Socii Platform Privacy Policy

1. Introduction

1.1 Socii Book Pty Ltd (ACN 695 597 141) (trading as Socii) (we, us or our) operates a software platform accessible at www.sociiclub.com and via the Socii application (together, the Platform).

1.2 We are committed to managing personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) (Privacy Act).

1.3 This document sets out our policies for managing your personal information and is referred to as our Privacy Policy.

1.4 In this Privacy Policy, you and your refers to any individual about whom we collect personal information. This includes registered users, visitors to the Platform, and third parties whose personal information is submitted to or collected by the Platform.

1.5 If you have any queries about this Privacy Policy or the way we handle your personal information, please contact us using the details set out in section 21.

2. About the Platform

2.1 The Platform provides infrastructure for storing, tracking and managing referral relationships and related agreements. The Platform enables users to create business profiles, connect with other users, record and track introductions, manage events, communicate through a community board, access AI-assisted tools, and store referral agreements.

2.2 We are not a party to any referral agreement or arrangement between users of the Platform.

2.3 The Platform incorporates automated systems including algorithmic reputation scoring, adaptive interface personalisation, behavioural tracking, and AI-assisted features. These are described in this Privacy Policy.

3. Anonymity and Pseudonymity

3.1 The Platform requires users to register an account and provide accurate business and contact details in order to access and use the Platform.

3.2 It is not practicable for us to allow you to deal with us anonymously or using a pseudonym. This is because the Platform is designed to facilitate business-to-business referral relationships, which require users to identify themselves and their businesses to other users.

3.3 If you do not wish to provide personal information to us, you will be unable to use the Platform.

4. Information We Collect

4.1 The types of personal information we collect will depend on the circumstances of collection and your interaction with the Platform. The categories of information we may collect are set out below.

Account Registration

4.2 When you register for an account on the Platform, we collect:

• your full name;
• your email address;
• your phone number (if provided); and
• your password (stored only as a secure one-way hash, so we cannot read it).

Business Profile

4.3 When you create and maintain a business profile, we may collect:

• your business name;
• your Australian Business Number (ABN);
• your Australian Company Number (ACN);
• your business address;
• your industry;
• your role and title;
• your professional headline;
• services offered and areas of specialty;
• industry verticals;
• geographic coverage areas;
• ideal client description;
• client types and client size preferences;
• applicable legislation and professional conduct rules;
• restraint of trade dates;
• your profile photo and company logo;
• your pitch description;
• social media profile links; and
• other professional information you choose to provide.

Referral Kit Data

4.4 Where you complete your referral kit on the Platform, we collect:

• your ideal client description;
• exclusions (clients you do not wish to receive);
• talking points for referrers;
• fit checklists;
• key links and resources;
• one-pager or capability statement uploads; and
• deal criteria and preferences.

4.5 Referral kit data is made available to your connections on the Platform to assist them in making referrals on your behalf.

Personal and Social Data

4.6 You may optionally provide personal and social information including:

• biography;
• personal interests;
• approach style;
• birthday;
• preferred drink order; and
• dietary preferences.

4.7 Dietary preferences may constitute sensitive information. See section 12 for how we handle sensitive information.

Connection and Relationship Data

4.8 When you use the Platform to connect with other users, we collect information about:

• connections made with other users;
• connection tier and status;
• how and where you met;
• preferred contact cadence;
• interaction history;
• private insights and notes about connections; and
• contact information for non-users added as connections (see section 11).

4.9 Private insights and notes you record about connections are visible only to you and are not shared with the connection or other users.

Lead and Introduction Data

4.10 When you record introductions or leads on the Platform, we collect:

• lead title and description;
• estimated value;
• contact name, email and phone number of the introduced party;
• lead status, conversion data and outcome;
• attestation data, including mutual confirmation flags and client attestation tokens and responses; and
• contextual notes about the introduction.

4.10A Where you opt in to share a past introduction with the Socii member who was a party to it, a copy of the introduction record (including your name and the introduction details) is made available to that member, who may confirm or dispute the recorded outcome. Confirmed and disputed outcomes are reflected in trust score calculations (see section 6.2).

Agreement Data

4.11 When you create or manage agreements on the Platform, we collect:

• commission type and fee structure;
• billing company details;
• agreement status and history; and
• an audit trail of agreement actions (creation, acceptance, signing, amendment, expiry), including the date and time, the IP address and browser used, and a secure hash (a digital check value) of the exact document signed.

Firm Seats

4.11A Where a firm holds member seats, we keep a permanent record of who held each seat and when. The firm's administrators can see, for each seat, who held it and how many confirmed deals were completed while each person held it. This record is part of the firm's records. It stays after you leave the firm or the club, and it is not removed when your account is closed (see section 13.2A).

Behavioural and Usage Data

4.12 When you use the Platform, we automatically collect:

• pages viewed and features accessed;
• clicks and interactions;
• time spent on features;
• feature affinity scores (computed from usage patterns); and
• login history and timestamps.

4.13 Behavioural data is retained for 90 days on a rolling basis and is used for adaptive interface personalisation (see section 6.7).

Visitor Tracking Data

4.14 When you visit the Platform without logging in, we may collect:

• HMAC-signed visitor tokens (included in email links so that we can recognise you when you return from one of our emails);
• UTM parameters and referral source data; and
• IP-derived information (approximate country and region; the IP address itself is not stored in the visitor profile).

4.14A We do not set a visitor identification cookie and we do not create a browser fingerprint.

4.15 Email visitor tokens expire after 30 days. If you later register an account or sign in, your visitor profile may be linked to your account so that we can attribute your sign-up source and personalise your experience.

