Privacy & data retention policy
How we collect, use, store and dispose of personal information — including everything that passes through our web forms and AI agents.
This policy outlines the ongoing obligations of Tall Order (Skalata Ventures Pty Ltd) to you in respect of how we manage your Personal Information.
We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). The APPs govern the way we collect, use, disclose, store, secure and dispose of your Personal Information. A copy of the Australian Privacy Principles is available from the Office of the Australian Information Commissioner at oaic.gov.au.
This policy applies to anyone whose information passes through our systems — people who submit information through our web forms, founders and team members whose information passes through our AI agents, investors and potential investors in our Venture Capital Funds (the Funds), and visitors to our website.
What is Personal Information and why do we collect it?
Personal Information is information or an opinion about an individual, or an individual who is reasonably identifiable. Examples we collect include names, addresses, email addresses and phone numbers of people who submit through our web forms, founders submitting through our AI agents, investors in our Funds, and people who contact us directly.
We may collect Personal Information from you through:
- Online contact and submission forms
- Our AI agents (conversation, uploaded materials, public profile data)
- Emails, letters, phone conversations and meetings
We collect Personal Information for the primary purposes of:
- Assessing submissions made through our web forms and AI agents
- Running our AI agents’ preliminary screening of pitches
- Assessing applications from investors and potential investors in our Funds
- Providing information and services in relation to our Funds
- Administrative, reporting, planning and marketing (including direct marketing) purposes
We may also use and disclose your Personal Information for secondary purposes closely related to the primary purposes, in circumstances where you would reasonably expect such use or disclosure.
We may send you direct marketing communications about our products and services that we consider may be of interest to you. You may unsubscribe at any time by contacting us in writing.
Our AI agents — what we collect and why
There are two ways to submit information to us: a conversation with our chatbot, or the pitch form, through which you can send us your deck. Both are processed by the same analysis pipeline and handled in the same way from that point on. This policy applies to both.
Between the two, we collect:
- What you tell us in conversation — answers to our questions, and anything you share about your company, team, market, traction and fundraising.
- Your pitch deck if you upload one (PDF or Markdown).
- Content from your company website — we read key pages so you don’t have to repeat what is already public.
- Public LinkedIn profile information for you and the team members you name — used to understand backgrounds, not to infer business facts.
- Publicly available information from the web — our agents search public sources for information about you, the team members you name and your company: news and media coverage, company and business registers, industry and professional listings, and other openly published material. We collect only what is already public, and we do not attempt to access anything behind a login or paywall.
- Your email address — used to identify your session and let you resume within a defined window.
- Technical data — IP address, session timestamps, device type. Used to prevent abuse, rate-limit, detect bots and debug.
We use this information to understand your company and whether it is a potential fit, run an automated preliminary assessment, route your submission to the right team member, keep our agents secure, and improve how the agents work.
Service providers (sub-processors)
We use a small number of third-party service providers to operate our systems. Each operates under their own contractual terms with us, and we have selected them on the basis that their security and data-handling practices are commensurate with the sensitivity of the information they handle.
| Provider | Purpose | Location |
|---|---|---|
| OpenRouter | Routes our calls to the range of AI models we use, including but not limited to models from Anthropic, OpenAI and Google | United States |
| Firecrawl | Parses your pitch deck and website, and retrieves public web pages we research | United States |
| Renidly | Retrieves public LinkedIn profile data | United States |
| Supabase | Database and file storage | Singapore and Australia |
| Attio | Our CRM — holds the record of your submission and our contact with you | Ireland |
| Notion | Internal notes and working documents about your company | United States |
| Box | Document storage, including your deck and files you send us | United States |
| Cloudflare | Bot protection (Turnstile) | United States |
Cross-border disclosure (APP 8)
Several of our service providers are based overseas, primarily in the United States, and one in Ireland. By using our services, you consent to your information being transferred to and processed in jurisdictions outside Australia. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs.
Model training
Your conversations with our AI agents, and any artifacts collected through them, are not used to train any AI model — not the models we route to, and not one of our own. We do not build or train models. The commercial API terms of the model providers we route to exclude customer data from model training by default, we do not opt into any training programs, and we do not sell or share your information with anyone training a model of theirs.
