Robsy Privacy Policy

1. Who we are, and what this policy covers

Who we are. Robsy is a product of PairOx Pty Ltd, an Australian proprietary limited company (ACN 154 477 728, ABN 82 154 477 728) based in New South Wales, Australia ("PairOx", "Robsy", "we", "us", "our"). Robsy is a multi-tenant, business-to-business (B2B) software-as-a-service (SaaS) platform for robotics operations and a marketplace of robot-service providers, available at robsy.ai and its subdomains, together with the associated web and mobile applications, APIs, and related services (collectively, the "Platform").

What Robsy does. The Platform provides robot fleet management with telemetry and command dispatch, a marketplace where "provider" tenants publish listings that "customer" tenants can book, workflow automation, analytics and reporting, single sign-on (SSO) and role-based access control (RBAC), and subscription billing. Each business customer is provisioned as an isolated tenant; the individuals who use the Platform on a customer's behalf are that customer's staff or invitees ("Authorized Users").

What this policy covers — and the important controller/processor distinction. This policy explains how we handle personal data in two different roles:

• Robsy as controller (business). When we collect and use personal data for our own purposes — for example, to run robsy.ai, administer accounts, bill customers, secure the Platform, communicate with prospects and administrators, and improve our services — we act as the data controller (under GDPR/UK-GDPR) or business (under CCPA/CPRA). This Privacy Policy governs that processing.
• Robsy as processor (service provider). When we host and process the personal data that a customer or its Authorized Users put into their tenant — for example, Authorized-User profiles, robot and operational records, marketplace listings and bookings — we act on the customer's documented instructions as a data processor (GDPR/UK-GDPR) / service provider (CCPA/CPRA). For that data, the customer is the controller/business, that customer's own privacy notice governs the relationship with its staff and end users, and our handling is governed by our Data Processing Addendum ("DPA"), not by this Privacy Policy. If you are an Authorized User and want to exercise rights over data held inside a customer's tenant, contact that customer (your employer or the organization that invited you); we will refer such requests to them.

A note on robotics (software-only role). Robsy is software. We do not physically operate, control, maintain, or supervise anyone's robots, and we are not responsible for robot safety, physical damage, injury, or a customer's compliance with robotics, product-safety, or workplace-safety laws. Operating robots safely and lawfully is the customer's responsibility. This policy concerns personal data; safety and operational responsibilities are addressed in our Terms of Service.

2. The personal data we collect

The categories below describe the personal data that may be processed through the Platform. Where we act as processor (Section 1), the customer determines what is entered into its tenant.

a. Account and contact data. Business/tenant name, the name, work email, job title, phone number, and country/region of the administrators and billing contacts who create or manage an account, and records of your agreements and communications with us.

b. Authorized-User profile and authentication data. Name, work email, display name, avatar (if provided), assigned roles/permissions (RBAC), tenant membership, and account status. Authentication data includes credentials handling metadata, session and token information, multi-factor settings, and — where a customer uses SSO — the identifiers and attributes returned by the customer's identity provider (IdP), such as a subject/User ID, email, group or role claims, and login timestamps. We do not receive your IdP password.

c. Billing and subscription data. Subscription plan (monthly/annual), trial status (14-day trials), billing contact details, billing address/country, tax identifiers where applicable, marketplace transaction and fee records, invoices, and payment status. Payments are processed by Stripe. We do not store full payment card numbers; Stripe collects and stores card data and returns to us only limited information such as a payment token/reference, card brand, last four digits, and expiry, plus transaction outcomes.

d. Usage, telemetry, and log data. Records generated automatically when the Platform is used — including feature usage and events, actions taken, timestamps, IP address, browser/device and operating-system information, API request and response metadata, performance metrics, and error/diagnostic logs. This includes audit logs recording security-relevant actions (e.g., sign-ins, permission changes, sensitive operations).

e. Robot and operational data a customer inputs. Data that a customer configures or generates within its tenant — for example, robot/fleet inventory and identifiers, device telemetry and status, commands and job/workflow records, schedules, locations/sites, and operational analytics. This data can include personal data if a customer chooses to include it (e.g., an operator's name against a task). For this data we generally act as processor, and the customer is responsible for the lawfulness of what it inputs.

f. Marketplace data. For provider tenants: business profile, listing content (service descriptions, pricing, availability, media). For customer tenants: booking requests, order and transaction records, and messages exchanged in connection with a booking. Marketplace data may be shared between the relevant provider and customer tenants to fulfil a booking (see Section 7).

g. Support and communications data. The contents of support tickets, emails, chat, and other communications you send us, including any attachments, plus the metadata needed to respond and to maintain a support history.

h. Cookies, device, and analytics data. Cookies and similar technologies, device and browser identifiers, and analytics events (see Section 6).

