MIZAN — PRIVACY POLICY

1. INFORMATION WE MAY COLLECT

Depending on the features you use, Mizan may process or collect:

• information you enter into Mizan;
• broad finance category or intent;
• information you voluntarily provide when contacting us;
• correction requests;
• technical information such as IP address, browser/device information and security logs;
• aggregate usage information; and
• communications you send to us.

We do not intentionally require users to identify their religion simply because they use an Islamic-finance platform.

Where possible, Mizan is designed to allow users to explore information without creating an account or identifying themselves.

2. CONVERSATION INFORMATION

Mizan's conversational interface may process information you enter in order to understand your request and provide relevant educational or factual information.

Where the current product states that raw conversation content remains within your browser tab, we will operate consistently with that representation.

Structured information may be transmitted to Mizan infrastructure where required to provide a feature.

We do not use raw financial conversations for advertising profiles.

Users should avoid entering unnecessary sensitive information, passwords, account numbers or identity documents into conversational fields.

3. SENSITIVE INFORMATION

Information about religious beliefs can constitute sensitive information under Australian privacy law.

Mizan does not infer that a person holds a particular religious belief merely because they visit or use Mizan.

We aim not to collect sensitive information unless it is reasonably necessary for a legitimate function and permitted by applicable law.

4. WHY WE COLLECT INFORMATION

We may handle information to:

• operate Mizan;
• respond to requests;
• provide educational and factual information;
• understand broad categories of user demand;
• maintain and improve the platform;
• investigate errors;
• review corrections;
• maintain security;
• prevent abuse or fraud;
• comply with legal obligations; and
• communicate with users who contact us.

We will not silently convert use of Mizan into consent to send a user's information to a finance provider.

5. REFERRAL INFORMATION

If Mizan introduces referral functionality in the future, we intend to clearly identify:

• that information will be shared;
• the provider receiving it;
• the information being shared;
• the purpose of the referral; and
• any relevant commercial relationship.

Where consent is required, it will be obtained at the relevant point.

Using Mizan does not automatically constitute consent for Mizan to distribute your information to financial providers.

6. ANALYTICS

Mizan may collect privacy-conscious aggregate analytics, such as:

• page views;
• broad category interest;
• conversation starts;
• provider profile views;
• educational content usage; and
• outbound provider-link interactions.

We aim not to send raw conversation text, names, email addresses, telephone numbers, income, deposits, finance amounts, account numbers or other sensitive financial information to third-party analytics systems.

7. HOW INFORMATION IS HELD

Mizan currently uses technology infrastructure that may include Cloudflare and Supabase.

We use technical and organisational measures intended to protect information against misuse, interference, loss and unauthorised access, modification or disclosure.

No internet or information system is completely secure, and we do not represent that security is absolute.

8. OVERSEAS PROCESSING AND DISCLOSURE

Some technology providers may process information using infrastructure located outside Australia.

Where Mizan is likely to disclose personal information to overseas recipients, we will take applicable privacy obligations into account and update this policy to identify countries where practicable.

We will not state that information remains exclusively in Australia unless we have established that technically.

9. DISCLOSURE

We may disclose personal information where reasonably necessary to:

• service providers supporting Mizan;
• professional advisers;
• regulators or authorities where required or authorised by law;
• protect Mizan, users or others from unlawful activity; or
• a finance provider where the user has expressly requested or authorised an introduction and the feature is lawfully enabled.

We do not sell personal information to data brokers.

10. DIRECT MARKETING

If Mizan introduces direct marketing, we will operate appropriate consent, identification and unsubscribe mechanisms as required by applicable law.

Using Mizan does not automatically subscribe a person to marketing communications.

11. CORRECTIONS AND PROVIDER-INFORMATION UPDATES

If you submit a correction or update, we may collect your contact information and the information necessary to investigate it.

Submitting a correction does not cause information to be automatically published.

Corrections may be reviewed against independent evidence before Mizan changes provider information.

12. RETENTION

We aim to retain personal information only for as long as reasonably required for the purpose for which it was collected, legal obligations, security or dispute management.

Where information is no longer required and applicable law permits, we may delete or de-identify it.

13. ACCESS AND CORRECTION

You may contact us to request access to personal information we hold about you or to request correction.

Email: info@mizan.au

We may need to verify your identity before providing access to personal information.

14. PRIVACY COMPLAINTS

If you believe Mizan has mishandled your personal information, contact:

Privacy Contact — Mizan info@mizan.au

Please describe your concern and provide enough information for us to investigate it.

We will assess privacy complaints and respond as appropriate.

You may also have the right to contact the Office of the Australian Information Commissioner.

15. COLLECTION NOTICES

Where Mizan begins collecting personal information through a particular feature, such as referrals or correction submissions, we may provide a shorter collection notice at the point of collection explaining the relevant purpose and disclosures.

16. AUTOMATED SYSTEMS

Mizan uses software to help users navigate information.

We aim to design automated functionality so that conversational systems do not independently invent authoritative provider/product information or make financial decisions for users.

As Mizan's functionality evolves, this policy will be updated to reflect material changes in how personal information is used by automated systems.

17. CHANGES TO THIS POLICY

We may update this Privacy Policy as Mizan evolves or legal requirements change.

The current version and effective date will be available on mizan.au.

18. CONTACT

A E GLOBAL CAPITAL INVESTMENTS PTY LTD Trading as Mizan Australia

Email: info@mizan.au

19. Optional accounts, sessions and saved information

You may explore Mizan, use Just Ask Mizan, read educational content and view the provider directory and sources without registering. Accounts are optional and provide saved providers, saved educational resources and basic user-controlled preferences.

Supabase Auth processes account email addresses, password authentication information, verification and recovery requests, session information and authentication/security events. Mizan does not duplicate your password in an application profile. Authentication requests pass through Mizan’s server to Supabase. Resend delivers verification and password-recovery emails. These providers may process information outside Australia; Mizan does not promise Australia-only processing.

We use essential session cookies to keep you signed in. These cookies are not advertising cookies. Session credentials are managed by Mizan’s server rather than stored in browser localStorage. You can sign out through account settings. Expiring or revoked sessions may require you to sign in again.

Your account stores identifiers for items you deliberately save, the time they were saved and a compact-view preference. We do not infer religious belief from use of Mizan or from saved items. We do not create a detailed financial profile. Accounts and saved items do not influence provider ordering or generate personalised financial-product recommendations.

Signing in does not automatically save raw conversation text. Current conversations remain in browser memory and are cleared on reload. Conversation saving is disabled. If offered later, saving would require an explicit action and a clear explanation. Fixed aggregate usage labels are transmitted automatically unless the browser signals Do Not Track. Account forms and save actions send the specific information needed for those functions.

An authenticated deletion request records your user identifier, request date and processing status in a private queue. No financial details or explanation are required. You can also contact info@mizan.au. We aim to respond within 30 days; deletion is reviewed and is not instantaneous. Processing normally removes your authentication account, saved items, preferences and the request row. Limited records may need to be retained for law, security or disputes. Backups expire under the infrastructure retention cycle and may not be erased immediately.

Mizan collects aggregate event counts using fixed categories, topics and public page/provider identifiers. Raw text, financial amounts and account identifiers are excluded. Daily aggregates older than 180 calendar days are removed by a daily retention job and are not unique-person measurements. Four historical aggregate event records remain separately; these are counts, not four identified users. We do not send account emails, user IDs, saved-item histories, raw conversations or financial information to third-party analytics. Structured corrections, referrals and lead sharing remain disabled. Corrections are initially handled by email.