Udio Privacy Policy
How we handle personal information
Udio WA Pty Ltd | ABN 38 166 661 945 | Version 1.0 | 27 October 2026
Udio WA Pty Ltd ABN 38 166 661 945, trading as Udio (we, us or our), provides software for businesses and organisations that manage classes, enrolments, participants and related activities. This Policy explains how we collect, hold, use and disclose personal information through our website, platform, customer app and related services, and how you can exercise your privacy rights.
For privacy enquiries, requests or complaints, contact our Privacy Officer at privacy@udiosystems.com.
1. How this Policy applies
Personal information means information about an identified or reasonably identifiable individual. It includes personal data under applicable overseas privacy laws and, where relevant, information generated or inferred about an individual.
If you use Udio through a school, swim school, activity provider or another organisation, that organisation is our business customer (your provider). Your provider decides what information it needs, why it uses it, which people can access its account and the instructions it gives Udio. Its privacy notices explain its own practices. Udio handles account information to provide, secure and support the service and carry out authorised instructions.
Udio also handles information for its own purposes, such as responding to enquiries, managing business contacts, subscription billing, website operation, security, fraud prevention and legal compliance. Where relevant law uses these terms, Udio generally acts as a processor or service provider for customer-directed account processing and as a controller for its own processing. Our role depends on the particular activity.
We apply the Australian Privacy Principles to customer personal information under our Data Processing and Security Schedule. We also comply with privacy laws that apply to our activities. This Policy does not remove any statutory right, reduce our obligations under a customer agreement, or replace a specific collection notice. Reading this Policy or using Udio is not, by itself, consent to optional marketing, advertising tracking or a new use that requires consent.
2. Information we handle
The information we handle depends on how you interact with us and the features your provider uses. It may include:
- Identity and contact information, such as names, birth dates, gender, addresses, email addresses, telephone numbers, family relationships and emergency contacts.
- Account and administration information, such as business details, staff roles, facility allocations, permissions, qualifications, account identifiers, authentication records and communication preferences.
- Participant and service records, such as bookings, attendance, progress, results, achievements, consents, notes, photographs, attachments and communications. A provider may include health information, allergies, disability information or other sensitive information where needed for its activities and permitted by law.
- Billing and transaction information, such as billing-account details, payment authorities, payment tokens or references, invoices, payment status, refunds and transaction history. Full payment-card numbers and card verification values are processed by the payment provider, not stored by Udio.
- Enquiries, support and business-contact information, including correspondence, information supplied with a support request, sales discussions, employer and job title, and newsletter or marketing preferences.
- Technical and usage information, including IP addresses, browser and device details, timestamps, account activity, security and diagnostic logs, website interactions, cookie identifiers and advertising interactions where those tools are enabled.
- AI-related information, including prompts, retrieved account information, tool inputs and results, outputs and action records from the authorised AI use described in section 6.
Please do not put passwords, recovery codes, private keys, full card numbers or card verification values in notes, emails, support tickets or AI prompts. Avoid sending unnecessary sensitive information in ordinary email or support requests. We may ask you to remove or redact information that is not needed.
3. How we collect information
We collect information directly when you use Udio, register or manage an account, submit a form, subscribe to updates, contact us or provide information through an authorised interaction. We also receive information from your provider, authorised account users, parents or guardians, authorised integrations and payment or communications providers.
For business prospecting, we may obtain professional contact information from public business websites, professional directories, business social-media profiles, referrals or direct enquiries. We do not buy marketing contact lists. Public availability does not remove the need for lawful collection and marketing practices. You may ask us where we obtained your contact information.
Technical information is collected through service operation, security monitoring and the website technologies described in section 7. If we receive information we did not request, we assess whether we may lawfully retain it and delete or de-identify it where required.
You may make a general enquiry anonymously or using a pseudonym where lawful and practicable. We may need to verify your identity or authority to provide account access, process a payment, investigate an account issue or respond to a privacy request. If required information is not supplied, we or your provider may be unable to provide the relevant service. Optional information should not be made a condition of unrelated services.
4. Why we use information
We use personal information to operate accounts and deliver bookings, enrolments, attendance, reporting and other selected functions; transmit authorised payments and messages; support users; manage subscriptions and business relationships; and investigate service issues. Authorised staff may use AI assistance for those purposes as explained in section 6.
We also use information to secure and administer Udio, detect fraud and misuse, maintain appropriate records, meet legal obligations and manage disputes. We may use genuinely de-identified information for service analytics, capacity planning, benchmarking and product improvement. We take reasonable steps to prevent re-identification and do not treat information as de-identified merely because names have been removed.