Sensitive data. Robsy is not designed to collect special-category/sensitive personal data (e.g., health, biometric, or government-ID data), and customers should not enter such data into free-text fields. If a customer chooses to process sensitive data in its tenant, it does so as controller and is responsible for having a lawful basis and any required consents.

3. How we collect personal data

• Directly from you. When you register, purchase a subscription, are invited to a tenant as an Authorized User, configure the Platform, create listings or bookings, contact support, or otherwise communicate with us.
• Automatically. Through your use of the Platform and our website, via server logs, cookies and similar technologies, and telemetry/analytics (Section 2d, 2h).
• From sub-processors and other sources. From Stripe (billing and payment status), from a customer's identity provider when SSO is used (authentication identifiers/claims), from Sentry (error diagnostics), and from other Authorized Users or administrators in your tenant (e.g., when an admin creates your account or assigns your role).

4. How and why we use personal data (purposes)

We use personal data to:

1. Provide and operate the Platform — create and administer tenants and accounts, authenticate users (including SSO), enforce RBAC and tenant isolation, and deliver the fleet-management, marketplace, workflow, and analytics features you request.
2. Process transactions and billing — manage subscriptions, trials, invoicing, marketplace fees, and payments through Stripe.
3. Enable the marketplace — publish provider listings and facilitate bookings and related communications between provider and customer tenants.
4. Communicate with you — send service, transactional, security, and administrative messages (e.g., via Resend), respond to support requests, and send product or marketing communications where permitted (with opt-out/consent as required).
5. Secure and protect the Platform — authentication, fraud and abuse prevention, audit logging, monitoring, incident detection and response, and enforcement of our Terms.
6. Maintain, troubleshoot, and improve — diagnose errors (via Sentry), monitor performance and reliability, and develop new and improved features (using aggregated or de-identified data wherever practicable).
7. Comply with law and enforce rights — meet legal, tax, and accounting obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not use robot/operational or marketplace content that a customer stores in its tenant to train general-purpose AI models for our own commercial purposes; any processing of that data is on the customer's instructions under the DPA.

5. Legal bases (GDPR / UK-GDPR)

Where GDPR or UK-GDPR applies and we act as controller, we rely on the following legal bases (Article 6):

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you may object (see Section 11). Where we act as processor for a customer's tenant data, the customer is responsible for the legal basis, and we process on its instructions under the DPA.

6. Cookies and analytics

We use cookies and similar technologies in two broad categories:

• Strictly necessary / essential. Required to run the Platform — for example, authentication and session cookies, security and load-balancing, and remembering essential preferences. These cannot be switched off without breaking core functionality, and generally do not require consent.
• Analytics / performance. We do not currently set analytics, advertising or other non-essential cookies on the Platform or our website. If we introduce them, then where required by law (e.g., in the EU/UK) we will set them only with your consent, asked for through a cookie preference tool before they are set, and you will be able to withdraw that consent at any time through the same tool.

We honor recognized opt-out preference signals (such as Global Privacy Control) where required by applicable law. For details of specific cookies and their durations, contact privacy@robsy.ai.

7. How we share personal data

We share personal data only as described below. We do not sell personal data, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA.

a. Sub-processors / service providers. We use a limited set of vetted third parties to provide the Platform. Each is bound by contract to protect personal data and process it only on our instructions:

Push notifications (mobile app). The Robsy mobile app obtains a push token for your device from Expo, and registers it with us, only after you allow notifications on that device. We send each push notification to that token through Expo, which passes it to Apple Push Notification service (iPhone and iPad) or Firebase Cloud Messaging (Android) for delivery. A push notification carries only what an operator needs to see on a locked phone — the alert type, the name of the robot concerned and the alert's severity — together with the device's push token and Robsy's own identifiers for the notification, the alert and the robot, which the app uses to open the alert when you tap it. It carries no telemetry readings and no other personal data.

Our current sub-processor list (including any updates) is maintained in this section and, for customer tenant data, in Annex III of the DPA (robsy.ai/dpa).

b. Between tenants within the marketplace. To fulfil the marketplace's core function, relevant information is shared between a provider tenant and a customer tenant — for example, a provider's public listing details are visible to prospective customers, and a customer's booking request and related messages are shared with the chosen provider. Robsy acts as an intermediary platform and is not a party to any service contract between a provider and a customer, and is not the operator of any robot.

c. Legal, safety, and compliance. We may disclose personal data where we reasonably believe it is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of PairOx, our users, or the public.

d. Business transfers. If PairOx is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction, subject to the receiving party honoring commitments consistent with this policy. We will provide notice where required.

e. With your direction or consent. We share personal data with other third parties when you or your tenant administrator instruct or authorize us to do so (for example, an integration you enable).

