DRAFT — placeholder for legal review, not legal advice. Prepared 2026-08-17 for GCIT to review with counsel. This document is a plain-English starting point drafted by the Burli team to describe how we intend to handle personal information. It has not been reviewed by a lawyer, it is not legal advice, and it must be checked, corrected, and replaced by GCIT's legal counsel before Burli relies on it or publishes it. It is written to be aware of the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), but its compliance has not been verified.

Burli — Privacy Policy

Last updated: 2026-08-17 (DRAFT)

1. About this policy

Burli ("Burli", "we", "us", "our") is operated by GCIT Pty Ltd, a company based on the Gold Coast, Queensland, Australia ("GCIT"). Burli lets organisations add AI "coworkers" to Microsoft Teams.

This Privacy Policy explains how we handle personal information when you visit burli.ai and when your organisation uses the Burli service (the "Service"). We aim to handle personal information consistently with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

Two roles. For information about the people who sign up, administer, and pay for Burli (for example, account and billing contacts), we generally act as the entity that decides how that information is handled. For the content your coworkers process on your behalf inside your systems ("Customer Data"), we generally act as a processor / service provider handling that data under your instructions and the Terms of Service. (For counsel: confirm controller/processor characterisation and whether a Data Processing Agreement is needed.)

2. What we collect

• Account and identity information. When you sign in with Microsoft, we receive identity details from Microsoft Entra ID / Microsoft 365 — such as your name, work email, organisation/tenant identifiers, and profile information needed to authenticate you and set up your account.
• Billing and usage information. Records of your credit purchases, balances, and consumption (including which coworkers and features were used and the associated AI and infrastructure costs). Card payment details are handled by Stripe, not stored by us.
• Conversation content the coworker processes. Messages, prompts, files, and other content your people share with a coworker in Teams, and the coworker's responses and actions, so the coworker can do its job.
• Connected-application data you authorise. When you enable a connector, the coworker may access data in the connected system (for example, Microsoft 365 / Teams content, and other business tools you connect) within the scope you grant, in order to carry out the tasks you authorise.
• Technical and support information. Logs, device/browser information, diagnostics, audit records of coworker actions, and information you provide when you contact support.
• Marketing-site information. Basic analytics and any details you submit through forms on burli.ai (see Cookies, Section 10).

We collect this information directly from you, from your use of the Service, from Microsoft when you sign in, and from the systems you connect.

3. How we use it

We use personal information to:

• run your AI coworkers and deliver the Service you have configured;
• authenticate you and manage your account and access;
• meter consumption, process payments, and manage credits and billing;
• provide support, investigate issues, and keep the Service secure and reliable;
• maintain audit and oversight records of coworker actions;
• comply with our legal obligations; and
• communicate with you about the Service, and (where permitted) send you relevant product or marketing messages you can opt out of.

We do not use Customer Data for our own unrelated purposes, and we do not use it to train third-party AI models except as needed to provide the Service and consistent with our providers' terms. (For counsel / to confirm: current Anthropic and other AI-provider data-use and no-training posture.)

4. Microsoft 365 and Teams data

Because coworkers operate inside Microsoft Teams and can be connected to Microsoft 365, we handle Microsoft 365 / Teams data on your behalf:

• access is based on the permissions you grant during setup and per connector, following a least-privilege approach;
• coworkers act within the scope you authorise, and material actions can be gated behind approvals;
• we process this data to perform the tasks you ask the coworker to do, and to operate, secure, and support the Service; and
• your use of Microsoft services remains subject to Microsoft's own terms and privacy commitments.

5. Sub-processors and disclosure

We use trusted third parties ("sub-processors") to deliver the Service. These currently include:

• Anthropic — the AI models that power coworkers (and potentially other AI providers as the product evolves);
• Microsoft — Microsoft 365 / Teams integration and Microsoft Azure hosting;
• Stripe — payment processing for credit purchases.

We share personal information with these providers only as needed to deliver the Service, and we require them to protect it. We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a business transfer. We do not sell personal information. An up-to-date list of sub-processors will be maintained and made available. (For counsel: confirm the complete, current sub-processor list, contractual terms, and any overseas-disclosure notices required under APP 8.)

6. Where your data is stored

We host the Service on Microsoft Azure in the Australia East region (Sydney, Australia). Some sub-processors (for example, AI model providers or payment processing) may process limited data outside Australia in order to deliver their part of the Service. Where personal information is disclosed overseas, we take reasonable steps consistent with APP 8. (For counsel: confirm which sub-processors process data offshore and in which countries, and finalise the APP 8 disclosure.)

7. Retention

We keep personal information only as long as needed for the purposes above, to meet legal, tax, and audit obligations, and to resolve disputes. Customer Data is retained while your account is active and for a reasonable period afterwards, after which we delete or de-identify it. See Section 8 for your export and deletion rights, and the Terms of Service for data export on churn. (For counsel: confirm concrete retention periods.)

8. Your rights — access, correction, export, and deletion

Consistent with the APPs, you can:

• access the personal information we hold about you;
• ask us to correct it if it is inaccurate, out of date, or incomplete;
• request an export of your Customer Data in a common format; and
• request deletion of personal information, subject to our legal and operational obligations.

To make a request, contact us at hello@burli.ai. We will respond within a reasonable time and may need to verify your identity. If your organisation administers Burli, some requests may need to be made through your administrator.

9. Security

We take reasonable steps to protect personal information, including:

• least-privilege connector permissions and scoped access;
• approval controls for material coworker actions and human oversight;
• audit logging of coworker activity;
• encryption in transit, access controls, and hosting on Microsoft Azure's secure infrastructure.

No system is perfectly secure, and we cannot guarantee absolute security. We are continuing to mature our security program; we do not currently claim any formal certification (such as SOC 2 or ISO 27001) — to be confirmed. (For counsel / security: do not add certification claims unless and until they are actually held.)

10. Cookies

We use cookies and similar technologies on the marketing website (burli.ai) for basic analytics and to remember your preferences. You can control cookies through your browser settings. The signed-in Service uses cookies and similar technologies only as needed to operate (for example, to keep you logged in). (For counsel: confirm cookie/consent banner requirements.)

11. Children

The Service is intended for business use by adults. It is not directed to, or intended for, anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take steps to delete it.

12. Contact and complaints

If you have a question, request, or complaint about how we handle personal information, contact us at hello@burli.ai. We will acknowledge your complaint and aim to resolve it within a reasonable time.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by phone on 1300 363 992.

Burli is a product of GCIT Pty Ltd, Gold Coast, Queensland, Australia. (For counsel: add GCIT's registered address and ABN/ACN, and a nominated privacy contact.)

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you (for example, by email or in-product notice). The "Last updated" date at the top shows when this policy last changed.