A/B Testing Data

4.16 We conduct A/B tests on marketing and interface copy. When you are exposed to an A/B test, we collect:

• the variant shown to you;
• the timestamp of the impression; and
• whether you completed a conversion action (recorded only if you have accepted optional cookies).

4.17 A/B test impressions are not linked to your identity. If you accept optional cookies, then during sign-up a cookie records which version of the sign-up steps you were shown (see section 15.2), and that version may be recorded with your account if you register. If you do not, you are shown the standard sign-up steps and no version is recorded.

Events Data

4.18 When you interact with events on the Platform, we collect:

• event details (title, description, date, location, type);
• RSVP status and responses;
• dietary notes provided for events;
• invitee information (including email addresses of non-users invited to events);
• where you reply to a save the date invitation: the name, email address and phone number you give us, your postal address, and your company and role if you choose to provide them. We collect your postal address so that we can send you correspondence about the event by post, and your phone number so that we can contact you about the event. Neither is shown to other guests;
• where you accept an event with a private guest room: once the event begins, other accepted guests can see your name, company, short bio, who you hope to meet and your photo. You can choose not to appear in the guest room. Your email address and dietary notes are never shown to other guests;
• the brief we give the venue hosting an event you have accepted (see section 9.1); and
• for events with paid seats, whether your seat payment has been received. Seat payments are processed by Stripe through a payment link; we do not receive or store your card details.

Financial and Billing Data

4.19 When you subscribe to a membership, pay an introduction fee or buy a paid event seat, we collect:

• your Stripe customer identifier (which Stripe links to your name and email address);
• your billing plan and subscription status;
• billing company name and details;
• the introductions an introduction fee relates to, and the invoice for each; and
• payment failure information.

4.20 We do not store your credit card number or full payment details. Payment processing is handled by Stripe, Inc. and is subject to Stripe's privacy policy.

Communications

4.21 We collect information contained in support requests, feedback, community board posts and other communications you send to us or post on the Platform.

Session and Device Data

4.22 When you access the Platform, we automatically collect:

• IP address;
• user agent (browser and device information);
• session token and authentication timestamps; and
• administrative audit log entries, including records of any administrator access to an account for support or investigation purposes (such access is flagged in the session and auditable).

Direct Messaging Data

4.23 When you send or receive direct messages on the Platform, we collect:

• the content of your messages;
• thread metadata, including participants, timestamps, last-read indicators and mute or archive flags;
• delivery and read status; and
• contextual references to any lead or agreement linked to the thread.

4.24 Direct messaging is trust-gated. You can only message another User if you share an active connection with that User.

Push Notification Subscriptions

4.25 If you opt in to receive web or mobile push notifications from the Platform, your browser or device sends us a push subscription endpoint together with cryptographic keys (the p256dh and auth keys defined by the Web Push Protocol). We store these against your account and use them solely to deliver Platform notifications via your browser or device vendor's push service (such as Apple, Google, Microsoft or Mozilla).

4.26 We track the delivery success or failure of push messages so that we can remove subscriptions that are no longer valid. You may revoke push notifications at any time through your browser or device settings, or through your Platform notification preferences.

Two-Factor Authentication Data

4.27 If you enable two-factor authentication on your account, we store:

• a TOTP secret used to verify codes generated by your authenticator application; and
• a set of single-use backup codes, stored encrypted for use in account recovery.

4.28 We do not store the time-based codes themselves. We verify codes only at the moment of sign-in.

Delegate and Managed Account Data

4.28A You may authorise another person (a delegate) to access and act on your account. If you do, we record the delegation (including the delegate's identity and the date of authorisation) and we log every action the delegate takes while acting as you, including the identity of the acting delegate, so that account activity can always be attributed to the person who performed it.

4.28B A delegate can see the account data reasonably necessary to act on your behalf. You may revoke a delegation at any time through your account settings; audit records of past delegate actions are retained.

Affiliate and Partner Commission Program Data

4.29 When you apply to or participate in the public affiliate program or the Black Book partner commission program, we collect:

• application data you provide, including why you wish to join, a size bucket for your network, social media URLs you choose to share and the channels you propose to use to share Socii;
• the application status (pending, approved, rejected or revoked), the source of the application (public application or Black Book partner invitation), the date you applied, the identity of the administrator who reviewed your application and any reason recorded for a rejection or revocation;
• commission ledger entries generated automatically when an end-user you referred pays an invoice, including the amount, currency, invoice period, status (clawback pending, eligible, voided or paid), the source Stripe invoice identifier and the date the entry becomes payable;
• payout batch records showing when commissions were aggregated and paid; and
• milestone bonus records where you have earned an additional bonus under the Black Book partner program.

4.30 Commission ledger entries are generated by Stripe webhooks when a referred user pays an invoice. Refunds, chargebacks or subscription cancellations within 90 days of the original payment will void the corresponding ledger entry. Eligible entries are aggregated into a quarterly payout batch issued on the first day of January, April, July and October.

Newsletter Consent Records

4.31 If you opt in to receive Socii newsletters or other marketing communications, we record:

• the boolean recording your consent;
• the exact text of the consent statement that was displayed to you at the time; and
• the timestamp of the consent.

4.32 We retain this audit record so that we can demonstrate the basis on which we sent you marketing communications, in accordance with the Spam Act 2003 (Cth).

Sensitive Information

4.33 We collect the following categories of information that may constitute sensitive information under the Privacy Act:

• dietary preferences (which may reveal information about religious beliefs or health conditions); and
• professional conduct rules and applicable legislation (which may identify membership of a professional association).

