Privacy policy

1.1

This policy is given by AI-LAW PTY LTD, ACN 698 421 608, ABN 23 698 421 608, an Australian proprietary company limited by shares. The trading name AI-Law belongs to it. In the provisions below, the company is AI-LAW PTY LTD and you is whoever is reading.

1.2

The policy reaches three things and no fourth: the pages served at ailaw.im; correspondence passing through hello@ailaw.im; and the statutory records the company keeps in order to remain a company.

1.3

Two things are therefore kept apart throughout. The first is personal information the company holds for itself, chiefly correspondence, and every clause below governs it. The second is a practice's own documents, which the practice indexes and the practice controls; the company's duties towards that material are the undertakings at clause 3.3, and they bind through the written agreement clause 6 of the terms describes.

1.4

The company is not an incorporated legal practice, holds no Australian practising certificate, and does not engage in legal practice. This document records the company's own handling of personal information. It advises you about nothing of your own.

2.1

The governing instrument is the Privacy Act 1988 (Cth), and within it Schedule 1, which carries the thirteen Australian Privacy Principles. A reference below to APP 6, or to any other numeral, is a reference to the principle bearing that number in that Schedule.

2.2

Section 6D lifts the principles from most businesses whose annual turnover stays at or under $3 million. The company sits under that figure. It declines the exemption, and undertakes to answer requests and complaints as though Schedule 1 bound it in full.

2.3

Four further instruments bear on the subject matter and are treated as binding where they apply.

• Spam Act 2003 (Cth), on commercial electronic messages: consent, identification of the sender, a functioning unsubscribe facility.
• Do Not Call Register Act 2006 (Cth), on unsolicited telemarketing. The company places no calls.
• Australian Consumer Law, Schedule 2 to the Competition and Consumer Act 2010 (Cth), whose guarantees survive anything drafted here.
• Privacy and Other Legislation Amendment Act 2024 (Cth), which created a tort for serious invasion of privacy, provided for a code covering children, and imposed disclosure duties on certain automated decisions. Clauses 19, 20 and 22 take those up.

3.1

Everything within clause 1.2 is held for the company's own ends. The company fixes why each item arrives and what becomes of it afterwards, and answers for both.

3.2

Where software is supplied to a law practice, the positions invert. The practice chooses the documents indexed, the people entitled to search them, the life of the index and the hour of its destruction. The company acts on instruction.

3.3

• Instruction only. Documents furnished by a practice are processed to give that practice retrieval, and for no end of the company's own.
• Training prohibited. A client document will not train, tune, evaluate or improve any model, whether the model belongs to the company or to somebody else. The prohibition is flat, not a default that a settings page can invert.

Every such engagement rests on a written agreement naming where the data sits, who may reach it, what is logged, how long it survives and by what method it is destroyed. A practice is entitled to ask for that agreement, and to read it, before it hands over anything at all.

4.1

APP 3 permits solicited collection only where the material is reasonably necessary for a function or activity of the entity, by means both lawful and fair, and ordinarily from the individual concerned. At this company the principle operates as a ceiling rather than a licence. The two tables below are exhaustive.

4.4

Those logs are not read as a matter of routine, not exported, not joined to anything else and not made into a profile. They exist so that a provider can keep a service standing and look into abuse of it. No analytics package, tag manager, advertising pixel, session recorder or heat map runs on this site.

4.5

Sensitive information is not collected. The expression takes its meaning from section 6. No field anywhere in anything the company operates is designed to receive health information, biometric material, union membership, political or religious affiliation, sexual orientation or a criminal record, and none of it is asked for.

Should a message you send happen to carry such material, it is used for nothing beyond answering you, and clause 17 is available to you.

4.6

Corporate books, tax records, the domain registration and the accounts carry personal information about the people running the company. The Corporations Act 2001 (Cth) and the revenue statutes require them. They concern you not at all, and none of it is published here.

5.1

APP 5 requires notice, at or before collection or as soon afterwards as is practicable, of a specific list: the identity of the entity and how to reach it; that collection has occurred and in what circumstances; whether a law compels it; the purpose; what follows from withholding; the usual recipients; where the access, correction and complaint procedures are set out; and whether disclosure abroad is likely, naming the countries.

