FAYBL PRIVACY POLICY

Replacement draft, version 2.5 | For review, 6 October 2026

YB Life Pty Ltd (ACN 667 901 537) trading as Faybl (we, us, our) is committed to protecting personal information. This policy explains how we handle personal information and how we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. What this policy covers

This policy applies to your use of Faybl. It explains what personal information we handle when you use our platform, visit our website or deal with us, why we handle it, where we keep it, and what you can ask us to do with it.

Faybl is subscribed to by businesses, principally financial advice practices and licensees. We call them Subscribers. Their advisers and staff use the platform, and information about their own clients passes through it. We call those clients the End Clients.

Two kinds of personal information move through Faybl, and your rights are exercised in different places depending on which applies to you.

2. What personal information we collect

2.1 Information we collect directly

• Contact and account details: name, business email address, telephone number, job title, and the business you work for.
• Authentication information: your login identifier and authentication credentials, which we store in hashed or encrypted form.
• Billing information: billing contact details, ABN, and payment records. We do not store full payment card numbers.
• Support and correspondence: records of your communications with us, including support tickets and emails.
• Technical and usage information: IP address, device and browser type, pages viewed, features used, and timestamps.

2.2 Information we handle for our Subscribers

When a Subscriber and their authorised users use the platform, information about their End Clients is processed through it. Depending on what the Subscriber chooses to upload, this can include name, contact details, date of birth, employment and income details, assets and liabilities, superannuation and investment holdings, insurance details, and related financial information. It may include health information where that is relevant to insurance advice.

We do not collect this information from the individual concerned. It is uploaded or entered by the Subscriber's own authorised users, acting for the Subscriber, or drawn from a system the Subscriber has connected. The Subscriber is responsible for collecting it lawfully, for telling individuals that it may be disclosed to a technology provider such as Faybl, and for obtaining any consent required before sensitive information is collected.

3. How we collect personal information

• Directly from you, when you register for an account, contact us, subscribe to updates, or use our platform.
• From a Subscriber's authorised users, when they upload or enter information into our platform on the Subscriber's behalf.
• From a connected system, where a Subscriber has authorised us to integrate with a platform they use, such as a financial planning system. We only receive information the Subscriber has authorised us to receive, and we use it to provide the platform, including to generate drafts and to carry out steps the Subscriber has configured.
• Automatically, through cookies and similar technologies when you visit our website or use our platform. See section 10.

4. Why we use personal information

• To provide, operate, secure and support our platform.
• To create, manage and authenticate user accounts.
• To generate documents, summaries and other outputs at the direction of a Subscriber and its users.
• To respond to enquiries and provide support to Subscribers and their authorised users.
• To bill for our services and manage our Subscriber relationships.
• To monitor, troubleshoot and improve the performance, reliability and security of our platform, using technical and usage information.
• To comply with our legal obligations, and to establish, exercise or defend legal claims.
• To send service communications, and marketing communications where you have not opted out. You can opt out of marketing at any time using the unsubscribe link or by contacting us.

5. Artificial intelligence, automation, and what we do not do with your information

Faybl uses artificial intelligence to generate summaries, drafts and documents. It also automates workflow and performs functions on behalf of users, which can include creating or updating records in a system a Subscriber uses, preparing and sending communications, and completing steps in a process.

We do not use Subscriber information to train artificial intelligence models. Information that Subscribers or their authorised users put into our platform, and the outputs generated from it, are not used by us to train, fine-tune or otherwise improve any artificial intelligence or machine learning model, whether a general purpose model or a model of our own.

Outputs generated by artificial intelligence can be inaccurate or incomplete, and an automated step can act on information that is wrong. Faybl is not a substitute for professional judgement. Automated functions run only where a Subscriber has turned them on and configured them, and the Subscriber decides what must be approved by a qualified person before it takes effect. Where an output or an automated step forms part of advice to an End Client, a qualified adviser reviews it first. We keep a record of the automated steps performed for each Subscriber so they can check what was done on their behalf.