4.34 We do not intentionally collect other categories of sensitive information. If you voluntarily include sensitive information in free-text fields (such as notes, descriptions, direct messages or community posts), you consent to our collection and handling of that information in accordance with this Privacy Policy.

5. How We Collect Information

5.1 We collect personal information:

• directly from you, when you register for an account, create or update your business profile, complete your referral kit, record introductions, create or manage agreements, RSVP to events, post on the community board, or communicate with us;
• from other users of the Platform, when they record an introduction involving you or a third party, add you as a connection, or invite you to an event;
• from third parties whose information is submitted to the Platform (for example, a client who provides an attestation in respect of a lead);
• automatically, through cookies, visitor tracking technologies, behavioural tracking, analytics tools and server logs when you access the Platform; and
• from third-party services we integrate with, including Stripe (payment processing and commission webhooks that record referred-user invoice events for the affiliate and partner commission program), Google (authentication), LinkedIn (authentication and, where you sign in with LinkedIn, your name, email address and photo), HubSpot (CRM mirror, when you choose to connect a HubSpot portal), Google's Gmail API and Microsoft Outlook (only the single email you choose to log with our add-ins, see section 6.9.4) and the push messaging services operated by your browser or device vendor (Apple, Google, Microsoft or Mozilla); and
• from visitors to our public marketing pages (including the referral fee, network ROI and commission split calculators under www.sociiclub.com/tools) where the visitor provides their contact details to receive a follow-up.

6. Purposes of Collection and Use

6.1 We collect and use personal information for the following purposes:

• to provide and operate the Platform;
• to create and manage user accounts;
• to authenticate sign-in attempts, including verification of two-factor authentication codes and backup codes;
• to enable connections between users;
• to record and track introductions and leads;
• to store and manage referral agreements;
• to facilitate counter-proposals, agreement template reuse and bulk agreement invitations between users;
• to facilitate referral kit sharing between connections;
• to enable trust-gated direct messaging between users and to deliver in-product, email and push notifications about new messages and other Platform activity;
• to organise and manage events and RSVPs;
• to operate the community board;
• to process subscriptions and billing;
• to administer the public affiliate program and the Black Book partner commission program, including reviewing applications, attributing referred sign-ups to a partner, recording commissions earned from invoices paid by referred users, applying the 90-day clawback window for refunds and cancellations, and issuing quarterly payouts (see section 6.15);
• to capture, store and follow up on submissions made through our public calculator tools and lead capture forms (see section 11.7);
• to compute trust scores and assign trust tiers (see section 6.2);
• to determine eligibility for Verified Dealmaker badges (see section 6.5);
• to personalise the interface based on usage patterns (see section 6.7);
• to provide AI-assisted features (see section 6.8);
• to conduct A/B testing on marketing and interface copy (see section 6.11);
• to recognise returning visitors and personalise marketing content;
• to send automated communications (see section 6.12);
• to communicate with you about your account, the Platform and our services;
• to send you marketing communications in accordance with section 7;
• to improve the Platform and develop new features;
• to comply with our legal obligations;
• to enforce our terms of use; and
• for security purposes and to prevent fraud.

Automated Decision-Making (Trust Score, Trust Tier and Verified Dealmaker)

6.2 The Platform computes a trust score (0 to 100) for each user from the following kinds of information:

• vouches received from other users, counted only once a confirmed deal between you and that user backs the vouch;
• lead conversion: how often introductions you receive convert;
• fee reliability: whether fees recorded as owing are confirmed as settled;
• introduction quality and outcomes, including client attestations;
• reciprocity: whether your referral relationships run both ways;
• your recent activity on the Platform;
• verified history: the number of quarters in which you have a verified record of completed deals; and
• nominations you receive, any Patron recognition for confirmed charity introductions, and disputes recorded against you.

6.3 Trust scores are used to assign users to trust tiers: New (a score under 40), Rising (40 to 69), Proven (70 or more) and Established (Proven, plus at least 12 active quarters of verified deal history). You can see your own score. Other members only ever see your tier, never your score. The score or tier affects:

• the order of the Trusted Partners directory;
• the order of Lounge posts and partner news;
• the order in which guests appear in an event guest room;
• how you are ranked when the Platform suggests referral candidates, dormant connections or deal flow briefings to other members; and
• the trust tier badge other members see on your profile.

6.4 Trust scores are computed algorithmically without human review. You may contact us to request an explanation of your trust tier or to raise a concern about its accuracy, and we will review it and correct any error (see clause 6.8 of our Terms of Use).

6.4A Decisions we make using computer programs

We use computer programs to make, and to do things substantially and directly related to making, decisions about members. Some of those decisions could reasonably be expected to significantly affect your rights or interests, because they affect how visible you are to other members. This section sets out what those programs use and what they decide.

The categories of personal information used. The programs described below use: your profile information, including the services, industries and locations you cover; your connection records, including whether the relationship is reciprocal; your lead and introduction records, including volume, status, recorded outcomes and conversion; your agreement and fee records, including whether fees are confirmed as settled; vouches other members have given you, the qualities they were given for and the deals that back them; client attestation responses; disputes recorded against you; your Lounge activity; your verified deal history by quarter; your billing plan; and your nomination records. Referral suggestions may also use engagement counts from your linked LinkedIn profile (messages, comments and reactions) and its location.

Decisions made solely by a computer program, with no human involvement. These are: the calculation of your trust score; your assignment to a trust tier (New, Rising, Proven or Established); the award or removal of the Verified Dealmaker badge, which is assessed daily; your position in the Trusted Partners directory; the order of your posts in the Lounge and partner news; your position in an event guest room; which trust tier badge other members see on your profile; whether you have met the nomination threshold for Trusted Partners; and which interface layout and content ordering you are shown.

