21 — Screen-Owner Privacy Notice

Effective Date: 14 September 2026 Controller: OOHAi Media Pty Ltd as trustee for the OOHAi Media Unit Trust ("OOHAi Media", "we", "us", "our"). Governing law: Western Australia, Australia. Defined terms: Capitalised terms not defined in this document have the meaning given in 00 — Definitions.

This notice is for Screen Owners — people and businesses who put a screen on the OOHAi network using the OOHAi Companion app or the OOHAi advertiser portal. It explains, in plain terms, what we collect about you, your team and your screens, what your screen collects about the people near it, who receives that information, how long we keep it, and the choices you have.

It adds to the Privacy Policy, which applies to everything we do with Personal Information. Where this notice is silent, the Privacy Policy governs. It does not replace the Computer Vision Privacy Disclosure, which describes what the screen's camera does and is referred to below rather than repeated.

---

1. What we collect about you and your teamCopy link

What	Examples	When
Account	Your name, email address, phone number (optional), and a password we store only in hashed form; the one-time login codes we send you	When you create your account and sign in
Business	Company name, industry, website, billing email, billing phone and billing address	When you fill in your business details
Tax	Your ABN, whether you are registered for GST, and whether you have accepted the RCTI Agreement	When you fill in your tax profile
Team	The name, email address and role of each person you invite	When you invite someone
Payouts	The identifier of your Stripe payout account and whether its setup is complete. Your bank details are collected and held by Stripe, not by us	When you set up payouts
Earnings	A record for every counted play on your screens: the screen, the advertisement, the amount, the share percentage in force, and whether it has been paid	Whenever a network advertisement plays on your screen
Content	The images and videos you upload, with their file name, type, size, dimensions and duration	When you upload content
Acceptances	The version of each platform legal document you accepted, when, from which network address and device, and any withdrawal	When you sign up, claim a screen, or change your consent
Support	The subject and text of any support ticket you raise	When you contact support
Settings	Your language, country, currency and time zone	When you change them

On your phone. The app keeps these things on the phone itself: your sign-in token, a device fingerprint and your quick-unlock state, all in the phone's secure key store; a copy of the last screens, insights, content and earnings figures the app fetched, so the app opens instantly — kept in ordinary app storage for up to 24 hours and discarded on every app update; whether you have read the audience-sensing notice and what you decided; your language preference; and the last app version you ran.

Crash reports. The app can send crash and performance reports to Sentry, our error-monitoring provider. A report includes the device model, operating system and app version, the network address Sentry records, and a short trail of what the app was doing when it failed. See clause 6 of the Privacy Policy.

Phone permissions. The app asks for permissions only for the purpose stated, and works with reduced features if you refuse:

• Camera — to scan the QR code on a screen during setup and claiming. You can type the code instead.
• Bluetooth — to connect to a brand-new screen and send it your Wi-Fi details during setup. The Wi-Fi password goes from your phone to the screen and is never sent to us. We record the steps of the setup (scanning, choosing a network, joining, result) so we can see where setup fails.
• Location — the app does not use your phone's location and does not collect or store it. On Android 11 and older, the operating system requires a location permission before an app can scan for a new screen over Bluetooth; the app asks for it only then and uses it only for that.
• Photos — only the images and videos you choose to upload.
• Face ID / fingerprint — only to unlock the app quickly, on your phone. We never receive biometric data.

2. What we collect about your screensCopy link

For each screen you claim we hold:

• its hardware identifier, model, screen size and resolution;
• its operating-system version, player-app version, free and total storage and memory, last reboot time, and when it last reported in;
• whether it is online and whether it is playing;
• the address, coordinates, place identifier and venue type you chose for it, and its orientation;
• the settings you chose — network ads on or off, blocked categories and brands, audience sensing on or off, proximity sensing on or off;
• a record of what it played (which advertisement, when, for how long), which is how your earnings are counted;
• the audience measurement records described in the Computer Vision Privacy Disclosure, if audience sensing is on. For a fixed screen, the "precise location" in those records is the venue location you set;
• the proximity records described in clause 3, if proximity sensing is on;
• the commands you send it (identify, re-sync, restart) and every change made to it, in an audit log.

Live checks. When you tap Read the room or Sense the room in the app, the screen sends a short live snapshot so the app can show it to you: a headcount, a coarse age and gender estimate, an attention figure, and a count of nearby Wi-Fi and Bluetooth devices. The snapshot never includes an image or a device address.

3. What your screen collects about people near itCopy link

Audience sensing (the camera). If you turn audience sensing on, the screen's camera counts the people in front of it and estimates coarse age and gender bands and whether they are looking at the screen. All of that happens on the screen. No image, video or face template ever leaves it. The system does not estimate emotion or mood. One record per advertisement played is sent to us — the screen's location, the time, an estimated headcount, the dominant age and gender band, and attention figures. That record, what it is used for, who can see it, and how long it is kept are set out in the Computer Vision Privacy Disclosure, which applies to your screen exactly as it applies to every other OOHAi screen.

