Privacy Policy

1. Who we are and when this policy applies

Ripley Labs Pty Ltd (ABN 70 683 401 514) (Ripley Labs, we, us or our) provides a Google Business Profile and Google Maps visibility service called Ripley Local. This policy explains how we handle your personal information when you visit our website at ripleylabs.com.au, apply for or use Ripley Local, or contact us.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles.

In this policy, personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in a material form or not.

2. What personal information we collect

We may collect:

• identity and contact details, such as your name, business name, email address, phone number and business address;
• business information, including your Google Business Profile details, website address, industry or category, service area and target keywords, and optionally a description of your ideal customer;
• payment information. Our payment provider handles your card details directly. We do not see or store full card numbers. We hold a customer identifier and, where our provider exposes it, the last four digits of your card;
• records of your communications with us, including support and sales enquiries;
• information you enter into the dashboard; and
• technical information collected automatically when you use our website or the dashboard, including device and connection information, IP address and usage data.

We collect sensitive information only if you provide it to us, or otherwise consent to us collecting it.

We do not collect administrative credentials to your Google Business Profile or website as part of Ripley Local. We may offer other services in future that require website access. That is not part of Ripley Local.

3. How we collect personal information

We collect personal information:

• directly from you, when you apply, complete onboarding, use the service, or contact our support and sales team;
• from publicly available sources, such as your Google Business Profile and business directories; and
• automatically, through our website and the dashboard. Tracking is minimal at launch.

4. Why we collect it and how we use it

We collect and use your personal information to:

• assess whether the service is a fit for your business;
• create and manage your account;
• deliver and support the service, including configuring and running your campaign and tracking and reporting performance;
• provide Reports, audits and dashboard access;
• process billing and payments;
• send service messages, including trial confirmations, trial reminders, billing notices, first-charge confirmations, report notifications and support messages;
• provide customer support and respond to your enquiries;
• maintain the security of our systems and the service;
• comply with our legal, tax, accounting and regulatory obligations; and
• maintain and improve the service.

We use your personal information for the purpose for which we collected it, for a related purpose you would reasonably expect, for a purpose you have consented to, or as otherwise permitted or required by law. We may use aggregated and de-identified information to understand and improve the service. We do not treat information as de-identified if it can reasonably identify you or your business contact.

5. To whom we disclose it

We may disclose personal information to our employees, contractors and advisers who need it for the purposes described in this policy.

We may use third-party service providers to help deliver and support the service. We disclose personal information to these providers by function, including:

• payment processing;
• data hosting and storage;
• email delivery;
• technology platform providers that help us deliver the service;
• security and content delivery; and
• error monitoring and analytics.

We also disclose personal information to our professional advisers, such as accountants and lawyers, and where we are permitted or required to do so by law, to enforce our Terms and Conditions, or as part of a sale or restructure of our business. We do not sell your personal information.

6. Overseas disclosure

Ripley Labs is an Australian company. Some of the service providers and technical infrastructure we rely on are located overseas, currently in the European Union and the United States. This means some of your personal information is handled overseas.

We are working to move primary data storage to an Australian region.

Where we disclose personal information to overseas recipients, we take reasonable steps to ensure those recipients handle it consistently with the Australian Privacy Principles. This section addresses our cross-border disclosure obligations under Australian Privacy Principle 8.

7. Where your information is stored

At launch, your personal information is stored in the European Union. Some supporting service providers may process information in the United States or through global networks. We intend to move primary data storage to an Australian region after an initial validation period, and we will update this policy when that move occurs.

8. Cookies and tracking

Our website uses strictly necessary cookies for authentication and security, for example to keep you logged in and to protect your session.

We do not use analytics or advertising cookies at launch.

If we introduce other cookies or tracking in future, we will update this policy and, where required, provide appropriate notices or controls. Most browsers let you manage or block cookies, although some features may not work without strictly necessary cookies.

9. How we protect your information

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include:

• encryption of data in transit;
• access controls that limit who can view your information;
• not storing full card numbers;
• account-level controls, including your own password; and
• using reputable service providers.

No method of transmission or storage is completely secure. We take reasonable steps consistent with the sensitivity of the information we handle, but we cannot guarantee absolute security. You are responsible for keeping your login credentials secure and for ensuring that people who access your account are authorised by you.

10. How long we keep it

We keep your personal information while you have an active subscription, and for the one-year read-only window after cancellation. Your account continues after cancellation so that you can use any other free services we offer, until you choose to delete it.

We keep invoices and tax records for the period required by Australian tax law, which is generally five years. We keep backups, which are cycled in the ordinary course, and information may remain in backups for a limited period before being overwritten or deleted.

You can request deletion of your personal information, or delete your account, at any time, except for records we are required to keep by law.

11. Access and correction

You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, incomplete or out of date. Use the contact details in section 16.

We will respond within a reasonable time. There are limited circumstances in which we may refuse access, for example where giving access would unreasonably affect another person's privacy or where we are required or permitted by law to refuse. If we refuse, we will give you written reasons.

12. Marketing communications and opt-out

There is a difference between service messages and marketing messages. Service messages, such as onboarding emails, trial reminders, billing notices and report notifications, are part of providing the service and are not marketing. You may not be able to opt out of service messages while you have an active account or subscription, because they are necessary to provide and administer the service.

We do not send marketing messages at launch. Marketing is opt-in. If we begin sending marketing messages, they will comply with the Spam Act 2003 (Cth), including identifying us as the sender, only being sent with your consent, and including a working unsubscribe option that we honour promptly. You can opt out at any time using the unsubscribe link or by contacting us at admin@ripleylabs.com.au.

13. Eligible data breaches

We comply with the Notifiable Data Breaches scheme under the Privacy Act. If we become aware of an eligible data breach that is likely to result in serious harm, and we have not been able to prevent that likely risk through remedial action, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

14. Complaints

If you think we have mishandled your personal information, please contact us using the details in section 16, with enough detail for us to investigate. We will acknowledge and respond within a reasonable time, and we aim to respond within 30 days where practicable. If your complaint is complex, we will let you know how the investigation is progressing.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

15. Changes to this policy

We may update this policy from time to time. We will publish the updated policy on our website and update the effective date. Where a change is significant, we will take reasonable steps to notify you, for example by email where we have your address.

16. Contact

For privacy questions, requests or complaints, contact:

Ripley Labs Pty Ltd ABN 70 683 401 514 Email: admin@ripleylabs.com.au Website: ripleylabs.com.au

17. Effective date and version

This policy is effective from June 8th, 2026. Version 1.2.