Decisions a computer program substantially and directly contributes to, where a person also has a role. These are: whether your application for the Trusted Partners directory is approved, where meeting the automated nomination threshold produces a pending status that we then review; whether your application to the affiliate or Black Book partner programme is approved or revoked; whether your account is flagged for review, including by automated financial-crime monitoring alerts, where a person then decides what, if anything, to do; the selection of Deal Flow Briefings, where content is ranked automatically; and whether you are suggested to another member as a referral candidate or a connection to re-engage, where the other member decides whether to act on the suggestion. We do not use trust scores to decide who is invited to an event.

6.4B If a decision described above affects you and you disagree with it, you may contact us using the details in section 21. We will tell you the general basis on which the decision was made, review it, and correct it if we find an error. We will not charge you for this. Nothing in this section limits your right to complain to us or to the Office of the Australian Information Commissioner under section 20.

Verified Dealmaker Badge

6.5 The Platform awards a Verified Dealmaker badge to approved Black Book members who meet the following criteria:

• 10 or more converted leads received;
• 5 or more backed vouches received across at least 3 distinct qualities; and
• at least 4 active quarters of verified deal history.

6.6 Verified Dealmaker status is assessed daily by an automated process and is shown to other members on your profile.

6.6A Every vouch given and every vouch withdrawn is kept in our permanent audit record (see section 13.2A), even after the vouch is withdrawn.

Adaptive Interface Personalisation

6.7 The Platform uses behavioural data (see section 4.12) to personalise the user interface, including reordering navigation items and dashboard widgets based on your usage patterns. This personalisation is computed from your own activity data and does not involve profiling against other users. You may contact us if you wish to reset your personalisation data.

AI-Assisted Features

6.8 The Platform uses an AI language model for three things only:

• Quick-Fill suggestions for your profile, referral kit and company details (see 6.9.1);
• introduction capture, when you send us an email, screenshot or message to log an introduction (see 6.9.3 and 6.9.4); and
• a plain-English summary of a referral arrangement for the client being introduced (see 6.9.1A).

Referral matching suggestions, suggested introductions, network health alerts, deal flow briefings and network value figures are produced by rules we set, not by an AI model.

6.9 The AI features above use language models provided by Anthropic, PBC. Only the information described in 6.9.1 to 6.9.4 is sent to Anthropic's API for processing. Anthropic's data handling practices are described in Anthropic's privacy policy.

6.9.1 Specifically, the following profile fields may be sent to Anthropic when you use Quick-Fill enrichment: your LinkedIn URL, full name, current company, current role, the additional context you type into the Quick-Fill prompt, and any existing values for your headline, bio, expertise, location, approach style, referral philosophy, and connect-with statement. For company enrichment, we additionally send the company name, website, and your role at that company. We do not send connection lists, lead notes, vouch text, or message contents to Anthropic, except as described in 6.9.1A to 6.9.4.

6.9.1A When an introduction includes a disclosure to the client of a referral fee, we may send Anthropic the names of the referring and receiving parties, the commission terms, and the industry and jurisdiction (if recorded), to draft a one-paragraph plain-English summary for the client. The formal disclosure is always included as well, whether or not a summary is drafted.

6.9.2 Separately from the built-in AI-assisted features, you may choose to connect a third-party AI assistant (such as Anthropic's Claude) to your account through an authorisation (OAuth consent) screen. Once connected, that assistant can read and act on your account data - including your profile, connections, leads, agreements, messages and settings - when you instruct it to, through our tool interface. Data the assistant retrieves is processed by the assistant's provider under that provider's own terms and privacy policy, not ours. Actions taken by a connected assistant are logged against your account. You can revoke a connected assistant's access at any time through your account settings.

6.9.3 If you choose to send an email to your private Socii log address (for example by adding it as BCC on an introduction, or by forwarding an introduction to it), we receive that one email and send its text and headers to Anthropic to identify who introduced whom. The same applies if you upload a screenshot of a conversation, or paste the text of a message, into the Intro inbox (including by sharing it to Socii from your phone's share menu), or email a screenshot to your log address: we send that screenshot or text to Anthropic for the same purpose, and the same applies to an email you log with our Outlook or Gmail add-in (see 6.9.4). These are the only cases in which message contents are sent to Anthropic, and only for what you choose to give us - we never read the rest of your inbox or any messaging app. The result is kept as a draft and nothing is added to your records until you confirm it. We never store screenshots: we read each one once and delete it straight away (a screenshot you email to us also passes through our email provider, like any email you send us). Screenshots can show other conversations, phone numbers and people; we instruct the AI to ignore anything that is not part of the introduction, and we keep none of it. We keep the text of an email or pasted message only until you confirm or dismiss the draft, and never longer than 30 days; after that we keep only the introduction details (names, companies, date and a one-line summary).

6.9.4 If you install the Socii Club add-in for Microsoft Outlook or the Socii Club add-on for Gmail, the add-in reads nothing when you open it or open an email. Only when you tap "Log this intro" does it read the one email you have open (its sender, recipients, subject, date and text) and send it to us, where it is handled exactly as in 6.9.3: sent to Anthropic to identify who introduced whom, saved as a draft you must confirm, and its text kept only until you confirm or dismiss the draft and never longer than 30 days. The add-ins cannot read any other email, your contacts or your calendar, and never send, change or delete email. To keep you signed in, the Outlook add-in stores your Socii sign-in in the add-in on your device; for Gmail we store your Socii sign-in (encrypted) together with an identifier for your Google account, and delete them when you sign out of Socii in the add-on, or the next time you use it after your sign-in has been revoked or has expired. For Gmail, we receive the email from Google's Gmail API using access you grant to the add-on. Socii's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use information received from Google only to create the introduction draft you asked for; we do not use it for advertising, do not sell it, and do not use it to train AI models, and no person at Socii reads it unless you ask us to for support, it is needed for security or to comply with the law. More detail is on our add-ins help page.

