Effective date: 1 July 2026
Umango is committed to protecting your privacy and handling personal information responsibly.
This Privacy Policy explains how Umango Pty Ltd, trading as Umango (“Umango”, “we”, “us” or “our”), collects, holds, uses and discloses personal information in connection with:
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, where they apply.
The types of personal information we may collect depend on how you interact with us and may include:
We generally do not require sensitive information. However, documents processed using Umango may contain sensitive information selected or supplied by a customer. In those circumstances, the customer is responsible for ensuring that it has authority to collect and process that information.
Umango enables customers to capture, scan, upload, classify, extract, route and process documents and related information.
Where we host or support an Umango environment, we may process information contained in customer documents on the customer’s behalf. Depending on the customer’s use of the service, this information could include names, addresses, contact details, financial information, identification numbers, employment information, health information or other sensitive content.
For customer-controlled content:
A customer’s own privacy policy may also apply to information processed using Umango.
We may collect personal information:
Where practical, you may interact with us anonymously or using a pseudonym. However, we may be unable to provide accounts, licences, support, subscriptions or other services without sufficient identifying information.
We may collect, hold, use and disclose personal information to:
We may also aggregate or de-identify information so that it no longer reasonably identifies an individual. We may use and disclose aggregated or de-identified information for analytics, reporting, service planning and product improvement.
Certain Umango licences and services may transmit licensing and usage information to Umango-operated or authorised systems.
This information may include:
We use this information to administer licences, calculate consumption, provide subscription services, prevent misuse and support customers.
Unless required for a particular hosted function, licensing reports are not intended to include the contents of documents processed by the customer.
Some Umango features may use artificial intelligence, optical character recognition, document analysis, language models or similar technologies provided by Umango or third-party service providers.
Depending on the configuration selected by the customer, document content or extracted information may be transmitted to a configured AI, OCR or cloud-processing provider.
Customers are responsible for:
Where Umango selects a third-party provider as part of an Umango-hosted service, we take reasonable steps to assess the provider and limit its processing to the purposes required to deliver the service.
We do not use customer document content to train publicly available generative AI models unless this has been expressly agreed with the customer.
We may disclose personal information to:
We require service providers to handle information only for authorised purposes and to provide appropriate confidentiality and security protections.
We do not sell personal information to data brokers.
Umango operates internationally and may use service providers located outside Australia.
Depending on the service, customer configuration and providers selected, personal information may be stored in or accessible from countries including United States of America, Germany, Canada, Australia, United Kingdom.
Cloud-region choices may be available for some services. Customers should review their service order, hosting configuration and any applicable data-processing terms for more specific information.
Where Australian privacy law applies, we take reasonable steps to ensure overseas recipients handle personal information consistently with applicable privacy obligations.
Our websites may use cookies and similar technologies to:
Some cookies may be provided by third-party analytics, advertising or communications services.
You can control cookies through your browser settings and, where available, our cookie-preference controls. Blocking certain cookies may affect website functionality.
Where tracking technologies are used for targeted marketing, we provide an appropriate method to manage or opt out of non-essential tracking.
We may use your business contact information to send you information about Umango products, services, events, updates and offers that we believe may be relevant to you.
You can opt out at any time by:
We may continue to send non-promotional communications that are necessary for an existing account, licence, subscription, transaction, security matter or service relationship.
We do not use sensitive information for direct marketing without the consent required by law.
We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
Depending on the service and deployment, these measures may include:
No system or method of transmission is completely secure. Customers are also responsible for maintaining the security of their own accounts, devices, networks, credentials and on-premises deployments.
Please notify us promptly if you believe an Umango account or service may have been accessed without authorisation.
We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to:
Retention periods may vary according to the type of information, the service configuration and the customer’s contract.
Where we process document content on behalf of a customer, retention and deletion may be controlled by the customer’s configuration or agreement with us. Backup copies may remain for a limited period before being overwritten or securely deleted.
When information is no longer required, we take reasonable steps to delete it, destroy it or permanently de-identify it, unless retention is required or authorised by law.
We maintain procedures for identifying, assessing and responding to suspected data breaches.
Where a breach is likely to result in serious harm and notification is required under the Australian Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner as required by law.
Where we process information on behalf of a customer, we will also cooperate with the customer in responding to relevant security incidents in accordance with our contractual obligations.
You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.
To make a request, contact our Privacy Officer using the details below. We may need to verify your identity before processing the request.
In some circumstances, the law permits or requires us to refuse access or correction. If this occurs, we will generally explain the reason and the available complaint process.
For information contained in documents controlled by an Umango customer, you should contact that customer directly. We may refer your request to the relevant customer where appropriate.
Where the European Union General Data Protection Regulation or United Kingdom data-protection law applies, you may have additional rights, including rights to:
Depending on the circumstances, we process personal data because it is necessary to perform a contract, comply with a legal obligation, pursue legitimate business interests or because you have provided consent.
Where Umango processes customer document content solely on behalf of a customer, the customer will generally be the controller and Umango will act as its processor or service provider.
Our products and websites are designed for businesses and organisations and are not directed to children.
We do not knowingly collect personal information directly from children for marketing or account-registration purposes. Documents processed by a customer may nevertheless contain information about children. In that situation, the customer is responsible for ensuring that the processing is lawful and appropriate.
Our websites and services may contain links to, or integrate with, third-party websites, platforms and applications.
Those third parties operate under their own privacy practices and terms. We are not responsible for their handling of personal information except to the extent required by applicable law.
You should review the privacy policies of any third-party service before providing information to it or enabling an integration.
You may contact us if you have a concern or complaint about how we have handled personal information.
Please provide enough information for us to understand and investigate the matter. We will acknowledge and respond to complaints within a reasonable period.
If you are not satisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner or another relevant privacy regulator.
We may update this Privacy Policy periodically to reflect changes to our services, business practices or legal obligations.
The current version will be published on our website with its effective date. Where changes are material, we may also provide notice through our website, services or direct communications.
For privacy enquiries, access or correction requests, or complaints, contact:
Privacy OfficerSpin up a Cloud trial in minutes, or talk to us about an on-premise / hybrid deployment through one of our reseller partners.