Critical Path Privacy Policy

Boab AI Pty Ltd | ABN 60 640 047 007

Effective date: 06/10/2026 | Version: 005

This policy explains how Boab AI handles personal information through Critical Path and the pre-accelerator program, including applications, AI interviews, participant work, program communications and optional publicity.

1 Who is responsible

Boab AI Pty Ltd operates Critical Path and is responsible for the information handling described here. In this policy, “we”, “us” and “our” mean Boab AI Pty Ltd. Your enrolment confirmation identifies your program and cohort.

Contact the Privacy Officer at [email protected]. Postal address: 3/45 Wangaratta St, Richmond VIC 3121, Australia.

This policy describes our practices. It is not blanket consent to every use of information. Recorded AI interviews, optional marketing and optional publicity have separate choices. Section 4 explains how optional demographic selections are recorded and restricted. You can make a general enquiry anonymously or under a pseudonym where practicable; we need identifying information to assess an application, manage participation or verify a personal-information request.

2 Information we collect and how we collect it

We collect information directly when you apply, use an account, complete an exercise or interview, attend program activities, request a perk or contact us. Some records are generated by the platform, AI processing, staff review and service providers.

Depending on your participation, this includes:

• Identity and contact details, including name, email, phone number, LinkedIn URL and account identifiers.
• Application details, including country, state or postcode, venture stage, startup description and website, technical proficiency and time commitment. Earlier applications may contain referral source and cofounder information.
• Optional demographic responses, including gender and Aboriginal and/or Torres Strait Islander status.
• Participant work, including answers, drafts, edits, AI summaries, staff feedback, submission history, progress, attendance and cohort membership.
• AI interview audio, recordings, transcripts, conversation identifiers, timing and related technical records, where you agree to use that feature.
• Program operations, including support messages, perk requests, eligibility and redemption records, and campaign delivery and payment details where relevant.
• Approved publicity material and records of the material, purposes and channels you approved.
• Consent and preference records, including the wording and policy versions presented, your choices, timestamps, withdrawals and later changes.
• Incomplete-application contact records. If you enter a valid email at the first contact step of the application and do not submit it, we record that email, the cohort you were applying to, any advertising click reference that brought you there, the version of this policy shown, and the first and most recent time you reached that step. We do not store your answers, drafts or a way to resume the application. If you later submit an application or create an account with that email, this contact record is removed.
• Technical information such as session cookies, IP address, browser or device details, security and error logs, and email delivery records.
• Application-funnel measurement records, including the hour of a visit, furthest application step reached, whether an application was submitted, limited campaign attribution and referring website host, and the route used to reach the interview page. These measurement records do not contain application answers, demographic responses, contact details, account identifiers or device identifiers. This measurement does not use cookies or browser storage and does not send the records to third-party analytics services. The only exception is the advertising click sharing described in section 3.

Please avoid providing unnecessary sensitive information or another person’s personal or confidential information without authority. We do not ask you to upload passwords, customer databases or government identification documents as part of a founder exercise.

3 Why we use information

We use relevant information to assess applications and eligibility, manage accounts and cohorts, deliver learning activities and AI features, review work, provide feedback, communicate about participation, administer perks and agreed campaign payments, respond to requests and secure the service.

We also use appropriate information to evaluate program delivery and prepare participation reports. We use aggregate or de-identified reporting where individual identification is unnecessary and assess whether someone could reasonably be re-identified, including in small demographic groups.

We measure visits through the application and interview-entry pages to understand where people stop and improve the application process. These are visit counts, not counts of distinct people; returning or reconnecting can create another visit. We report aggregate counts and restrict access to the underlying records. Hour-level timing and campaign attribution can sometimes be linked to other records, particularly when few people apply, so we do not describe the records as fully anonymous. We do not use this measurement to identify applicants or to send you marketing. Its only use beyond aggregate reporting is the advertising click sharing described below. We also report aggregate application and interview outcomes using records already held for those purposes, without joining them to individual funnel visits.

Some advertising links carry a click reference created by the advertising platform that showed the advertisement. For visits made on or after the effective date of this version, we may give that platform back the click reference, the time of the visit, whether an application was submitted from that visit and when, and the campaign labels in the link. This lets us measure which campaigns lead to applications, and the platform may use it to measure and improve the delivery of our advertising. We do not send your name, email address, phone number, application answers, demographic responses or interview content. The platform may be able to connect the click reference to an account you hold with it, and it handles what it receives under its own privacy policy, which may involve processing outside Australia. Visits made before this version took effect are never shared this way. If you do not want a click reference recorded, open the application from a link without one, for example by typing the address directly.

Information marked required is needed to assess an application or provide the relevant service. We explain the consequences of withholding it at collection. Optional demographic answers, marketing communications and general publicity do not affect admission or ordinary program access.