5.2

The obligation is therefore discharged in three places at once. This document, linked from the foot of every page including the page carrying the address. The contact page, which states before you write what a message does and does not set in motion. And the columns of the tables at 4.2 and 4.3, which carry purpose and consequence beside each item rather than in a paragraph elsewhere.

5.3

On the final matter, plainly: yes. What you send is likely to be reachable from outside Australia, because the mailbox and the hosting run on infrastructure that is not confined to this country. Clause 10 names the recipients and clause 11 states the basis. That table governs, and it is corrected when a provider moves rather than hedged with a phrase about trusted partners.

6.1

APP 2 entitles you to withhold your identity, or to adopt a pseudonym, unless dealing with you that way is impracticable or a law requires an identified individual.

Here the entitlement is real. Nothing on this site admits of signing in, so reading it identifies you to the company not at all. Write from a pseudonymous address, sign with any name; the message is answered on its merits. There is no verification step and no appetite for one.

6.2

The entitlement narrows in one place only. A request under clause 16 or clause 17 requires the company to be satisfied that you are the person the material concerns, since otherwise an access right becomes a disclosure risk borne by somebody else. Clause 16.2 states what that involves, and it does not involve identity documents.

7.1

APP 4 governs personal information received without solicitation. Within a reasonable period the entity must decide whether APP 3 would have permitted it to collect the material. If it would not have, and the material forms no part of a Commonwealth record, the entity must destroy or de-identify it as soon as practicable, so far as that is lawful and reasonable.

7.2

Such an attachment may be an executed agreement naming individuals, a client file, a matter reference, a witness statement, or material over which privilege subsists for a client who has never heard of this company. APP 3 would not have permitted its collection: it is necessary to no function here, there is no apparatus to put it through, and the sender frequently has no authority to hand it over. It is therefore destroyed.

7.3

1. The attachment is opened no further than a mail client opens it unbidden, and is not saved, copied, forwarded or shown to anyone.
2. It is removed from the mailbox and from the deleted items folder, and ages out of any provider-level backup on that provider's own rotation. Nobody here can reach inside a backup rotation, and this policy will not pretend otherwise.
3. You are told in writing that it is gone, and asked not to send another.
4. Where it appears to have been sent by a person lacking authority to disclose it, that is said plainly, because the sender may owe a notification duty they have not yet considered.

The same treatment meets any other unsolicited personal information about a third party, a pasted thread carrying somebody else's contact details among them.

8.1

APP 6 governs what may be done with material once held. The primary purpose is permitted. A secondary purpose is permitted where you would reasonably expect it and it is related to the first, where you consented, or where the Act supplies a specific exception.

8.2

• Answering your message, and continuing the conversation it begins.
• Noting a question that has now arrived twice, so the website can be mended instead of the answer retyped.
• Dealing with a request, a complaint or a security report, and being able to show afterwards that it was dealt with.
• Meeting a legal obligation, the company's own corporate and revenue records included.

8.3

Five things are prohibited outright, stated as flatly as they can be put.

• Nothing is sold. Not to a broker, not to an advertiser, not bundled inside anything described as an audience.
• Correspondence is not turned to advertising. No advertising exists anywhere in this company.
• Writing in adds you to no list, because there is no list to be added to.
• Nothing you send trains a model. That covers ordinary correspondence as squarely as it covers documents, and models belonging to others as squarely as any of the company's own.
• You are not tracked across other services. The means to do it are absent and unwanted.

8.4

Disclosure may occur where the Act permits it: where an Australian law, or an order of a court or tribunal, requires or authorises it; where a permitted general situation under section 16A arises, such as a serious threat to life, health or safety; or to an enforcement body where reasonably necessary for an enforcement related activity.

A disclosure to an enforcement body is recorded in writing, as APP 6.5 requires. Where the law leaves the company free to tell you that a demand was made, you will be told. A polite request unaccompanied by lawful authority is refused, and the refusal is put in writing.

