Privacy Policy

1. Who we are and what this policy covers

Nuamedia Solutions Pty Ltd (ABN 57 153 868 949) (Nuamedia, we, us) is an Australian company that builds the Camlin Connect platform. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy is our APP 1 privacy policy and, together with the notices shown at the point of collection, gives the information required by APP 5.

This policy covers personal information we collect through:

• the website at nuamedia.com.au and nuamedia.com, including its contact, demo and request forms;
• the Camlin Companion avatar assistant that appears on those pages, which is a Nuamedia product served from our Camlin Connect infrastructure; and
• our first-party website analytics and the servers that host the website.

It does not cover Camlin Connect deployments operated for or by our customers (for example, a customer's own voice assistant, contact centre or avatar built on Camlin Connect). Those deployments are governed by the customer's own privacy notice and by the contract between Nuamedia and that customer. If you interacted with a Camlin-powered service run by another organisation, please contact that organisation first.

The Camlin Connect product portals (camlinconnect.com.au and its sub-domains) have their own notices where they collect information beyond what is described here.

2. The short version

• We collect what you type into our forms (name, email, organisation and any message) so we can respond to you. Submissions are emailed to our team.
• The Camlin Companion assistant does nothing until you start it by selecting the avatar button in the corner of the page, and it only listens through your microphone if you then allow that in your browser. Your speech is sent to our own Camlin Speech service in Sydney for recognition, and the conversation is handled by our Camlin Connect runtime, which may use third-party AI model providers to generate replies.
• Our analytics are first-party and cookieless. We do not use advertising cookies or cross-site tracking, and we do not sell personal information.
• The website, Camlin Speech, the Camlin Connect runtime and our analytics service are hosted in Australia (Sydney). Some service providers, including our business email provider and AI model providers where enabled, may process information outside Australia.
• You can ask us for access to, or correction of, your personal information, or make a complaint, at privacy@nuamedia.com.au.

3. What we collect and how

We collect personal information in six ways. Each is described below with the kinds of information involved, where it goes and how long we keep it. We do not collect sensitive information (such as health, biometric or political information) through the website, and we ask that you do not include it in form messages or in conversations with the Companion.

3.1 Contact, demo and request forms

The website has a number of forms: general contact, contact sales, enterprise contact, get started, schedule or book a demo, try a demo, request access, service and solution enquiries, case-study and assurance-pack requests, webinar, workshop, event and visit sign-ups, and product interest sign-ups. Depending on the form, we collect:

• Identity and contact details: your name, email address, organisation or company, and optionally your phone number and role or job title;
• Your request: the subject, message, use case, requirements, budget or timeline, or other free-text you enter, and the product, service or event you selected; and
• Technical context: the time of submission and the IP address the request arrived from (used only for the spam control described below).

Spam control. We do not use a CAPTCHA. Each form includes a hidden field that ordinary visitors never see, a heuristic that identifies obviously machine-generated text, and a limit of three submissions per minute per IP address. Submissions that fail these checks are silently discarded; nothing about them is emailed or stored, and our application log records only that a drop occurred and its reason (not your details).

Where submissions go. A submission that passes the checks is handled by our web server and then:

• Emailed to our team at Nuamedia mailboxes, and in most cases a confirmation copy (including your message) is emailed to the address you gave us. Email is sent through our business email provider (see sections 5 and 6).
• Request access is different: it is not emailed. Your name, email, company and use case are forwarded to the Camlin Connect access-request service, where the request is stored with a status of pending, approved or denied while our team reviews it.

3.2 The Camlin Companion assistant

The Camlin Companion is the avatar assistant in the corner of every page. It is a Nuamedia product, loaded from our companion.camlinconnect.com.au origin, and it answers questions about our products using the content of this website as its knowledge base. It does nothing until you open it.

• Consent first. The avatar button in the corner of each page is only a button: nothing is downloaded from the Companion service, and nothing is listened to or recorded, until you select it. Selecting it is how you choose to start the Companion; a short notice linking to this policy appears with the first panel, and your browser then asks for microphone permission, which you can decline and still type your questions. Your choice to start is stored in your browser's local storage (key camlin-companion-consent-v1) so you are not asked on every page, and you can hide the button for the rest of your visit with its close control; you can clear the stored choice at any time through your browser settings.
• Speech. When you speak, audio is streamed directly from your browser to our Camlin Speech service (speech.camlinconnect.com.au), hosted in Sydney, which converts it to text. The audio does not pass through the nuamedia.com.au web server (see section 3.3). Camlin Speech processes the audio in memory to produce the transcript and does not store it.
• Conversation. What you type or say, and the Companion's replies, are handled by the Camlin Connect runtime (served from architect.camlinconnect.com.au) and its voice service (avatar.camlinconnect.com.au). To generate answers the runtime may send your messages, together with relevant website content, to one or more third-party AI model providers, depending on how the Companion is configured at the time. We do not send your name or contact details to these providers unless you include them in what you say.
• Transcripts. Conversation transcripts for this website are retained by the Camlin Connect platform for up to 30 days and then deleted. We use them to improve the Companion's answers and to diagnose problems.
• Proactive prompts. The Companion may occasionally offer help unprompted. It limits how often it does so and remembers in your browser's local storage that you dismissed it, for up to seven days.