6.10 AI-generated outputs (such as draft messages or suggestions) are not sent, shared or acted upon without your review and approval.

A/B Testing

6.11 We conduct A/B tests using a statistical method (Thompson Sampling) to optimise marketing and interface copy. Variants are assigned at random and do not use personal information from your user account.

Automated Communications

6.12 The Platform sends automated communications including:

• agreement renewal reminders;
• follow-up reminders for leads and introductions;
• event RSVP reminders;
• post-event follow-up nudges;
• referral qualification notifications;
• network health alerts;
• deal flow briefings;
• weekly activity digests;
• client attestation requests;
• nomination notifications; and
• subscription and billing notifications.

6.13 You can unsubscribe from our non-essential email at any time using the link in any such email. That stops all of it, including notifications about introductions and Platform activity. We will still send emails we must send to run your account or that you have asked for: sign-in and security emails, payment and failed-payment notices, membership renewal reminders, emails about agreements you are a party to, confirmations of deletion or data-export requests, and any reminder you set yourself. After your account is closed, we send only password-reset, deletion, data-export and failed-payment emails.

6.14 Marketing communications can be unsubscribed from at any time (see section 7).

Affiliate and Partner Commission Program

6.15 The Platform operates two referral commission programs: a public affiliate program (15% of paid invoices for 12 paid months) and a private Black Book partner commission program (25% of paid invoices for 12 paid months, plus milestone bonuses). Both programs are gated by an apply-to-join application that an administrator reviews before approval.

6.16 Commission ledger entries are generated automatically when a Stripe webhook tells us that a user you referred has paid an invoice. Each entry remains in a 90-day clawback-pending state before becoming eligible for payout, so that we can void it if the underlying payment is refunded, charged back or the subscription is cancelled inside the clawback window. Eligible entries are aggregated into quarterly payout batches issued on the first day of January, April, July and October.

6.17 We use your contact details and bank or payout details (if you provide them) solely to administer the program, calculate your earnings, send program-related notifications and remit payouts. Payouts are made by bank transfer.

6.18 Where your referral code is shared with a prospective User, we record an attribution link between that referral code and the resulting account so we can credit you with future commissions.

7. Direct Marketing

7.1 We may use your personal information to send you marketing communications about our products, services, events and promotions that may be of interest to you.

7.2 You may opt out of receiving marketing communications from us at any time by:

• clicking the unsubscribe link in any marketing email you receive from us;
• updating your communication preferences in your account settings; or
• contacting us using the details set out in section 21.

7.3 If you opt out of receiving marketing communications, we will still send the essential emails described in section 6.13.

7.4 We do not sell your personal information to third parties for their marketing purposes.

8. Unsolicited Personal Information

8.1 From time to time, we may receive personal information that we have not requested or solicited. This may occur, for example, when a user records an introduction that contains personal information about a third party, or when a user adds a non-user as a connection.

8.2 Where we receive unsolicited personal information, we will determine whether we could have collected the information under the APPs. If so, we will handle that information in accordance with this Privacy Policy. If not, we will destroy or de-identify the information (provided it is lawful and reasonable to do so).

9. Disclosure of Information

9.1 We may disclose your personal information to:

• other users of the Platform, to the extent that your profile information, referral kit, trust tier and badges are visible to your connections, and lead details are visible to relevant partners, in accordance with the Platform functionality;
• a delegate you have authorised to access and act on your account, to the extent needed to act on your behalf (see section 4.28A);
• a third-party AI assistant you have connected to your account, when you instruct it to access your data (see section 6.9.2);
• our service providers, including hosting providers, payment processors, AI service providers and email delivery services, under appropriate contractual arrangements;
• the venue hosting an event you have accepted, which is an outside business. It receives your name, company, short bio, photo, who you hope to meet, whether your seat is paid, and any dietary or allergy notes you give in your reply (if you are a member, we fill the reply in from your profile for you to check first, and send only what you submit), so it can seat and cater for you;
• our professional advisers, including lawyers and accountants, who are bound by confidentiality obligations;
• regulatory authorities or law enforcement agencies, where required or authorised by law or in response to a court order or lawful government request;
• a third party in connection with a business transfer, if we sell, merge or transfer any part of our business;
• third parties who provide attestations in respect of leads, to the extent necessary to facilitate the attestation process; and
• any other party where you have consented to such disclosure.

9.2 Lead contact details are not shared beyond the relevant partner relationship on the Platform, except where you opt in to share a past introduction with the Socii member who was a party to it (see section 4.10A).

9.3 Private notes and insights you record about connections are not disclosed to those connections or to other users.

9.3A We do not sell, rent or trade personal information. We do not show other members the people in your contacts who are not members, or the people in a LinkedIn list you upload, except where you choose to share someone yourself (for example, when you introduce them) and the limited statement described in 11.8A.

9.4 Community board posts are visible to all registered users of the Platform in accordance with the applicable visibility settings.

9.5 Your participation mode - the reward setting you declare for your personal profile and for each company you act for (for example, open exchange, pays for introductions, or favours only) - is shown as a short label to other members on your profile and in the introduction and agreement screens where they choose you, so they know whether introduction fees can apply before they deal with you. The label shows the mode only; it does not reveal your fee amounts or the reasons behind your choice.

