Privacy Policy

We collect information you provide directly to us, such as when you create an account, start a free trial, or contact us for support. This includes: • Name, email address, and phone number • Business name, type, and location • Billing information (processed securely via our payment provider — we do not store card details) • Usage data and activity within the platform • Communications you send us We also collect information automatically when you use our services, including IP address, browser type, device information, and pages visited.

We use the information we collect to: • Provide, maintain, and improve the Shoulder Monkey platform • Process transactions and send billing-related communications • Send onboarding, product updates, and support communications • Personalise your experience and pre-configure your account • Analyse usage patterns to improve our product • Comply with legal obligations We do not sell your personal information to third parties.

Account data for Australian businesses is stored on Australian servers, and account data for New Zealand businesses on New Zealand servers. Calls and texts answered by our AI assistant are the exception: some of the providers that handle them are overseas (see Calls and Texts Answered by Our AI Assistant). Otherwise, data is not transferred outside your region without your consent, except where required by law. We use industry-standard encryption (TLS/SSL) for data in transit and encryption at rest for sensitive data. We implement access controls, audit logging, and regular security reviews. Our infrastructure maintains SOC 2 compliance and industry-standard security practices. While we take data security seriously, no method of transmission or storage is 100% secure. We encourage you to use a strong, unique password for your account.

We share your information only in the following circumstances: • With service providers who assist us in operating our platform (e.g., payment processors, email delivery, hosting providers) • With our platform infrastructure provider, to deliver the service • With the providers that answer and carry our phone calls and texts (see Calls and Texts Answered by Our AI Assistant) • When required by law or in response to valid legal process • In connection with a merger, acquisition, or sale of assets (you will be notified) We require all third parties to maintain appropriate data security standards.

When you call or text Shoulder Monkey, you may be answered by Donna, our AI assistant. Donna can: • answer questions about our services; • check our calendar and book a discovery call at a time you choose; • text you a booking link; • pass your enquiry to our team, with a short summary. What we collect. We collect: • your phone number; • what you say on the call or in your texts; • your name and your business; • what you tell us about your business: its type, its team size, the software you use now, what you need help with and how soon you want to start; • whether your business is in Australia, and whether you can make the decision yourself; • whether you asked how to sign up, or asked for a call back. Recording. Calls are recorded as written transcripts: your speech is turned into text as you talk. We do not keep audio recordings. The transcript and the summary are saved with your contact record in our CRM, so our team can follow up. Who processes it. To answer a call or text, the information passes through these providers: • Twilio carries calls and texts between the phone network and us. • LiveKit carries the live audio of a call. • Deepgram turns speech into text. We have opted out of Deepgram using call audio to improve its models. • Anthropic provides Claude, the AI model that decides what Donna says. • ElevenLabs turns Donna's replies into speech. • Our CRM and messaging platform: – stores your contact record, transcripts and summaries; – sends and receives texts. Donna itself runs on a server we operate in Sydney. The providers above are based in the United States. They may process information there, or in other countries where they operate. We use them only to provide this service. How long we keep it. Transcripts and summaries stay with your contact record while we deal with your enquiry and any work that follows. We delete them when you ask (see Your Data Rights). Your choices. • Ask Donna for a call back, and a person from our team will call you. • Reply STOP to any text, and we will stop texting you. • Tell Donna you do not want to be contacted again, and we will note it on your record and stop contacting you. You can also reach us directly (see Contact Us).

Donna is a computer program. It uses your personal information to make some decisions without a person involved at the time: • What kind of caller you are: a possible customer, a referral partner, an existing client, or a sales or spam call. A sales or spam call raises no alert for our team. • How quickly our team follows up. Donna marks an enquiry as urgent when all of these apply: – your business is in Australia; – you can make the decision yourself; – you want to start within 30 days, asked how to sign up or booked a call. Referral partners are always marked urgent, and existing clients always get a call back. • Whether to arrange a call back from our team. • Booking a call, only ever at a time you choose. • Whether to reply to a text or leave it for our team, and stopping when you ask. To make these decisions, Donna uses: • what you tell it on the call or in your texts; • your phone number; • your existing contact record with us, if there is one. Donna does not decide whether we work with you or what you pay: a person does. Our team sees every enquiry Donna marks as urgent or as a call back. If you think Donna got something wrong, contact us and a person will look at it.

Depending on your jurisdiction, you may have the right to: • Access the personal data we hold about you • Correct inaccurate or incomplete data • Request deletion of your data • Object to or restrict certain processing • Data portability (receive your data in a structured, machine-readable format) Australian residents: Your rights are governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. New Zealand residents: Your rights are governed by the Privacy Act 2020. To exercise any of these rights, contact us at info@shouldermonkey.co. We will respond within 30 days.

We use cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse usage. You can control cookie settings through your browser, though disabling certain cookies may affect platform functionality. We do not use cookies for third-party advertising.

We retain your personal data for as long as your account is active or as needed to provide services. If you cancel your account, we will delete or anonymise your data within 90 days, unless we are legally required to retain it longer. Backup data may persist for up to 30 additional days after deletion.

Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies.

Shoulder Monkey is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the platform at least 14 days before the changes take effect. Your continued use of the platform after that date constitutes acceptance of the updated policy.

For privacy-related enquiries, requests, or complaints: Email: info@shouldermonkey.co Phone: +61 2 5657 6545 Address: Shoulder Monkey, 377 Kent St, Sydney NSW 2000, Australia If you are not satisfied with our response, you may contact the relevant authority in your jurisdiction: • Australia: Office of the Australian Information Commissioner (oaic.gov.au) • New Zealand: Office of the Privacy Commissioner (privacy.org.nz)