9.1

APP 7 restrains the use of personal information for direct marketing. For anything sent by email, text or instant message the Spam Act 2003 (Cth) sits above it and is strict: consent, an accurate statement of who is sending, and an unsubscribe facility that works, stays reachable for a minimum of 30 days and is honoured within 5 working days.

9.2

Should that change, it will change by opt in. The consent will be stored with its timestamp and the words actually agreed to, and the opening message will say where the address was obtained. Correspondence with the published mailbox subscribes you to nothing; that is the quiet route by which small companies assemble lists, and it is closed here.

9.3

No advertising appears on this website and no placement is sponsored. The software carries none either: a retrieval tool displaying an advertisement beside a client's contract would be a remarkable thing to build. There is accordingly no advertising identifier, no personalisation control and no advertising network in the supply chain at clause 10.

Nor does the company buy advertising aimed at you. No pixel here reports your visit to a platform, so no audience is assembled from this site and no remarketing list exists to hold you.

9.4

Every message leaving this company answers one that arrived first. A reply to your own enquiry is not a commercial electronic message in the relevant sense, but replies identify the sender and give the address to write back to regardless. Anything that ever is a commercial electronic message will carry the unsubscribe facility described at 9.1.

10.1

The supply chain is short enough to name entirely. Every third party capable of seeing anything connected with this company appears in the table, by name and not by description.

10.3

Beyond those five, nobody. No analytics vendor, no relationship management system, no marketing platform, no support desk product, no chat service, no error reporting service, no advertising network, no enrichment service. Each is an ordinary purchase for a small company and each is a further place material comes to rest. None has been bought, and this table is amended before any such change takes effect rather than afterwards.

10.4

On a sale, a merger or a winding up, records could pass to a successor. They would pass carrying the obligations in this policy. Where such a change materially alters the handling of material about you, this page will say so before the change takes effect.

11.1

APP 8 governs disclosure to a recipient outside Australia. Section 16C then supplies the sting: where an overseas recipient does something that would have breached the principles, the act is taken to have been done by the discloser, who is liable for it.

11.2

Before material goes abroad the company takes such steps as are reasonable to see that the recipient will not breach the principles, principally by contract. The terms relied on are the data processing terms each provider publishes, which bind it to act on instruction, to hold the material securely, to help with an individual's request and to report an incident.

11.3

The destinations are those named in the fourth column at 10.2. That column is the authoritative statement of where material may be held or reached, and it is corrected when a provider changes region.

12.1

APP 9 forbids an organisation to adopt a government related identifier as its own identifier for a person, and confines the use and disclosure of such identifiers to narrow cases. The class takes in tax file numbers, Medicare numbers, licence and passport numbers, and Centrelink references.

None is collected. Nothing here asks for one. There is no account to open, no age gate, no identity check and no payment to take, so no field exists that could hold one, and no such number is used as this company's reference for anybody.

12.2

The clause runs longer than the position warrants because the exposure here is particular. Executed agreements are full of identifiers: a licence number in a services contract, a passport number in an immigration retainer, a tax file number sitting in a document that should never have carried one. Retrieval over a firm's documents meets them, not by collecting them but because they were on the file.

12.3

• An identifier occurring inside a practice's own document remains that practice's material. It would not be extracted, indexed as an identifier, used as a key, or adopted by the company as anybody's reference.
• An identifier reaching the company outside such an engagement, in an attachment for instance, is unsolicited information and meets clause 7.3.

13.1

APP 10 requires that what is collected be accurate, current and complete, and that what is used or disclosed be relevant as well.

Almost everything here you wrote yourself, so accuracy reduces to whether it was true when sent and whether it remains so. The item likeliest to go stale is precisely that: an address, or an account of a practice, sitting in a thread a year old. Those are not re-verified on a cycle, since re-verification would mean approaching people who have finished their business here to ask whether they are still themselves.

14.1

APP 11.1 requires protection against misuse, interference and loss, and against unauthorised access, modification or disclosure, by such steps as are reasonable in the circumstances.