8. International data transfers

The Platform is operated using cloud infrastructure and sub-processors that may store or process personal data in countries outside the country in which you or your customer is located, including potentially outside the EEA, the UK, and Australia. The location or region in which each of our infrastructure providers processes personal data is listed in Section 7.

Where personal data is transferred internationally in a way that triggers transfer requirements, we implement appropriate safeguards, which may include the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement / Addendum, and, for Australian personal information, steps consistent with Australian Privacy Principle 8 (cross-border disclosure). A copy of the relevant safeguards can be requested via the contact in Section 14. For customer tenant data, transfer terms are set out in the DPA.

9. Data retention

We retain personal data for as long as it is needed for the purposes described in this policy, and specifically:

• Account and tenant data: for the life of the account, and for a defined period after account closure or termination to allow for reactivation, dispute resolution, and legal/tax record-keeping, after which it is deleted or de-identified.
• Billing/transaction records: retained for the period required by tax, accounting, and financial-record laws (typically several years).
• Usage and telemetry logs: retained for a limited operational and security window, then deleted or aggregated/de-identified.
• Sign-in attempt records (the email address entered, the IP address, the browser's user-agent string and whether the attempt succeeded): kept for 90 days, then deleted.
• Audit log entries: each entry in a workspace's audit log is kept for 13 months from when it is recorded, then deleted. A workspace's owner or admin keeps a copy of what the audit log lists by exporting it (Audit log → Export CSV).
• Support communications: retained for as long as needed to provide support and maintain a service history.
• Customer tenant data (processor role): retained and deleted according to the customer's instructions and the timelines in the DPA, including deletion or return of data after termination.

For customer tenant data, the return and deletion timelines are set out in Section 10 of the DPA. Where we de-identify data, we maintain and use it only in aggregated or anonymized form.

10. Security

We maintain technical and organizational measures designed to protect personal data, including:

• Encryption in transit (TLS/HTTPS) for data moving between you and the Platform;
• Tenant isolation enforced at the application and database layers, including row-level security (RLS) and role-based access control (RBAC) so users can access only the data their permissions allow;
• Audit logging of security-relevant actions, and monitoring for anomalous activity;
• Access controls for our personnel on a least-privilege, need-to-know basis;
• Use of reputable infrastructure and sub-processors (Section 7) with their own security programs.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Customers and Authorized Users are responsible for safeguarding their credentials, configuring SSO/MFA and permissions appropriately, and using the Platform securely. If we become aware of a personal-data breach, we will notify affected parties and authorities as required by applicable law and, for tenant data, as set out in the DPA.

11. Your privacy rights

Your rights depend on where you are and on whether Robsy acts as controller or processor for the data in question. If your data sits inside a customer's tenant, that customer is the controller — contact them, and we will assist them in responding. For data where we are the controller, you have the rights below.

a. EU / UK (GDPR / UK-GDPR). You may have the right to: access your personal data; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests or to direct marketing; and, where processing is based on consent, to withdraw consent at any time (without affecting prior processing). You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO); in the EU, your local Data Protection Authority.

Complaints to us (UK). If you are in the UK, you can complain to us first at privacy@robsy.ai about how we handle your personal data. We acknowledge your complaint within 30 days of receiving it, and we respond without undue delay and tell you the outcome. You can still complain to the ICO.

b. California (CCPA / CPRA). If you are a California resident, you may have the right to: know/access the categories and specific pieces of personal information we collect, use, and disclose; delete your personal information; correct inaccurate personal information; opt out of the sale or sharing of personal information (note: we do not sell or share personal information as defined by the CCPA/CPRA); and to non-discrimination for exercising your rights. You may use an authorized agent to submit requests, subject to our verification. We do not use or disclose sensitive personal information beyond the purposes permitted under the CPRA.

c. Australia (Privacy Act 1988 / Australian Privacy Principles). You may request access to, and correction of, the personal information we hold about you (APP 12 and APP 13). If you have a complaint about how we handle your personal information, you can contact us first (Section 14); if you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC).