10. Cross-Border Disclosure

10.1 We use service providers that are located in, or store data in, countries outside Australia. As at the date of this Privacy Policy, these include:

• Stripe, Inc. (membership, introduction fee and event seat payment processing) - United States;
• Resend, Inc. (email delivery) - United States;
• Google LLC (authentication, and the Gmail API, only for the single email you choose to log with our Gmail add-on) - United States;
• Microsoft Corporation (the Outlook add-in, which runs inside Outlook and loads Microsoft's Office add-in library, and push notifications, see below) - United States;
• LinkedIn Corporation (authentication) - United States;
• Sentry (error monitoring) - United States;
• Inngest, Inc. (workflow automation) - United States;
• Replit, Inc. (application hosting and file storage for profile photos, agreement attachments, referral kits and other user-uploaded documents) - United States;
• Anthropic, PBC (AI language model services) - United States; and
• HubSpot, Inc. (CRM mirror, only for users who connect a HubSpot portal) - United States. When you connect HubSpot, we send: deal name, deal status, deal close date, deal amount, a short context summary (truncated to 280 characters), referrer name, the commission terms, contact first/last name, contact email, contact phone, contact job title, the contact's connection tier, the count of vouches received and, on the Socii card shown inside HubSpot, the referrer's trust tier (never the trust score). We do not send: the full body of introduction emails you write, your private memos beyond the truncated context summary, or any data about connections you have not explicitly synced; and
• browser and device push messaging services operated by Apple Inc. (Apple Push Notification service), Google LLC (Firebase Cloud Messaging), Microsoft Corporation (Windows Push Notification Services) and Mozilla Corporation (Firefox push), only for users who opt in to push notifications - United States. We send to these services only the encrypted notification payload and the push subscription endpoint your browser or device gave us; we do not send your account information.

10.2 Where we disclose your personal information to overseas recipients, we take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to your personal information, or that an exception under the APPs applies.

10.3 By using the Platform, you acknowledge that your personal information may be transferred to, stored in, and processed in the United States and other countries where our service providers operate.

11. Data Collected From and About Non-Users

11.1 The Platform allows registered users to submit personal information about individuals who are not registered users of the Platform (non-users). This section describes the circumstances in which non-user data is collected and how it is handled.

Client Attestation

11.2 A registered user may request that a client (who may be a non-user) provide an attestation confirming the outcome of a referral. When this occurs, the client receives an email containing a unique attestation link. The client's response (confirmation or decline) is recorded on the Platform.

11.3 The attestation email identifies the referring user and the nature of the referral. The client's email address and response are stored for the purpose of verifying the referral outcome.

Event Invitations

11.4 A registered user may invite non-users to events by providing their email address. Non-users who are invited to events will receive an invitation email. Their name, email address, any phone number and RSVP response (if any) are stored on the Platform.

Lead and Introduction Contact Details

11.5 When a registered user records a lead or introduction, they may provide the contact name, email address and phone number of the introduced party, who may be a non-user. This information is stored on the Platform and is visible only to the parties to the relevant referral relationship.

Partner Applications

11.6 Individuals who apply to become a Trusted Partner submit their name, email address, firm name and firm type, their monthly referral volume, a revenue range and their goals. Our team reviews the application and may record internal review notes. We keep an application, including our review notes, for 7 years after the applicant's account is closed (or, if it was never linked to an account, 7 years after it was made), as a business record, and then delete it.

Calculator Tools and Lead Capture

11.7 Visitors who use any of our public calculator tools at www.sociiclub.com/tools (including the referral fee calculator, the network ROI calculator and the commission split calculator) or submit a referral audit or affiliate ROI estimate may provide:

• their name and email address;
• their LinkedIn URL, company name, profession and country (each optional);
• the inputs they entered into the calculator and the result that was displayed back to them; and
• an explicit, opt-in (not pre-ticked) consent to receive the Socii newsletter, together with the exact wording of the consent statement they were shown.

11.7A This information is stored for the purpose of responding to the enquiry, sending the requested follow-up content, reviewing the lead for membership eligibility and (where the visitor has opted in) sending marketing communications subject to section 7.

Affiliate Referral Attribution

11.7B Where a non-user signs up to the Platform via an affiliate referral link, we record the referral code, the timestamp of the click, basic browser metadata and the resulting user identifier once the visitor registers, so that we can attribute future paid invoices to the referring partner.

Connection Records About Non-Users

11.8 A registered user may add a non-user as a connection, providing their name, email, phone number and notes. This information is visible only to the user who added it, except as set out in 11.8A. If the non-user subsequently registers on the Platform, the connection record may be linked to their account.

11.8A Finding a path to a company. When a member asks who could introduce them to a company, we check their own contacts and the contacts of members they are already connected to. For another member's contacts, we tell the member asking only that this connected member knows "someone at that company". We never tell them who that person is, whether a person they named is among them, their contact details, anything written about them, or how many people the other member knows.

Uploaded LinkedIn Lists

11.9 A member may download their own list of LinkedIn connections from LinkedIn and upload it to the Platform, so we can sort and rank their network for them. They may also add the message, comment and reaction files from the same LinkedIn download. We do not connect to LinkedIn to collect any of this, we do not use any LinkedIn interface other than sign-in, and we do not collect information from LinkedIn's website. The file is read in the member's browser. From it we may use, for each person in the list:

• their name, company, job title, LinkedIn profile link and the date the member connected with them;
• if the member adds the message, comment or reaction files: how many messages and comments the member has exchanged with them, and whether their messages mention well-known business groups (we do not keep the text of any message or comment); and
• their email address, only where LinkedIn includes it, and only to send an invitation to the people the member chooses to invite and to match the list to people already in the member's contacts.