Automated decision making. Faybl does not make decisions about individuals. It produces drafts and analysis, and it carries out steps that a Subscriber has configured it to carry out. Where a step could affect an End Client, such as a communication being sent or a record being changed, the Subscriber or their authorised user decides whether a qualified person must approve it first, and we provide the controls to require that approval. The decision about what advice is given, and whether to act on any output or automated step, is made by the Subscriber and their authorised users and not by our software. Our terms of use require that Faybl does not use personal information to make, or to substantially assist in making, any decision that has a legal or similarly significant effect on an individual without a person in the loop.

6. Where your information is stored and processed

We store personal information only in the country in which the Subscriber account is registered. If a Subscriber account is registered in Australia, the information associated with that account is stored in Australia, including backups and system logs. We do not move it offshore for storage.

Faybl is an international business. We have employees and contractors in Australia, the United Kingdom, the United States, Thailand, Taiwan and many other countries, and some of them need access to the platform to build, operate, secure and support it. That means personal information stored in Australia may be viewed from those countries.

Where that happens:

• Access is limited to individuals whose role requires it, and is logged.
• Every person with access is bound by written confidentiality obligations and by our security policies.
• Information is not copied onto, or stored on, any system or device outside the country it is stored in.
• We remain accountable for how those people handle the information, as if we had handled it ourselves in Australia.

Where you contact us directly, or receive a marketing communication from us, limited contact details may also be handled by a communications provider. Those providers and their locations are listed in section 7.

A Subscriber may choose to give access to someone located in another country, for example an outsourced paraplanner. That is the Subscriber's decision, and the Subscriber is responsible for telling its End Clients about it. It does not change where we store the information.

7. Who we share personal information with

We do not sell personal information. We do not rent or trade it. We disclose it only as described below.

7.1 Service providers

We use a small number of providers to operate our platform. Each is bound by contract to protect the information, to use it only to provide services to us, and not to use it to train artificial intelligence models.

7.2 Other disclosures

• To our professional advisers, including lawyers and accountants, where they need the information to advise us.
• Where required or authorised by law, by a court, or by a regulator.
• To a purchaser or proposed purchaser of our business, subject to confidentiality, where the information is part of the assets being transferred.
• With your consent, or where you would reasonably expect the disclosure.

8. How we keep information secure

We maintain an information security program that is independently assessed under SOC 2 Type II. A summary of our controls is available to Subscribers on request. Our measures include:

• Encryption of information in transit and at rest.
• Role based access control, least privilege, and multi-factor authentication for administrative access.
• Logical separation of each Subscriber's information, with no commingling between Subscribers.
• Background checks, confidentiality undertakings and security training for personnel with access to production systems.
• Logging and monitoring of access, with alerting on unusual activity.
• Independent penetration testing at least annually.
• Encrypted backups with tested restoration, and a business continuity plan tested at least annually.

No system can be guaranteed to be completely secure. If a data breach occurs that is likely to result in serious harm, we will act in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. Where the information belongs to a Subscriber, we will notify that Subscriber without undue delay and work with them so that whichever of us is the responsible entity can meet its obligations.

9. How long we keep information

We delete or de-identify personal information when we no longer need it, unless we are required by law to keep it.

10. Cookies and analytics

Our website and platform use cookies and similar technologies. Essential cookies are necessary for the platform to work, including to keep you signed in. Analytics cookies help us understand how the website and platform are used, so we can improve them.

You can control cookies through your browser settings. Blocking essential cookies will prevent parts of the platform from working.

11. Accessing and correcting your information

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact our Privacy Officer using the details in section 14.

We will acknowledge your request within 14 days and respond within 30 days. If we need to charge for the cost of retrieving information, we will tell you before we proceed. We do not charge for making a request or for correcting information.

If you are an End Client, please direct your request to your adviser. They hold the relationship with you and control the information. We will assist them to respond to you.

If we refuse a request, we will tell you why in writing and explain how to complain.

12. Complaints

If you believe we have breached the Australian Privacy Principles, please contact our Privacy Officer. We will acknowledge your complaint within 14 days and aim to resolve it within 30 days. If we need longer, we will tell you why and keep you informed.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au, by telephone on 1300 363 992, or by writing to GPO Box 5218, Sydney NSW 2001.

13. Changes to this policy

We may update this policy. The current version is always available at faybl.com and we will notify changes in accordance with Australian law.

14. How to contact us

Version 2.5 | Effective 21 October 2026 | Replaces the version dated 8 April 2025