d. India (Digital Personal Data Protection Act, 2023 — "DPDP Act"). The DPDP Act can apply to the processing of the personal data of individuals ("Data Principals") located in India, including where that processing takes place outside India in connection with offering goods or services to Data Principals in India. Where the DPDP Act applies and we determine the purpose and means of processing, we act as a Data Fiduciary; where we process personal data on a customer's documented instructions inside its tenant (Section 1), we act as a Data Processor and the customer is the Data Fiduciary. We process personal data on the basis of your consent or a legitimate use permitted by the Act (for example, the specified purpose for which you voluntarily provided your data, and compliance with legal obligations). As a Data Principal you have the right to: access a summary of the personal data we process about you and the processing activities we undertake; obtain the identities of other Data Fiduciaries and Data Processors with whom your personal data has been shared, together with a description of the data shared; correct, complete, update, and erase your personal data; grievance redressal (see below and Section 14); and nominate another individual to exercise your rights in the event of your death or incapacity. Where processing is based on consent, you may withdraw your consent at any time, and doing so will be as easy as it was to give it (withdrawal does not affect processing carried out before withdrawal, or processing on another lawful basis). To exercise these rights or raise a grievance, contact our Grievance Officer (India) at the details in Section 14; we will respond within the period prescribed by the Act. If your grievance is not resolved to your satisfaction, you may register a complaint with the Data Protection Board of India.

How to exercise your rights, and our timelines. Submit a request via privacy@robsy.ai or the contact details in Section 14. We will verify your identity before acting (and may need additional information to do so). We aim to respond within the timeframes required by applicable law — generally within 30 days (extendable where permitted, e.g., up to 90 days under CCPA/CPRA for complex requests), and 45 days for CCPA/CPRA requests (extendable by a further 45 days with notice). We will not discriminate against you for exercising your rights. Some rights are subject to legal limits and exceptions.

Decisions a program makes (automated decisions). The Platform makes these decisions by program, with no person involved:

• Sign-in lockout. After 5 wrong passwords in a row, the account is locked for 15 minutes, even against the correct password. The lock ends by itself after 15 minutes. This uses the account and its sign-in attempts.
• Two-factor codes. After 5 wrong two-factor codes during one sign-in, that sign-in is cancelled and you start again with your password. This uses the account and the sign-in.
• End of a free trial. When a workspace's 14-day trial ends without a paid plan, the workspace cannot add robots or use its plan's features, and its scheduled tasks are held until a plan is chosen.
• Unpaid subscription. When Stripe reports a subscription as unpaid, or cancels it because a payment failed, the workspace becomes read-only: its data can still be read, and paying, signing in and out, safety actions and support requests keep working.
• Card payment screening. When a card payment is made through Stripe Checkout, Stripe's own fraud screening may decline it.
• Security monitoring. A program flags bursts of failed sign-ins, many actions outside 06:00–22:00 UTC and very rapid requests as possible security incidents for Robsy to review, and may email a workspace's owners and admins about them.

The trial and subscription decisions are about a business's subscription and use its billing status, not personal data about a person. None of these decisions is made solely by a program in a way that significantly affects an individual's rights or interests. To ask about any of them, contact privacy@robsy.ai.

12. Children's privacy

The Platform is a B2B product intended for use by businesses and their staff. It is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16 (or 18 where a higher age applies). If you believe a child has provided us personal data, contact us (Section 14) and we will take appropriate steps to delete it.

India (DPDP Act, 2023). Under the DPDP Act a "child" is an individual under 18. We do not knowingly process the personal data of children in India without the verifiable consent of a parent or lawful guardian, we do not undertake processing likely to cause a detrimental effect on a child's well-being, and we do not carry out tracking, behavioural monitoring, or targeted advertising directed at children.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will provide notice by updating the "Last updated" date above and, where appropriate, by email or an in-Platform notice before the change takes effect. Your continued use of the Platform after an update takes effect constitutes acceptance of the revised policy, to the extent permitted by law.

14. How to contact us

PairOx Pty Ltd (ACN 154 477 728, ABN 82 154 477 728) — operator of Robsy (robsy.ai), an Australian proprietary limited company based in New South Wales, Australia

• Privacy enquiries / rights requests: privacy@robsy.ai
• Legal notices: legal@robsy.ai
• Postal address: available on request via legal@robsy.ai
• Data Protection Officer (DPO): not appointed, because GDPR and UK-GDPR Art. 37 do not require one for Robsy's processing; privacy@robsy.ai answers every privacy question
• EU representative (GDPR Art. 27): not appointed
• UK representative (UK-GDPR Art. 27): not appointed
• Grievance Officer (India — DPDP Act, 2023): privacy@robsy.ai, monitored by PairOx and able to answer on PairOx's behalf. Under the DPDP Act, the Grievance Officer is the point of contact for Data Principals in India to raise grievances about our processing of their personal data; if a grievance is not resolved to your satisfaction, you may escalate to the Data Protection Board of India.

If you are an Authorized User and your request concerns data held inside a customer's tenant, please contact that customer (the controller) directly; we will support them in responding. For matters concerning our processing of customer tenant data, please refer to the Data Processing Addendum (DPA), published at robsy.ai/dpa.

This Privacy Policy should be read together with our Terms of Service and (for business customers) our Data Processing Addendum.