11.9A If the member saves the result as a report, we keep it for that member alone, without anyone's email address or phone number. For people already in the member's contacts, we add their current role, company, an approximate location and how often the member is in touch with them to that contact record, which stays private to the member as set out in 11.8. We never contact the people in a member's list. Only the people the member chooses to invite receive an invitation.

11.10 If you are in a member's contacts. If you are not a member and a member has added or uploaded your details, you may ask us at privacy@sociiclub.com what we hold about you and to correct it (see section 14).

12. Sensitive Information

12.1 We collect the following categories of information that may constitute sensitive information under the Privacy Act:

• dietary preferences (which may reveal information about religious beliefs or health conditions); and
• professional conduct rules and applicable legislation (which may identify membership of a professional association).

12.2 We collect dietary preferences and allergies for the purpose of catering at events. We give the venue hosting an event you have accepted only the dietary and allergy notes you submit in your reply to that event (see section 9.1); we do not send it the dietary preferences saved on your profile. We collect professional conduct information for the purpose of agreement compliance. We do not use this information for any other purpose.

12.3 By providing sensitive information to us, you consent to our collection, use and disclosure of that information in accordance with this Privacy Policy.

12.4 If you do not wish to provide sensitive information, you may leave the relevant fields blank. This may limit certain functionality (for example, dietary preferences will not be communicated to the event venue).

13. Data Retention

13.1 We retain your personal information for as long as your account is active or as needed to provide you with the Platform and our services.

13.2 When you ask us to close your account, a 30-day grace period starts. During it, you can change your mind by contacting us at privacy@sociiclub.com. After the grace period we remove your name, email address, phone number, profile, photos, uploaded documents, sign-in details and connected-service tokens, and your account can no longer be linked to you by name. We keep, for 7 years after closure, to resolve disputes, enforce agreements and meet our legal obligations: agreements, introductions and fee records; vouches you gave or received; introductions you captured; the contacts and private notes you added about other people; and our audit records (see 13.2A). The records of firms you belonged to belong to the firm and are not removed. If you are subject to an anti-money-laundering record-keeping hold, some steps may wait until that hold ends.

13.2A Permanent records. Agreements, introductions, fee confirmations, vouches, firm seat history and our audit log are kept on a permanent, tamper-evident record. Entries are added but never edited or deleted, so that members can rely on them as evidence of what was agreed and done. These records may include your name, the date and time of an action, and technical details such as the IP address used. We keep them for at least 7 years after your account closes, and then delete or de-identify the personal information in them.

13.3 The exception is records we are required by law to keep in identified form, such as financial and tax records. These are retained for the periods the law requires, even after account closure.

13.4 Specific data types are subject to the following retention periods:

• behavioural and usage data: 90 days on a rolling basis;
• cookies: as set out in section 15.2;
• email visitor tokens: 30 days;
• the text of emails sent to your private log address, and of messages pasted into the Intro inbox: until you confirm or dismiss the introduction, and no longer than 30 days;
• the text of emails logged with the Outlook or Gmail add-in: until you confirm or dismiss the introduction, and no longer than 30 days;
• Gmail add-on sign-in (encrypted) and Google account identifier: until you sign out of Socii in the add-on, or the next time you use it after your sign-in has been revoked or has expired;
• screenshots of introductions: not stored - deleted as soon as they have been read;
• A/B test impression data: 90 days after the test version is retired or adopted;
• session tokens: duration of the active session;
• administrative audit logs: 7 years;
• agreement documents and audit trails: 7 years following account closure;
• lead and introduction records: 7 years following account closure;
• direct messages and thread metadata: retained while either participant maintains an active account, and thereafter for the period set out in section 13.2;
• push notification subscription endpoints: until the subscription is revoked by you or invalidated by the browser or device vendor;
• two-factor authentication secrets and backup codes: until you disable two-factor authentication or close your account;
• Trusted Partner applications: 7 years after the applicant's account closes (see section 11.6);
• our email suppression list (the addresses that have unsubscribed, with the date): for as long as we send email, so that we keep honouring your unsubscribe;
• event invitations to people who are not members (name, email, phone and reply): deleted 24 months after the event, unless you have since become a member;
• firm seat history: permanently, as part of the firm's records (see section 4.11A);
• affiliate and partner commission ledger entries, payout batch records and milestone bonus records: 7 years (financial records);
• saved LinkedIn reports (see 11.9A): the newest 3 for each member, never more than 18 months after upload, and all of them deleted when the member's account closes;
• calculator and lead capture submissions: until you ask us to delete them, or 24 months from the date of submission if you have not converted to a registered account; and
• signed GDPR data export tokens: 24 hours from issue or until first use, whichever is sooner.

13.5 Non-user data (see section 11) is retained for as long as the registered user who submitted it maintains an active account, and thereafter for 7 years as set out in section 13.2, unless a shorter period above applies.

13.6 You may request deletion of your data by contacting us using the details set out in section 21. Deletion requests are subject to our legal retention obligations.

14. Access and Correction

14.1 You may access and update certain personal information we hold about you through your account settings on the Platform. You can also download a copy of your personal information from your settings. The download includes your full profile, your firms, your sign-in history (time, IP address, browser and method), your event replies, your applications, vouches you gave and received, introductions you sent, your agreements and your fee records. Your connections are shown as a count, because they contain other people's details. For anything else we hold about you, write to us using the details in section 21.

14.2 You may request access to any personal information we hold about you by contacting us using the details set out in section 21.