Proximity sensing (Wi-Fi and Bluetooth). If you turn proximity sensing on, the screen periodically estimates how busy its surroundings are from nearby Wi-Fi and Bluetooth signals. What leaves the screen is only a density band — sparse, moderate or dense — for each of Wi-Fi and Bluetooth, a movement band, a coarse map cell about a kilometre across, whether the screen was in a trip, and a time. No device address, no signal strength and no count of individual devices is kept or sent. In-vehicle screens never run proximity sensing.

Advertisers. Advertisers never see records about your screen individually. They see aggregate reports with small samples suppressed, as clause 9.1 of the Computer Vision Privacy Disclosure describes.

4. Why we use itCopy link

We use the information above to:

• run your workspace and your screens — set them up, deliver content to them, show you their health;
• count what played and work out, show and pay your earnings, including GST and any tax document;
• keep records of your acceptances, your settings and the changes made to your screens;
• answer your support requests;
• detect fraud, tampering and misuse, and keep the network secure;
• fix crashes and improve the app; and
• meet our legal obligations, including tax and record-keeping.

We do not sell your information. We do not use it to build a behavioural profile of you outside the network. The app carries no third-party advertising network.

5. Who receives itCopy link

Besides our own systems, hosted by Amazon Web Services in Sydney, the recipients specific to Screen Owners are:

Recipient	What	Why	Where
Stripe	Your payout-account identifier; your bank details, which Stripe collects directly	Payouts	Australia / United States
Google Maps Platform	The address you type or choose for a screen, and map tiles	Finding and showing your screens' locations	United States
Cloudflare	The images and videos you upload	Storing and delivering your content	Cloudflare's global network
Sentry	Crash and performance reports from the app	Error monitoring	United States

The full list of recipients, and how we handle disclosures outside Australia, is in clauses 6 and 7 of the Privacy Policy.

Your team. Everyone you invite to your workspace can see what their role allows — your screens, their earnings and their audience insights. We do not separate one team member's view from another's beyond those roles.

6. How long we keep itCopy link

What	How long
Your account, business, tax, team and screen records	While your account is open. When your account is deleted (clause 7), these are removed except the records listed below that we must keep
Earnings, payout, RCTI and credit-note records	7 years, as financial records
Acceptance and withdrawal records	Kept as an append-only history; audit records are kept for 7 years
Content you upload	While it is in your library; content is kept for 90 days after your account closes, then deleted unless a legal hold applies
Per-play audience measurement records	As set out in the retention table of the Computer Vision Privacy Disclosure — a 25-month target that is not yet enforced by an automated purge

7. Your choices and rightsCopy link

Sensing. You can turn audience sensing and proximity sensing on or off for each screen at any time in the app.

Permissions. You can revoke any phone permission in your phone's settings at any time. The app keeps working with reduced features.

Access, correction and export. You can correct most account details in the app. To get a copy of the information we hold about your account and your consent history, email privacy@oohai.com.au — there is no download button today. For anything else, write to the same address; we respond within 30 days.

Withdrawing consent. To withdraw your consent to the Screen-Owner Terms or the Privacy Policy, email privacy@oohai.com.au. Your workspace is then suspended for review: no new campaigns, claims or uploads until the withdrawal is reversed by accepting the terms again. Your data stays available to you on request while the suspension lasts.

Deleting your account. Use Delete account in the app. Today that raises a request that our support team processes for you; a person completes the deletion. You can also lodge an erasure request in the advertiser portal; it is recorded immediately and completed by a person. Financial and tax records are kept for the periods in clause 6 even after your account is deleted.

Removing a screen. Removing a screen in the app returns it to the unclaimed state and revokes its credentials. Records of what it played while it was yours are kept as part of your earnings history.

8. SecurityCopy link

Your sign-in token is stored in your phone's hardware-backed key store. The app talks to us only over encrypted connections. The measures we apply to the information we hold are set out in clause 10 of the Privacy Policy.

9. ComplaintsCopy link

If you think we have mishandled your information, write to privacy@oohai.com.au, or follow the Complaints Handling Procedure. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

10. Changes to this noticeCopy link

We may update this notice. A change that materially affects your rights is notified to the workspace owner by email at least 14 days before it takes effect. Every version is published on this page with its effective date.

11. Related documentsCopy link

• Screen-Owner Terms
• Privacy Policy
• Computer Vision Privacy Disclosure
• Complaints Handling Procedure
• Data Breach Response Plan
• Definitions

---

End of Screen-Owner Privacy Notice.