thryvve.com.au.