14.3 We will respond to your request within 30 days. We may require verification of your identity before providing access to your personal information.

14.4 You will not be charged for making an access request, but we may charge a reasonable fee for the time and expense of providing access if your request requires substantial effort.

14.4A Where we provide a copy of your personal information by email, we will send a single-use signed download link rather than attaching the full data export. The link expires 24 hours after issue or on first use, whichever is sooner. The token is stored on our servers as a SHA-256 hash so that the original link cannot be reconstructed from our database.

14.5 If you believe that personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may request that we correct that information. We will take reasonable steps to correct the information upon receiving such a request.

14.5A If information in our permanent record (see section 13.2A) is wrong, we will not change the original entry. Instead we will add a correcting entry and show the corrected information wherever the record is displayed. If we do not agree that a correction is needed, you may ask us to attach a statement to the record, and we will.

14.6 We may refuse a request for access or correction in circumstances permitted by the APPs. If we refuse a request, we will provide you with written reasons for the refusal.

15. Cookies and Tracking Technologies

15.1 The Platform uses cookies and similar technologies. A cookie is a small file stored on your device that assists in managing customised settings and delivering content.

15.2 We use the following cookies:

Strictly necessary cookies. These are set regardless of your cookie choice, because the Platform, or the thing you asked us to do, cannot work without them:

• your sign-in session (lasts 30 days and renews while you use the Platform);
• the two-step sign-in challenge (10 minutes) and, if you choose to trust a device, a trusted-device cookie (30 days);
• sign-up cookies (30 days), which carry the application you are filling in from page to page: they can hold your name, LinkedIn URL, company, application note, requested membership, and any invitation or referral code you arrived with;
• a club key cookie (30 days), which opens member-only pages from a key you were given;
• a security cookie used while you connect HubSpot (5 minutes); and
• a sidebar preference cookie (7 days), which remembers whether the menu is open.

Your cookie choice itself is kept in your browser's local storage, not in a cookie.

Optional measurement. If you accept optional cookies, we record whether you completed an action after seeing a version of our marketing copy (see sections 4.16 and 6.11), and during sign-up we may show you one of two versions of the sign-up steps and keep a cookie (30 days) recording which one (see section 4.17). We do not set a visitor identification cookie and we do not create a browser fingerprint.

15.2A If you reject non-essential cookies, we do not record your activity against a copy-testing variant and we do not enrol you in A/B measurement. If you have not answered the banner yet, we treat that the same way as a rejection. You can change your choice at any time from the Cookie preferences link in the footer.

15.3 We do not use advertising cookies or third-party analytics or tracking cookies. Usage measurement is performed first-party by the Platform itself (see sections 4.12 and 4.14) and is not shared with advertising or analytics networks. Our typefaces are served from our own servers, so loading a page does not send your IP address to a font provider.

15.4 You can manage your cookie preferences through your browser settings. However, disabling cookies may affect the functionality of the Platform, including the ability to log in.

15.5 The Platform displays a cookie consent notice to first-time visitors with the option to accept all cookies or reject non-essential cookies. Essential cookies are set regardless of consent as they are necessary for the Platform to function.

15.6 If you have a question about any cookie used by the Platform, please contact us using the details in section 21.

16. Security

16.1 We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

16.2 Our security measures include:

• encryption of data in transit and at rest;
• access controls to limit access to personal information to authorised personnel; and
• regular security reviews.

16.3 However, no data transmission over the internet or data storage system can be guaranteed to be completely secure. We cannot guarantee the absolute security of your personal information.

16.4 You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

17. Data Breaches

17.1 We have procedures in place to respond to suspected or actual data breaches.

17.2 If we experience a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

• take reasonable steps to contain the breach and mitigate any resulting harm;
• assess the breach to determine whether it is an eligible data breach under the Privacy Act;
• if the breach is an eligible data breach, notify the Office of the Australian Information Commissioner and affected individuals as required under Part IIIC of the Privacy Act; and
• take steps to prevent future breaches.

18. Third-Party Links and Children's Privacy

Third-Party Links

18.1 The Platform may contain links to third-party websites, applications or services.

18.2 We are not responsible for the privacy practices of any third party. We encourage you to review the privacy policies of any third-party websites you visit.

Children's Privacy

18.3 The Platform is not intended for persons under the age of 18.

18.4 We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information.

19. Changes to This Privacy Policy

19.1 We may update this Privacy Policy from time to time.

19.2 We will notify you of any material changes by email or through a notice on the Platform.

19.3 We will tell you about a material change before it takes effect. Where a change needs your consent, we will ask for it.

19.4 The date of the most recent update is displayed at the top of this Privacy Policy.

20. Complaints

20.1 If you have any concerns about this Privacy Policy or the way we have handled your personal information, you may lodge a complaint with us.

20.2 Complaints should be directed to our Privacy Officer using the contact details set out in section 21.

20.3 We will acknowledge receipt of your complaint within 5 business days.

20.4 We will investigate your complaint and will use reasonable efforts to respond within 30 days. If we require additional time to investigate your complaint, we will notify you.

20.5 If you are not satisfied with our response to your complaint, or you consider that we may have breached the APPs or the Privacy Act, you may make a complaint to the Office of the Australian Information Commissioner (OAIC). The OAIC can be contacted:

• by telephone on 1300 363 992; or
• via the OAIC website at www.oaic.gov.au.

21. Contact

21.1 If you have any questions about this Privacy Policy or wish to make an access or correction request, please contact our Privacy Officer:

Socii Book Pty Ltd
Socii Privacy Officer
Email: privacy@sociiclub.com
Website: www.sociiclub.com

See also our Terms of Use.