The Companion is a demonstration and product-information assistant. It is not a channel for account, billing or support requests, and you should not share passwords, payment details or other sensitive information with it.

3.3 Speech token relay

So that your browser can talk to Camlin Speech without our secret credentials ever reaching your device, the website exposes a small relay at /api/asr-token. When you start speaking, the Companion asks this relay for a short-lived token (valid for five minutes, limited to speech recognition). The relay obtains the token from Camlin Speech using a server-held key and returns it to your browser. The relay handles no audio and no transcript, and it records nothing about you beyond the ordinary server logs described in section 3.6.

3.4 Website analytics

We measure how the website is used with our own first-party analytics service at analytics.nuamedia.com.au. It is cookieless: it sets no cookies and stores nothing on your device, it honours the Do Not Track and Global Privacy Control browser signals, and it does not track you across other websites. We do not use any third-party analytics or advertising services.

The events it records are:

• page views, including in-page navigation, with the referring page;
• how far down a page you read and how long the page was visible;
• clicks on primary calls to action, downloads, telephone and email links, and outbound links;
• which enquiry form was opened and whether a submission succeeded or failed (the form's name only, never what you typed); and
• that a Companion conversation started (not its content).

Event properties are limited to a fixed list of short labels chosen by us; nothing you type into the site is ever sent to analytics. The analytics service receives your IP address as part of the network request and uses it, at the moment the event arrives, to derive an approximate country, state and city and a visitor hash that is salted with a value that changes every day. The IP address itself is then discarded and is never stored with events, so visits cannot be linked from one day to the next. Individual event rows are kept for up to 400 days (about 13 months) to allow year-on-year comparison and then deleted; aggregated statistics, which do not identify anyone, are kept indefinitely.

3.5 Cookies and local storage

We use a minimal set of cookies and browser storage, all first-party and all functional. We use no advertising cookies and no third-party tracking cookies.

• Theme preference (local storage): whether you chose light, dark or system theme, and whether we have already asked you. Kept until you clear your browser storage.
• Companion consent and prompt state (local storage): your choice to start the Companion and whether you dismissed a proactive prompt (section 3.2); and whether you hid the avatar button for this visit (session storage, cleared when the tab closes).
• nua_internal (cookie, 30 days): set only for Nuamedia staff who unlock internal design-system pages. Ordinary visitors never receive it.

You can block or delete cookies and local storage through your browser. The site will continue to work; your theme choice and Companion consent will simply be asked again.

3.6 Server and infrastructure logs

Like every website, our servers keep technical logs in order to run and secure the service. These are held with our cloud hosting provider in its Sydney region and include:

• Application logs from the website containers: request paths, status codes, timestamps, error messages, spam-control drop reasons and email delivery confirmations (subject line and recipient address). Retained for seven days.
• Load balancer and network logs. Our load balancer does not record per-request access logs. Connection-level metadata (such as your IP address) may be held briefly by our hosting provider for operations and security monitoring.

4. Why we collect it and our legal basis

We collect, hold, use and disclose personal information for these purposes:

• to respond to your enquiry, demo or access request and to follow up on it (forms);
• to answer your questions about our products through the Companion;
• to send you information you have asked for, such as assurance packs, webinar and event details;
• to understand how the website is used so we can improve it (analytics);
• to keep the website secure, prevent spam and abuse, and diagnose faults (spam control and logs); and
• to meet our legal obligations.

Under the Privacy Act 1988 (Cth) we collect personal information only where it is reasonably necessary for one or more of our functions or activities (APP 3), and we collect it directly from you unless it is unreasonable or impracticable to do so. We use and disclose it only for the purpose we collected it, for a related purpose you would reasonably expect, with your consent, or where the law requires or permits (APP 6). Microphone audio in the Companion is collected only with your express consent, given by starting the Companion and then allowing microphone access in your browser.

5. Who we share it with

We do not sell, rent or trade personal information. We disclose it only to the following kinds of recipients, and only to the extent needed for the purposes above:

• Our own Camlin Connect services (access requests, runtime, voice, speech and Companion hosting), operated by Nuamedia.
• Our business email provider, which carries the notification and confirmation emails generated by our forms and hosts the Nuamedia mailboxes they are delivered to.
• Our cloud hosting provider, which hosts the website, Camlin Speech, the Camlin Connect runtime and our analytics service in its Sydney (ap-southeast-2) region and stores our logs. The Companion's script files are delivered through that provider's content delivery network; they carry no personal information.
• Third-party AI model providers, which receive Companion conversation text (not audio) so that replies can be generated, where the Companion is configured to use them. The providers in use may change as we configure the Companion; the current configuration is available on request at privacy@nuamedia.com.au.
• Professional advisers, regulators and law enforcement, where the law requires or permits, or to protect our rights or the safety of others.