14.2

• Encryption in transit throughout. The site answers over HTTPS alone, and mail travels under TLS wherever the sending server offers it.
• Encryption at rest for what is stored, supplied by the underlying platform.
• A second factor on every administrative account the company has: the mailbox, the domain registration, the hosting account, the code repositories.
• Reach confined to those who need it. The number of people able to open the mailbox is very small, and it is revisited whenever somebody arrives or leaves.
• A small perimeter. What has to be defended is a set of static files, one mailbox, a domain registration and a repository.
• Collecting less. For a company of this size the most dependable control available is not having the material, which is why the tables at clause 4 are as short as they are.

No arrangement is perfectly secure, and a supplier asserting otherwise is mistaken or selling something.

14.3

Those controls are proportionate to a company holding correspondence. A practice's executed contracts are a different order of material and are held to a different standard, which is why indexing runs on infrastructure the practice controls and why the security arrangements are reviewed by somebody who does not work here. Both standards are written out on the approach page, in those words, so a firm can quote them back.

15.1

APP 11.2 requires that where material is no longer needed for any purpose for which the principles would permit its use or disclosure, and no law requires it to be kept, reasonable steps be taken to destroy it or de-identify it. Retention is thus a rule carrying an expiry, not a habit that continues until somebody objects.

15.3

Removal from a live system does not strike a record instantly from a provider's backup rotation. Where that is the position it is stated, rather than an immediate erasure being claimed that nobody can deliver. Backups expire on their ordinary cycle and are never consulted to reconstitute something a person asked to have removed.

16.1

APP 12 entitles you to ask for access to the personal information the company holds about you. APP 13 entitles you to require its correction. Write to hello@ailaw.im under the subject line Privacy request, saying what you want and giving enough to find it. Everything here is indexed by the address it arrived from, so writing from that address, or naming it, is ordinarily the whole of what is needed.

16.2

The company must be satisfied that you are the person concerned, or that person's authorised representative. With no accounts in existence, what can honestly be established is control of the address the correspondence sits under, and this policy says so rather than claiming a higher confidence. In practice that means replying to a message sent to it. Identity documents will never be requested, and anybody purporting to be this company and asking for them is not.

16.3

A request is answered within 30 days. Access carries no charge, nor does making the request, nor does correction. Where furnishing access in some particular form would cost real money, a bulk export in an unusual format for example, the charge is quoted before the work begins and will not be excessive.

16.4

The grounds for refusal are those the Act specifies, and they are narrower than most people suppose. Among them: where access would unreasonably affect another person's privacy; where the request is frivolous or vexatious; where the material relates to existing or anticipated proceedings and would not be discoverable; and where access would itself be unlawful.

A refusal, entire or partial, comes with written reasons, the ground relied on, and how to complain. Where part can be given, or the need met another way, that is offered instead of a bare refusal.

16.5

Material inaccurate, out of date, incomplete, irrelevant or misleading is corrected. Where it has gone to somebody else and you ask for them to be told of the correction, reasonable steps are taken to tell them, unless that is impracticable or unlawful.

Where correction is refused, you may require a statement to be attached recording that you consider the material inaccurate, and reasonable steps are then taken to make that statement apparent to anyone consulting the record later. The entitlement is routinely overlooked and is worth having.

17.1

Deletion here carries one meaning: removing the record of your dealings with this company. No account exists on this site, so nothing has to be closed first. Write to hello@ailaw.im under the subject line Delete my data, from the address the correspondence sits under if that is open to you. No reason need be given, and none will be sought.

17.2

1. Every thread associated with the address is found, with any attachment stored beside it.
2. They are removed from the mailbox, and from the deleted items folder.
3. What was removed, and anything retained, is confirmed to you in writing.
4. The whole of it completes inside 30 days, and ordinarily inside a few.

17.3

Three things may survive the request.

• A minimal note that a deletion was asked for and carried out, holding the address and the date and nothing further. Without it the company cannot show it did what you asked.
• Anything a law requires to be kept, chiefly financial records under section 286 of the Corporations Act 2001 (Cth). You would be told if part of your correspondence fell there.
• Material inside an open complaint or a live proceeding, until it concludes. You would be told that too, and why.

Backups expire as clause 15.3 describes. No backup is restored to reinstate something a person asked to have removed.

18.1

No principle in Schedule 1 requires this clause. It is here because this policy is written for law practices, for whom confidentiality and privilege are not a compliance topic but the substance of the relationship.