Our own marketing is directed to business contacts and prospects, subject to section 7. We do not use identifiable information held in customer accounts for our own advertising, profiling, lead generation, market research or promotional communications without the business customer's written agreement and any required permission or other lawful authority from the individuals concerned. In particular, entering a child's or parent's information into a provider's account does not subscribe that person to Udio marketing.
Legal grounds where required
Where law requires us to identify a legal basis for our own processing, we rely on the basis relevant to the activity. This may be performing a contract with you or taking steps at your request before a contract; meeting a legal obligation; or consent for activities that require it, including optional tracking and certain sensitive-information processing. Where permitted, we rely on legitimate interests in running a secure service, preventing fraud, responding to business enquiries and developing business relationships, after considering the effects on individuals and their rights. That basis does not override a separate requirement for marketing or cookie consent.
For information processed on a provider's behalf, the provider is responsible for establishing the legal basis for its collection and instructions, including any additional condition for sensitive information. We assist with lawful requests and retain our own obligations. Where we rely on consent, you can withdraw it through the relevant control or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal, but may affect a feature that needs the information.
5. Children and sensitive information
Udio supports providers that work with children. Children cannot independently create their own Udio accounts. Their information is supplied or managed by a parent, guardian, provider or another authorised person. Providers must give appropriate notices, collect only what is necessary and obtain parental or other valid consent where required. A parent or guardian's authority and a child's own rights are assessed under applicable law, not assumed solely from an account relationship.
Sensitive information, including health information, is handled only where reasonably necessary for an authorised purpose and where consent or another legal condition permits it. Access should be limited to people who need it for their role. We do not use sensitive information or children's account records to create Udio advertising audiences.
6. AI assistance
At the date of this version, Udio's account-connected AI integration is available only to authorised Udio staff. It uses ChatGPT Work, supplied by OpenAI, through Udio's business workspace and an approved connection to Udio. Staff use it for support, account setup and administration, and analytics within an authorised service purpose. It is not currently a customer-facing feature and does not give customers or arbitrary external AI services an open connection to Udio accounts.
When a staff member invokes the integration, it can retrieve account information within the approved connection's access scope. Retrieved information may include personal and sensitive information present in the relevant records. Access must be appropriate to the staff member's role and task. The integration fetches information when invoked; it does not continuously export or create a general AI index of each customer's account.
Prompts, retrieved records, tool results, outputs and execution information may be transmitted to and held by OpenAI. This is actual processing of account information by an external provider, not merely processing of anonymous statistics. We require business-data protections under which this information is not used to train general or foundation models by default. We do not opt customer information into such training without the customer's express written agreement and any other consent or authority required by law.
Not using information for model training does not mean that no information is stored. AI conversations, files and related records are subject to the applicable workspace controls, provider terms and retention rules. They may be processed outside Australia. Deleting a source record does not automatically delete every copy already present in an AI conversation or file; those copies require separate retention and deletion controls.
AI can prepare an answer or propose an action, but changes through this integration require human confirmation. We do not use it to make solely automated decisions with legal or similarly significant effects on individuals. Outputs may be inaccurate and must be checked before material reliance. An affected person may raise a concern, request correction or ask for human review through their provider or our Privacy Officer.
Before introducing customer-facing account-connected AI or materially changing these processing purposes, we will provide appropriate information and obtain any required authorisation or consent. This Policy is not advance consent to every future AI product or provider.
7. Website technologies and marketing choices
Cookies analytics and advertising
Our public website uses cookies and similar technologies for essential operation and security and, where enabled, preferences, analytics, advertising measurement and retargeting. Tools used or available for those purposes include Google Analytics, Google Ads, Meta Pixel and LinkedIn tracking. A tool being named here does not mean it is enabled on every page or for every visitor.
These tools may receive online identifiers, IP and device information, pages viewed, referrals and interaction or conversion events. Advertising providers may associate those events with information they hold, including information from other sites or their own accounts, to measure campaigns and show relevant Udio advertising. They may act for their own purposes under their privacy notices. Website analytics and advertising information is not necessarily anonymous.
Where consent is required, non-essential technologies must not operate until you consent. You can accept or reject optional categories and change or withdraw your choice through the website's cookie preferences. Necessary security and service technologies remain available. You may also use browser or advertising-account controls; browser settings alone may not stop every type of tracking. Refusing optional advertising tracking does not prevent access to the core service.
These website advertising purposes do not authorise disclosure of customer account content, participant records or sensitive information to advertising networks. We do not sell customer account records to data brokers. Depending on the law that applies, advertising-related disclosures of website identifiers may nevertheless be treated as sharing, sale or targeted advertising. Where you have an applicable opt-out right, use the cookie controls or contact privacy@udiosystems.com. We honour legally required opt-out preference signals and do not unlawfully discriminate against people who exercise their rights.