We do not sell participant contact lists or private interview content. Marketing, publicity and any separate publisher’s use are limited to the choices and approvals described in section 6.

4 Optional demographic information

Demographic questions help us understand who the program reaches and prepare participation reporting. You may leave them unanswered or select “Prefer not to say”. They do not influence admission decisions.

Aboriginal and/or Torres Strait Islander status is sensitive information. The current question lets you select an answer without a separate consent checkbox. We record the selection and collection notice shown; we do not record that selection as express consent or treat acceptance of this policy as demographic consent. Sensitive responses collected through this selection-only question are excluded from participation reports unless a separate valid basis for that reporting is established. Earlier responses supported by valid recorded consent remain subject to that consent and any withdrawal. You can view your response or ask us to withdraw or delete it. We do not use sensitive demographic information for marketing or publicity.

We restrict access to people responsible for the relevant reporting and exclude sensitive demographic fields from routine contact or progress exports unless the reporting task requires them. Funder reporting uses aggregate information that does not reasonably identify you. If identifiable reporting is required for a particular cohort, we will identify the recipient, fields, purpose and basis for that sharing in the collection notice before collecting the relevant information, and obtain consent where required.

5 AI interviews and automated decisions

Critical Path uses ElevenLabs for voice features and Anthropic Claude for AI processing. Interview content may pass through the providers needed to conduct the conversation, produce a transcript or generate a summary. Section 8 describes providers and overseas handling.

Before an interview begins, a notice explains whether it is for a program exercise or a private founder-story application, what is recorded, its purpose, who can access it and relevant retention and provider processing. We ask for your agreement before collecting or transmitting interview audio. Browser microphone permission alone is not our record of that agreement.

You may end a call at any time. This stops further audio collection through that call but does not automatically delete existing records. Contact us about an alternative to a recorded interview; we will explain what is available and any effect on the relevant feature or optional campaign before you decide.

Authorised staff and service providers may access interview information as needed to deliver and support the feature and review your participation. Completing a founder-story interview does not make it public. Publication of private interview material requires your specific approval.

AI summaries may be inaccurate. You can review and edit exercise summaries before submitting them and ask us to correct inaccurate information about you.

Automated eligibility rules use application information such as country, state or postcode to check the published cohort criteria. Matching applications may be approved without individual staff screening. Perk rules use cohort membership and exercise-submission records to determine eligibility automatically. Staff review submitted exercises and select Build in Public participants. Contact [email protected] to query an outcome or request human review.

6 Program communications and your separate choices

We send factual communications needed for your application, account and current participation, such as sign-in links, workshop details, exercise reminders, feedback and agreed campaign payment updates.

Marketing communications are a separate opt-in. If you agree, Boab AI may contact you by email and SMS about founder resources, events, other programs and partner offers. This is one optional choice covering both channels; partners do not receive permission to add you to their own contact lists or send you their own marketing. Withdraw using the unsubscribe link in an email, the unsubscribe instructions in an SMS, your marketing preference setting, or by emailing [email protected]. Each SMS will include a working unsubscribe method, such as replying STOP where replies are supported. Withdrawal through any of these routes stops marketing by both email and SMS, and we honour requests within five working days. We may continue factual program and account communications while they remain relevant.

Earlier email-only permission remains email-only. Marketing SMS requires a fresh affirmative choice after the email-and-SMS wording is shown. Providing a phone number, accepting revised terms, acknowledging this policy or leaving an existing preference unchanged does not give that permission. We keep evidence of the wording, policy versions, choice and time recorded for each new marketing permission.

General publicity is another separate opt-in. It covers your name, your startup’s public name and description, and material you supply or specifically approve for publicity, for the channels and duration in section 7 of the Terms and Conditions. Private answers, raw recordings or transcripts, confidential business information and nonpublic AI analysis are excluded and require specific approval before publication. We do not use sensitive demographic information for publicity.

Private material may become public only through a specific approval identifying the material and intended use. Any separate organisation permitted to publish it must be identified in that approval. A selected Build in Public participant accepts a separate, limited campaign permission with their invitation. Neither selection nor payment grants rights over unrelated private material.

Marketing and publicity preferences are independent. Declining either does not reduce ordinary program access or perks. Marketing withdrawal does not change publicity permission. Restoring a preference or accepting revised policies does not restore another consent.

Incomplete-application contact records have their own withdrawal. If you enter your email on the application form but do not submit, we may email you reminders to finish the application. Every reminder contains an unsubscribe link that asks us to stop sending those reminders. Withdrawal stops further reminder emails and is recorded against that contact record. Because the record is only a reminder contact and not a persistent suppression list, withdrawal lasts only while we still hold the record: we delete it under the normal inactivity period in section 9, and a later visit to the application with the same email may create a new contact record and make you eligible for reminders again. You can also ask us to delete the record at any time using the contact details in section 10.