How we improve the agents
We use submissions to improve the operation of our agents. Where an agent produces an incorrect or inadequate result, we review that case and amend the instructions, investment criteria and scoring rubrics behind it. We also index submissions as comparables, so that a later submission can be assessed against companies we have previously seen. This processing takes place within our own systems.
That work is done by people, not automatically: someone here opens the session — the transcript, the deck, the research the agents pulled and the memo they drafted — and edits what sits behind them. It happens inside our own systems, and nothing is sent to a model provider for the purpose.
Third parties
Where reasonable and practicable, we collect your Personal Information only from you. In some circumstances we may be provided with information by third parties — including, in the case of our AI agents, public LinkedIn profiles and other publicly available information about the company and the team members named by the founder.
Disclosure of Personal Information
- To our employees, officers, advisors, suppliers, service providers or contractors in connection with the primary purpose of collection
- To other third parties where you consent to such disclosure
- Where required or authorised by law (including to LaunchVic, Innovation and Science Australia, and other government agencies)
Cookies and analytics
We use cookies and similar technologies on this site. Some are necessary for it to function, such as remembering a banner you have dismissed or protecting our forms from spam. Others help us understand how the site is used, and may be set by third-party analytics, measurement or advertising providers on our behalf.
These technologies may collect information including your IP address, device and browser type, the pages you view, the site you arrived from and how you interact with our pages. Third-party providers may combine that information with data they hold from other websites and use it for analytics, measurement, retargeting or advertising.
Most browsers allow you to refuse or delete cookies through their settings, and some third-party providers offer their own opt-out mechanisms. Disabling cookies may affect how parts of this site work.
Security of Personal Information
Your Personal Information is stored in a manner that reasonably protects it from misuse and loss and from unauthorised access, modification or disclosure. We use encryption in transit and at rest, access controls, and regular review of our service providers.
No system is completely secure. If a breach affecting your information occurs, we will notify you and the Office of the Australian Information Commissioner in line with Australia’s Notifiable Data Breaches scheme.
How long we keep your information
We keep your information only for as long as it is needed for the purposes for which it was collected.
Whether you used the chatbot or the pitch form, we hold your conversation or submission, your deck, the research our agents gathered in connection with it, and our assessment of it. That record sits in our CRM and internal systems, and we keep it: it is the record of who we looked at and what we decided, and it is one of the comparables a later submission gets read against.
We may reconsider a company we have previously declined. Retaining the earlier submission allows us to assess a later one against it and to identify what has changed in the intervening period. This is one of the purposes for which we hold the information.
Some of it we have to keep. Where we have been in direct contact with you about an investment, the correspondence and the file that goes with it are business records, and Australian record-keeping obligations set a minimum period we cannot delete inside — see below.
Other personal information
Most other Personal Information is or will be stored in client files, which we keep for a minimum of seven years to comply with Australian record-keeping obligations.
Portfolio companies
If you become a portfolio company, longer retention applies under separate portfolio agreements, which supersede this policy for your company.
When your Personal Information is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify it.
Your rights
- Access your information (APP 12) — email privacy@tallorder.vc and we will send a copy within 30 days, free of charge.
- Correct your information (APP 13) — during a conversation with one of our AI agents, edit extracted facts directly in the memory sidebar. Afterwards, or for any other Personal Information we hold, email privacy@tallorder.vc. If we do not agree the information is wrong, we will tell you why in writing, and on request we will attach a note to the record saying you dispute it.
- Delete your information — email privacy@tallorder.vc. Within 30 days we will delete your conversation, your deck and the material our agents derived from them. We do not delete the record of your company held in our CRM, for the reasons set out under retention above. On request we will tell you what that record contains. Australian privacy law gives you the right to request access to and correction of your information; it does not give a general right to erasure, and deletion is offered here to the extent described.
- Complain — email privacy@tallorder.vc first so we can try to fix it. If we cannot resolve things, you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.
We may require identification from you before releasing or acting on a request.
Changes to this policy
This policy may change from time to time, and the current version is published on this page. The version in force when you submitted information to us is recorded against that submission and continues to govern how we handle it.
Contact
For anything in this policy: privacy@tallorder.vc
For general enquiries: info@tallorder.vc
Tall Order (Skalata Ventures Pty Ltd)
237 Toorak Rd
South Yarra
Melbourne VIC 3141
Australia