Two obligations sit side by side and are often run together. A solicitor owes a client a duty of confidence under the applicable conduct rules. Separately, legal professional privilege attaches to certain communications and belongs to the client, not to the practitioner. Handing privileged material to an outsider can waive it, and the loss falls on the client and the practice rather than on the supplier who received it.

18.2

• Possession of a practice's client documents is not wanted. The design keeps indexing on infrastructure the practice controls, so that the question of waiver need not arise.
• Where a practice nonetheless chooses a hosted arrangement, a written agreement records the duties of confidence, the location of the data, who may reach it and how it is destroyed, in terms the practice can put before whoever advises it.
• The company will never tell a practice that using its software is consistent with that practice's professional obligations. The judgement belongs to the practice, on advice, and a supplier offering comfort on the point is doing something improper.
• Documents arriving at the published mailbox are destroyed rather than read, which is the only defensible way to treat material that may be privileged and was never the recipient's to hold.

19.1

This is a site about business software for law practices. It is not directed at a child, is not built to appeal to one, and offers nothing for a child to join, buy, download or play.

The Act fixes no age at which a person may consent for themselves. The Commissioner's guidance is to assess capacity individually where that is practicable, and, as a general rule, to presume capacity from the age of 15 unless something indicates otherwise. That presumption is applied in the single situation where it could bite, which is a young person writing to the mailbox.

19.2

The Privacy and Other Legislation Amendment Act 2024 (Cth) provides for a Children's Online Privacy Code, to be made by the Information Commissioner and directed at services likely to be accessed by children. This site is not such a service. Should that assessment ever alter, the Code will be complied with as it applies and this clause rewritten then, rather than its terms guessed at now.

19.3

• Personal information is not knowingly taken from a person under 15 absent the consent of a parent or guardian.
• There is no account, no profile, no social feature, no chat, no content posted by users and no advertising anywhere on this site.
• If a child has written here, say so at hello@ailaw.im. The correspondence is deleted and the deletion confirmed. Proof of a legal relationship is not demanded beyond enough to be satisfied the request is genuine.

20.1

Schedule 1 to the Privacy and Other Legislation Amendment Act 2024 (Cth) will require a policy to disclose the kinds of personal information used in substantially automated decisions significantly affecting a person's rights or interests, together with the kinds of decision made. That duty commences on 10 December 2026. This clause is written before the commencement rather than after it.

20.2

No automated decision of any kind is made about any person. Nothing operated here determines whether somebody obtains credit, employment, a service, a benefit, a price or a legal entitlement. Nobody is scored, ranked, sorted for eligibility or profiled. A person reads each message that arrives and answers it.

20.3

Ranking is automated. When the software orders passages by their similarity to a query, no person chooses the order. That is a determination about which paragraph of a contract to display first. It is not a determination about a person, it touches nobody's rights or interests, and calling it an automated decision in the statutory sense would be a category error making the disclosure less useful rather than more.

Two undertakings keep this clause honest if the product arrives.

• A ranking score will not be dressed up as a probability, a confidence level, a risk rating or a prediction about a matter or a party.
• If anything is ever built here that does decide something about a person, this clause will describe it, with the kinds of information used and the kinds of decision made, before the processing begins.

21.1

Part IIIC establishes the Notifiable Data Breaches scheme. It bites on an eligible data breach: unauthorised access to, unauthorised disclosure of, or loss of personal information, where a reasonable person would conclude that serious harm to an affected individual is likely, and where remedial action has not removed that likelihood.

21.2

1. Contain. Stop the access, revoke the credential, take the component down if that is what it takes.
2. Assess. Where an eligible data breach is suspected, an assessment that is both reasonable and expeditious is completed within 30 days of the grounds for suspicion arising, which is the period section 26WH allows.
3. Remediate. Where remedial action removes the likelihood of serious harm, the breach is not notifiable, and the reasoning is written down.
4. Notify. Where it is notifiable, a statement is prepared and given to the Office of the Australian Information Commissioner (OAIC), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au, as soon as practicable. Affected individuals are then notified, or, where that is impracticable, the statement is published here and reasonable steps taken to bring it to notice.