Our service providers are contractually limited to processing personal information for us and in line with our instructions.

6. Overseas disclosure

The nuamedia.com.au website, Camlin Speech, the Camlin Connect runtime and voice service, and our analytics service are all hosted in Australia, in our cloud hosting provider's Sydney (ap-southeast-2) region. Your form submissions, the Companion's speech recognition and our analytics therefore stay in Australia while we hold them.

Personal information may be disclosed to recipients outside Australia in two cases:

• AI model processing. Where the Companion is configured to use third-party AI model providers, the text of your conversation may be processed on their infrastructure, which may be located outside Australia.
• Email. Our business email provider operates globally and may store or route email, including your form submission and our reply, through data centres outside Australia.

Where we disclose personal information overseas we take reasonable steps, as required by APP 8, to ensure the recipient handles it in a way consistent with the Australian Privacy Principles, including through contractual terms. By starting the Companion you consent to this processing of your conversation.

7. How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure (APP 11). In practice:

• all traffic between your browser and our services, and between our services and our providers, is encrypted in transit using TLS;
• data held by our hosting provider, including logs, is encrypted at rest using keys managed by that provider;
• secret credentials (such as the Camlin Speech key and the email password) are held in our hosting provider's secrets store and injected into the server at run time; they are never in the website's source code or sent to your browser;
• access to systems that hold personal information is limited to Nuamedia staff who need it for their role and is protected by individual accounts;
• we keep data only for as long as we need it (section 8); and
• the website carries a limit on form submissions per IP address, a hidden anti-bot field and content heuristics to reduce automated abuse.

We do not claim any third-party security certification for this website. No method of transmission or storage is completely secure. If we become aware of an eligible data breach under the Notifiable Data Breaches scheme we will notify affected individuals and the Office of the Australian Information Commissioner as the law requires.

8. How long we keep it

We keep personal information only for as long as it is needed for the purpose it was collected, or as the law requires, and then delete or de-identify it. Our current retention periods are:

• Form submission emails in Nuamedia mailboxes: retained while the enquiry is active and for up to 24 months after our last contact with you.
• Access requests held by the Camlin Connect access-request service: retained while pending and for up to 12 months after a decision.
• Companion audio: processed for recognition and not stored.
• Companion transcripts: up to 30 days.
• Analytics events: individual event rows (which contain no identifier) up to 400 days; aggregated statistics indefinitely, as they do not identify you.
• Application logs: seven days. Load balancer logs: not recorded.

9. Access and correction

You have the right to ask for access to the personal information we hold about you (APP 12) and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13).

To make a request, email privacy@nuamedia.com.au with the subject line "Privacy request" and tell us what you would like to access or change. We will need to verify your identity, usually by confirming the email address you used with us. We will respond within 30 days. Access is free; if a request is unusually complex we may charge a reasonable fee for the time involved and will tell you before we do. If we refuse access or correction we will explain why in writing and how you can complain.

You can also ask us to delete your information. We will do so unless we need to keep it for a legal reason, and we will tell you if that is the case.

10. Dealing with us anonymously

You can browse the website, read our content and use the Companion without telling us who you are (APP 2). Our analytics do not identify you. You will need to give us your contact details if you want us to respond to an enquiry, book a demo or grant access to a product.

11. Direct marketing

We may contact you about Nuamedia products and events that relate to the enquiry you made or the sign-up you completed (APP 7). Every marketing email includes a way to unsubscribe, and you can opt out at any time by emailing privacy@nuamedia.com.au. We do not share your details with other organisations for their marketing.

12. Complaints

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please contact us first:

• Email: privacy@nuamedia.com.au (subject line "Privacy complaint")
• Phone: +61 2 5300 6005 during Australian business hours
• Post: Data Protection Officer, Nuamedia Solutions Pty Ltd, Suite 8, 11 Bungan Street, Mona Vale NSW 2103, Australia

We will acknowledge your complaint promptly, investigate it and respond in writing within 30 days. If you are not satisfied with our response, or we have not responded in that time, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

13. Children

The website and the Companion are intended for business audiences and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact privacy@nuamedia.com.au and we will delete it.

14. Changes to this policy

We review this policy at least annually and whenever we change how the website or the Companion handles personal information, for example if we add a form, change a service provider or change where information is processed. The current version is always published at nuamedia.com.au/privacy with its effective date and version number. Where a change is material we will highlight it on that page for at least 30 days.

• v1.2 — 5 September 2026. Form submissions are now delivered by email only; the lead-management system and its retention entry were removed from sections 2, 3.1, 5, 7 and 8.
• v1.0 — 3 September 2026. First APP 1 policy for nuamedia.com.au. Replaces the earlier "Privacy & Security" summary page.

15. Contact us

Entity

Nuamedia Solutions Pty Ltd
ABN 57 153 868 949

Privacy enquiries

privacy@nuamedia.com.au

Phone

+61 2 5300 6005

Post

Suite 8, 11 Bungan Street, Mona Vale NSW 2103, Australia

Effective date

3 September 2026

Last updated

5 September 2026 (v1.2)