Privacy Policy

Lunio Energy Pty Ltd (ABN 31672296767) and Lunio Labs Pty Ltd (ABN 94689993137) (we, us, our) is committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, and store your personal information, and how you can access or correct it.

We may collect the following types of personal information:

• Identity information — name, email address, organisation
• Account information — login credentials and account details
• Technical and usage data — IP address, device information, browser type, and usage logs
• Communication records — support requests, correspondence, and feedback

We collect personal information directly from you (such as when you register or contact us) and automatically through your use of our services.

We collect, hold, use, and disclose your personal information for the following purposes:

• To provide, operate, and maintain our services
• To respond to your enquiries and support requests
• To analyse usage patterns and improve system performance
• To train and optimise AI and machine learning models — where our services include AI-powered features (such as pricing intelligence systems), we use your operational and commercial data exclusively to train and optimise the AI model deployed for your specific customer instance. We do not engage in cross-customer training using identifiable or proprietary customer data
• To meet our legal and regulatory obligations
• To detect, prevent, and address technical issues or security threats

We will only use your personal information for the purposes for which it was collected, or for a related purpose you would reasonably expect.

We may disclose your personal information to:

• Third-party service providers — primarily Amazon Web Services (AWS) as our cloud hosting provider, and other approved sub-processors listed in our Data Processing Agreement. AWS provides the infrastructure for data storage, processing, and security controls
• Professional advisers — such as lawyers, accountants, and auditors
• Government agencies and regulators — where required or authorised by law

We do not sell, rent, or trade your personal information.

You retain full ownership of all data uploaded to our systems, as well as all outputs, insights, and derivative data generated by our platform. We claim no ownership rights to your data and use it solely to provide the contracted services.

Some of our service providers are located overseas, including in the United States (AWS). When we disclose your personal information overseas, we take reasonable steps to ensure that the overseas recipient complies with the APPs or is subject to a substantially similar privacy regime.

By using our services, you consent to the disclosure of your personal information to overseas recipients for the purposes set out in this Privacy Policy.

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our security measures include:

• Encryption in transit (TLS 1.2+)
• Encryption at rest (AES-256)
• Access controls and multi-factor authentication
• Regular monitoring and logging

We retain your personal information for the duration of the active service agreement and for a period of 30 days following termination, unless otherwise specified in writing by you or required by applicable law. Backup copies are retained in accordance with our backup retention schedule and are subject to the same deletion protocols. You may request early deletion at any time.

When personal information is no longer required, we securely delete it from our systems in accordance with NIST 800-88 guidelines for media sanitisation, ensuring data is irretrievable. A certificate of destruction can be provided upon request.

Under the APPs, you have the right to:

• Access — request access to the personal information we hold about you
• Correction — request correction of inaccurate, out-of-date, incomplete, or misleading personal information
• Anonymity or pseudonymity — where practicable, you may interact with us without identifying yourself

To exercise these rights, please contact us using the details below.

If you believe we have breached the APPs or your privacy, you may lodge a complaint with us. We will investigate your complaint and respond within a reasonable timeframe (usually 30 days).

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au

Contact: corporate@lunio.co