21.3

A notification states who the company is and how to reach it, what happened, the kinds of information caught up in it, and the steps recommended to you. It is not padded with reassurance nobody has earned, and it says what remains unknown.

To report something, write under the subject line Security. Chasing a false alarm is preferable to missing a real one, and a report made in good faith will not be treated as hostile.

22.1

A statutory tort of serious invasion of privacy commenced on 10 June 2025, under Schedule 2 to the Privacy and Other Legislation Amendment Act 2024. It permits a person to sue for intrusion upon seclusion or for misuse of information, where the invasion was intentional or reckless, where somebody in the plaintiff's position would have expected privacy, and where the invasion was serious.

It runs against anybody, this company included, and it exists quite apart from the complaint route at clause 24.

23.1

Nothing. No cookie of this company's is set, for analytics or preferences or the state of a consent dialogue. Nothing of ours is written to local storage or to session storage.

Because nothing is stored, no consent dialogue appears, and its absence is a decision rather than an oversight. Australia has no counterpart to the European rule requiring permission before information is placed on a device. What governs instead is APP 3, confining collection to what is reasonably necessary, and APP 5, requiring notice. Collecting nothing satisfies the first; this clause and the cookie notice satisfy the second.

23.2

One thing does leave your browser. Two font families are called from Google's service, which shows your network address to Google at the instant they load. It is the only third party request these pages make. The cookie notice sets it out in full, with the means of preventing it.

24.1

First, to the company. Write to hello@ailaw.im under the subject line Privacy complaint, setting out what happened and what you want done about it. A first reply follows within 5 business days; the determination follows within 30 days. Where more time is needed, you are told why, and given a date.

24.2

Then, to the Commissioner. If the answer does not satisfy you, or 30 days pass without one, the complaint may go to the Office of the Australian Information Commissioner (OAIC), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au.

The Commissioner ordinarily looks for the complaint to have been put to the company first, with a month allowed to answer, though a complaint may be accepted without that where the circumstances warrant it. Nothing is charged for making one. Neither representation nor this company's agreement is required.

24.3

Two undertakings about the process itself. A non-disclosure agreement will never be made a condition of a privacy complaint being dealt with. Making a complaint will never be treated as a breach of the terms of use.

25.1

This policy is drafted to Australian law, that being the law which binds the company. Rights may nonetheless attach to you elsewhere, and silence here should not be read as refusal.

Where the General Data Protection Regulation or its United Kingdom counterpart reaches this processing, the familiar entitlements apply, along with a complaint to your own supervisory authority. Where reliance is placed on consent, it may be withdrawn at any point, without unsettling what was done beforehand. A request of that kind is answered inside one month; say which law you invoke, so the correct timetable is applied.

25.2

Under the California Consumer Privacy Act as amended there are entitlements to know, to delete, to correct, and to opt out of a sale or of sharing for cross context behavioural advertising. Nothing is sold and nothing is shared for that purpose, as those expressions are defined in that Act. No advertising exists on this site or in the software, so there is no such dealing to withdraw from. A browser sending the Global Privacy Control signal is honoured regardless.

Where some other right exists where you live, tell the company about it and the request is dealt with on its merits rather than on whether an obligation technically arises.

26.1

This policy may be amended. An amendment moves the effective date and the version recorded in the heading above.

Where an amendment materially reduces your rights, or materially widens what is collected, notice comes first: a note carried above the heading of this page for a minimum of 30 days, and, if a practice is by then using anything supplied by the company, a message to that practice directly. No amendment is given retrospective effect.

27.1

Every privacy matter arrives at one address: hello@ailaw.im. The subject line settles which clock applies.

27.3

Entity: AI-LAW PTY LTD, ACN 698 421 608, ABN 23 698 421 608, a proprietary company limited by shares in Western Australia. It is not registered for GST.

No postal address is published here. Where a document must be served on the company, ASIC holds its registered office against ACN 698 421 608, and service is properly effected at the office that register shows.

27.4

Should you prefer not to deal with the company at all, the Office of the Australian Information Commissioner (OAIC) may be approached directly at GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au.