Business communications
We use HubSpot to manage business contacts and sales enquiries and Mailchimp for newsletters and marketing communications. We may contact relevant business prospects using lawfully obtained professional contact information and run retargeting campaigns. We obtain consent where required, observe applicable contact restrictions, identify Udio as the sender and provide an effective way to opt out. A publicly available address is not automatically permission to send every type of marketing message.
Where enabled, marketing emails may record delivery, opens and link clicks to help us understand engagement and manage communications. You can unsubscribe from those emails. Email-client controls, such as blocking remote images, may also limit some measurement but do not replace an unsubscribe request.
You can unsubscribe using the link in a marketing email or by contacting us. We action requests within the period required by law and may retain minimal suppression information to avoid contacting you again. Opting out of marketing does not stop necessary account, transaction, security or service notices. Messages your provider sends through Udio are sent for that provider; contact it about its marketing preferences, or ask us to help direct your request.
8. Who receives information
Information in a provider's account is available to that provider and its authorised users according to permissions and the functions they use. We do not make it available to another business customer merely because it also uses Udio. We may disclose information to authorised personnel and contractors who need it, and to service providers for the relevant purposes below. Not every provider receives every category of information.
We may also disclose relevant information to website and IT service providers, professional advisers, insurers, regulators or law-enforcement bodies where reasonably necessary and legally permitted or required. If a business sale or restructure is proposed, any disclosure must be limited to what is necessary, subject to appropriate confidentiality and privacy safeguards and any notice or consent required by law.
Payment providers, banks and some advertising services may have independent legal responsibilities and their own privacy notices. Links to those notices explain their practices; they do not remove Udio's responsibilities for its own conduct. Customer-appointed integrations or a provider's own exports are also subject to that provider's instructions and notices.
9. Hosting and overseas handling
Udio's Australian production environments are hosted in the AWS Sydney region. Its US production environment is hosted in AWS US East Northern Virginia (us-east-1). Udio's Snowflake warehouse and self-hosted analytics environment are hosted in Australia. The country of a business customer does not, by itself, establish the hosting location of its account. Customers can ask us to confirm their account's deployment.
Support, email, AI, payment, messaging and marketing services may store or process information outside the primary application region. We have not selected Australia-only or other dedicated regional residency for Help Scout, Google Workspace, Sentry or ChatGPT Work. Application hosting in Australia therefore does not mean that all information remains in Australia.
The United States is a principal overseas location for these external services. Provider-published processing and support locations also include the United Kingdom, Canada, Singapore, India, Japan and Colombia, and European countries including Ireland, Germany, the Netherlands, France, Belgium, Sweden, Spain, Greece and Romania. Globally distributed email, network, support and telecommunications services can involve additional countries, including the destination countries of messages. Not every service uses every listed location. It is not practicable to list every changing network or support location here; the provider disclosures linked below give more specific country information, and you may ask us about the services relevant to your information.
Udio staff are based in Perth, Western Australia, and ordinarily access work systems from there. Authorised access while travelling outside Australia may occur subject to approved authentication, access restrictions and security controls. That does not authorise unrestricted overseas access.
We apply proportionate contractual, confidentiality, security and access safeguards to overseas handling and take the steps required by applicable law. Where a transfer requires an adequacy decision, contractual transfer safeguards or another lawful mechanism, that requirement must be met. You may request information about relevant safeguards, including a copy where legally available with confidential material redacted. We do not treat use of Udio as consent to waive overseas-transfer protections. Information held overseas may be subject to lawful access by authorities in the relevant country.
Further provider information
- AWS processing locations
- Adyen processing providers
- Twilio processing providers
- Google Workspace processing providers
- Help Scout processing providers
- HubSpot processing providers
- Mailchimp processing providers
- ChatGPT Work privacy and retention information
Our Data Processing and Security Schedule identifies the subprocessors authorised for customer-account processing. We maintain that information and give contractual notice of material new subprocessors as required by the customer agreement. Marketing tools used for Udio's own business-contact processing are not automatically authorised to receive participant account records.
10. Security and incidents
We use reasonable technical and organisational safeguards proportionate to the information and risk. These include encryption in transit and at rest using provider-supported controls, role-appropriate access, multi-factor authentication for privileged access, customer-account separation, logging, monitored backups, controlled changes and incident-response procedures. We restrict access to people with a legitimate need and confidentiality obligations. No system can guarantee that every security incident will be prevented.
We assess suspected breaches, take steps to contain and remedy them, and notify affected customers, individuals and regulators where required by law or contract. Legal notification requirements are not limited by our ordinary support hours. If you suspect an account compromise, contact security@udiosystems.com or the normal support channel promptly.