To withdraw publicity permission, use your preference setting or email [email protected]. We stop arranging new uses on receipt, stop active advertising we control within five working days and remove public material we control within 30 days, unless otherwise agreed. The same process applies when permission expires. We ask any approved separate publisher to act on the withdrawal but cannot guarantee removal of independent third-party copies or print already distributed. We may retain restricted evidence of earlier lawful uses and approvals for justified recordkeeping.

Public material can be seen worldwide, copied or shared by others. Please consider that before approving publication. Account deletion also ends marketing and publicity permission for future use and starts the applicable removal process. Campaign withdrawal does not cancel amounts already earned under the campaign agreement.

7 Who can receive information

We limit access and disclosure to what is reasonably needed for the stated purpose:

• Authorised staff, contractors and delivery personnel receive the information needed to administer the program, review work, provide support or prepare authorised reports. They are subject to appropriate confidentiality and access requirements.
• Technology providers process information to supply hosting, storage, voice and AI services, email and other necessary platform functions. Section 8 identifies the relevant arrangements.
• Perk providers receive relevant information when you request their offer.
• Fellow participants can see information you choose to share in workshops or peer spaces. For a cohort directory, we explain the fields and audience before you choose to share a profile. Private answers and interview material are not part of a shared profile.
• Funders receive reporting on the basis described in section 4. Any required identifiable disclosure is specified in the collection notice before the relevant collection.
• Public audiences and approved publicity partners receive only the material covered by your applicable publicity approval.
• Advertising platforms that sent a visit receive only the click information described in section 3, and only for visits made on or after the effective date of this version.

We may also disclose information where required or authorised by law, or for another specific purpose to which you consent. Staff exports remain subject to access, security and retention requirements after download. Export access does not authorise onward sharing or publicity, except the advertising click sharing described in section 3.

Where you directly use a third-party service, including a social platform or perk provider, that service’s privacy policy and terms also apply to its own handling.

8 Overseas processing and security

Some providers process or store information outside Australia.

We take reasonable steps to protect information disclosed to overseas recipients, including appropriate contractual safeguards, access limits and provider review. Agreeing to this policy does not waive protections under Australian Privacy Principle 8 or release us from responsibilities that apply to us.

We use appropriate technical and organisational measures to protect personal information, including role-based access and controls over staff exports. No internet service can guarantee absolute security. Report suspected unauthorised access to [email protected]. We investigate incidents and notify affected people and regulators when required by applicable law.

9 Retention and deletion

We keep information only while reasonably needed for the stated purposes. Our normal retention limits are below. We delete or de-identify it sooner where it is no longer needed and no applicable retention obligation prevents that. We do not retain every record for the longest period in the table. For an unsuccessful or withdrawn application, interview transcripts follow the application period; raw audio follows its shorter recording period.

The record-specific periods apply to active systems. Routine backups are isolated from ordinary use and age out within 90 days after deletion from active systems. Section 8 identifies any different provider arrangements.

You can request deletion by emailing us or using the account-deletion option. We aim to remove your active account data and stored audio under our control within 30 days of a verified request, subject to limited justified exceptions and the backup period above. We pass relevant requests to providers and take reasonable steps to verify deletion where we control their handling.

We may retain specific information where needed for an unresolved complaint, legal claim, applicable recordkeeping duty or another purpose permitted by law. We restrict that information and explain relevant exceptions to you where lawful. Account deletion does not require you to wait for a recording-retention minimum.

Records held independently by third parties, and material already shared publicly, may not be fully recoverable. Section 8 describes provider retention and section 6 explains public-material removal. We will explain the scope and progress of your request rather than promise immediate deletion of every copy.

10 Access correction and complaints

Email [email protected], addressed to the Privacy Officer, to request access, correction or deletion, change a consent, or raise a privacy complaint. We may need proportionate identity checks. Please do not send unnecessary sensitive documents with an initial request.

We aim to acknowledge requests and complaints within five working days and respond within 30 days. If more time is reasonably needed, we explain why and give an expected response date. Any shorter applicable legal deadline takes priority.

If we refuse a request, we explain the reason and available review options, unless the law prevents us doing so. If you remain dissatisfied, you can contact the Office of the Australian Information Commissioner through its privacy complaints service at www.oaic.gov.au/privacy/privacy-complaints, where it has jurisdiction. We will identify any other applicable complaint route.

Policy access, privacy requests, marketing unsubscribe and available account-exit options remain accessible if you do not accept revised program terms.

11 Changes to this policy

We publish the effective date and version and retain the corresponding historical text. We notify participants of material changes through an appropriate channel. Where a new purpose or practice requires consent, we ask before relying on it. Notice or acknowledgement of a new policy does not itself expand an earlier consent or authorise past conduct.