Privacy Policy

1. Who we are and what this policy covers

InterMeta Pty Ltd is an Australian company based in Victoria. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy covers everything you do on networkingcopilot.ai and everything the service does on your behalf. If you have a complaint we can’t resolve, you can escalate it to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au — see section 14.

2. What Networking Copilot does

It helps to know what the product does before reading what it collects. Networking Copilot is a business-networking CRM with follow-up automation. You capture a contact by photographing their business card (AI reads the image) or by typing or chatting the details in. At capture, the AI can read the contact’s own public website to fill in their company, business description, industry, address and ABN, and can run an AI web search to find their public LinkedIn profile URL — low-confidence LinkedIn matches are discarded rather than guessed. The AI scores each lead against a rubric you define, with a written justification. You then manage contacts through pipeline stages, notes, tags, tasks and meeting history; send follow-up email sequences from your own mailbox; and let booking detection stop the chase automatically when a meeting lands in your calendar. An AI chat copilot can read and update your own CRM, and the service can suggest introductions between your own contacts.

3. What we collect

• Account: your name, email and password, or a Google or Microsoft sign-in identity.
• Contacts you add: name, job title, company, industry, up to three email addresses, mobile and office phone numbers, website, LinkedIn URL, postal address, ABN, business description, a photo, where and when you met, personal details, what the contact cares about, who referred them, referral potential, interest tags, their AI lead score and its justification, pipeline stage, meeting notes, and an activity timeline.
• Brand and content: your logo, brand colour, email templates and copy, sign-off, and booking link.
• Connection credentials: if you connect a mailbox or calendar — a Gmail app password, Microsoft OAuth tokens, or Google Calendar OAuth tokens. These are encrypted at rest.
• Billing: handled entirely by Stripe. We never see or store your card number.
• Technical: standard server and application logs.

4. We never read your mailbox

This is the question people most want answered, so here it is plainly: we never read your email. There is no scope, credential, or code path in Networking Copilot that can read your mailbox.

• Gmail: your app password is used only to send. Never to read.
• Microsoft: we request Mail.Send only. The Mail.ReadWrite permission was deliberately dropped from our app.
• Booking detection reads your calendar, not your email. Google Calendar access is a separate, read-only grant; on Microsoft it is Calendars.Read.
• The booking scanner only acts on a newly created calendar event whose attendee matches a contact already in your CRM. Every other event is ignored, and nothing about it is stored.

The exact permissions we request, in full. Google: openid, email, https://www.googleapis.com/auth/calendar.events.readonly. Microsoft: openid, email, offline_access, User.Read, Mail.Send, Calendars.Read.

Connecting email and calendar is optional — the product works without it. And because we don’t read your mail, we do not detect replies: when someone replies to you, you cancel their sequence yourself. Bookings are what stop a sequence automatically.

5. How we use your information

We use your information to run the service for you: capture and enrich contacts, score leads against your rubric, show your CRM and stats, send the follow-up emails you configure from your own mailbox, detect bookings to stop a sequence, power the chat copilot over your own CRM, and suggest introductions between your own contacts. We also use it to provide support, process billing through Stripe, and keep the service secure. We do not sell your data, and we do not use it for advertising.

6. How we use AI

The AI in Networking Copilot is Anthropic’s Claude (models claude-sonnet-4-6 and claude-haiku-4-5). To do its job we send it: business card images, contact details, your scoring rubric, text from a contact’s public website, and your chat messages. Anthropic does not train its models on data sent through the API, and we do not use your data to train AI models either — ours or anyone else’s.

Be aware that AI output can be wrong. Extracted card fields, enriched business details, LinkedIn matches, lead scores and drafted email copy are suggestions — review them before you rely on them or send them. A lead score is an estimate against your own rubric, not advice. Nothing in the product is legal, financial, accounting or tax advice.

7. Where your data lives

Your data at rest — the database, authentication and file storage — is held with Supabase in Sydney, Australia (ap-southeast-2). Customer data is stored in Australia.

To be precise about the rest: the application itself and its scheduled jobs run on Vercel, whose servers may be outside Australia, likely in the United States, so requests are processed there in transit. The AI providers we use are also overseas. Data at rest stays in Australia; some processing happens offshore.

8. Who we share it with (sub-processors)

We share your data only with the providers needed to run the service, and only for that purpose:

• Supabase — database, authentication, file storage. Sydney, Australia.
• Vercel — application hosting and scheduled jobs.
• Anthropic (Claude) — the AI, as described in section 6. Does not train on API data.
• Stripe — payments, in Australian dollars.
• Google — only if you choose it: sign-in, read-only calendar access, sending via Gmail.
• Microsoft — only if you choose it: sign-in, sending via Outlook, read-only calendar access.

That is the whole list. There are no advertising networks, no data brokers, and no analytics companies receiving your customer data.

9. Google API Services User Data Policy

Networking Copilot’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is used solely to detect that a meeting was booked with an existing contact and to stop that contact’s follow-up sequence. It is never used for advertising, never sold, and never transferred except as needed to provide that feature or as required by law. No human reads it except with your express permission, or for security or legal reasons.

10. Other people’s personal information

The contacts you add are other people’s personal information, and you are the one putting it into our system. You must have a lawful basis and the right to do so. Do not enter sensitive information — health information, biometric data, or government identifiers — into contact records.

If one of your contacts asks you, or asks us, for access to their details or for deletion, we will help make that happen. Contacts can reach us directly at [email protected].

11. Cookies

We use cookies for sign-in sessions only. There are no third-party advertising or tracking cookies.

12. Security

Data is encrypted in transit. Connection credentials are encrypted at rest. The database uses row-level isolation, so one account cannot read another’s data. Staff access is limited to those who need it. We take these measures seriously, and we are also honest about the limits: no system is perfectly secure, and we cannot guarantee absolute security.

13. Retention and deletion

• We keep your data while your account is active.
• You can delete individual contacts in-app at any time.
• You can request deletion of your whole account by emailing [email protected]. We action it within 30 days.
• You can disconnect a mailbox or calendar at any time in Settings, which revokes the stored credential.
• We may keep limited records where the law requires it — for example, tax and transaction records.

14. Access, correction and complaints

You can see and edit almost all of your data directly in the app. For anything you can’t reach in-app, email us and we’ll provide or correct it. If you have a privacy complaint, send it to [email protected] — we respond within 30 days. If you’re not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner at oaic.gov.au.

15. Changes to this policy

If we change this policy, we’ll update the date at the top. If a change is material, we’ll tell you by email or in-app at least 30 days before it takes effect, so you have time to decide whether you’re happy with it. Continued use of the service means you accept the current version.