11. Retention and deletion
We retain personal information only while reasonably needed for the purposes described here, including service delivery, security, lawful recordkeeping and handling claims. Retention depends on the type of record, account status, provider instructions, applicable legal duties and any dispute or preservation requirement. We delete or appropriately de-identify information that is no longer needed and is not required to be retained.
While a business remains a customer, it determines appropriate participant-retention choices through available settings or authorised instructions, subject to applicable law and any published maximum. Records are not automatically retained forever merely because a provider wants historical statistics; genuinely de-identified statistics may be kept without retaining unnecessary identifiers.
When a business customer's service ends, authorised users ordinarily retain account access for a 30-day transition period to complete an orderly transition and obtain exports, subject to the customer agreement. After that period, ordinary access is disabled and customer personal information and content are deleted or robustly de-identified from active systems within the following 30 days, unless lawful retention applies. Trial information is deleted or de-identified from active systems within 30 days after a trial ends if the customer does not subscribe.
Financial, invoice, transaction, security, audit, dispute and legal records may need to be kept longer for the applicable legal or operational period. We minimise retained personal information where practicable. Business-contact records are retained while there is a relevant relationship or other lawful need; minimal opt-out records may remain to prevent unwanted contact.
Protected shared backups cannot ordinarily be edited to remove one person's information. Daily protected copies expire through a 14-day cycle and database point-in-time recovery data through a 28-day cycle after removal from active systems. Backups are not available for ordinary use and are accessed only for recovery, security investigation or legal compliance. If restored, applicable deletion and de-identification steps are reapplied before ordinary use.
Support records, emails, AI conversations, files and provider-managed copies have separate retention and deletion controls. Deleting a production record alone does not remove those copies. We apply the same necessity and lawful-retention principles, carry out separate deletion steps where required, and account for applicable provider backup cycles and legal exceptions. The 14-day and 28-day production backup cycles are not a promise that every external provider deletes all records within those periods.
12. Access correction and other rights
You can ask for access to or correction of personal information Udio holds about you. Depending on the law and circumstances, you may also have rights to deletion, restriction, a portable copy, withdrawal of consent, objection to processing or direct marketing, or an opt-out of targeted advertising, sale or sharing. Some rights have legal exceptions, and deletion may not be available for records that must be retained.
If your request concerns records held for a provider, contacting that provider first will often be the quickest approach. You can also contact privacy@udiosystems.com. We will identify our responsibilities and coordinate with the provider where appropriate; we will not simply refuse to consider a request because the information is in a customer's account. A parent's or guardian's request may require verification of authority and consideration of the child's rights and interests.
We may reasonably verify identity, authority and the scope of the request without collecting more information than necessary. We aim to acknowledge requests within five business days and provide a substantive response within 30 calendar days, or sooner where law requires. If a lawful extension is needed, we explain the reason and expected response time within the applicable deadline. These targets do not extend a mandatory deadline.
We do not charge for making a request, seeking correction or complaining. Any fee for providing access must be permitted by applicable law, not excessive, and explained in advance. We explain any refusal and available complaint options in writing. Where required, we can associate a statement of disputed accuracy with a record or notify relevant recipients of a correction.
13. Privacy complaints
Send a privacy complaint to our Privacy Officer using the contact details below. Please describe what happened, the account or interaction involved and the outcome you seek, without including unnecessary sensitive information. We will acknowledge the complaint within five business days, assess and investigate it fairly, and aim to provide a substantive response within 30 calendar days. We explain any delay and comply with shorter legal deadlines where applicable.
If you are not satisfied, or applicable law allows you to complain directly, you may contact the relevant privacy regulator. In Australia, this is the Office of the Australian Information Commissioner at www.oaic.gov.au. Depending on the matter and your location, you may also have rights to complain to your local regulator, including the New Zealand Privacy Commissioner, Singapore Personal Data Protection Commission, UK Information Commissioner's Office, Swiss Federal Data Protection and Information Commissioner, South African Information Regulator, Senegalese data protection authority, Canadian federal or provincial privacy regulator, or the relevant US state authority. We can help identify the appropriate contact. You do not lose a regulatory complaint right by contacting us first.
14. Changes and contact
We update this Policy when our practices or legal requirements change and publish the current version at www.udiosystems.com/privacy with its version date. For material changes, we provide additional notice appropriate to the change and any applicable legal or contractual requirement. If a new purpose requires consent, publishing a revised Policy does not replace that consent.
Privacy Officer
Udio WA Pty Ltd ABN 38 166 661 945
Unit 8, 22 Railway Road
Subiaco WA 6008, Australia
- Privacy enquiries requests and complaints: privacy@udiosystems.com
- Security reports: security@udiosystems.com
You may request a copy of this Policy free of charge or ask for assistance accessing it in another appropriate format.