Privacy Policy

CrunchAI PTY LTD (ABN [ABN]) ("we," "us," or "our") operates the Verdex AI website, application and related services (collectively, the "Service"), an artificial intelligence-powered legal research and drafting-support tool for lawyers that contains judgments and decisions of Australian courts and tribunals. This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you use the Service.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

The Service is operated by CrunchAI PTY LTD from [city, state], Australia. For any privacy-related enquiry, complaint or request, you can contact our Privacy Officer at:

CrunchAI PTY LTD (trading as Verdex AI)
ABN: [ABN]
Email: privacy@verdex.ai [confirm/replace with live address]
Post: CrunchAI PTY LTD, [address], Australia

2. Information We Collect

The information we collect depends on how you interact with the Service.

2.1 Information collected from all users

• Account details: name, work email address, password (stored in hashed form), and, if you choose to use it, single sign-on details (for example Google or Microsoft).
• Communications: messages, support enquiries, feedback and survey responses you send us.
• Usage and device data: log data, IP address, device and browser type, pages and features used, timestamps and error reports.

2.2 Information collected from legal practitioners and firms

• Professional information: firm or organisation name, role, practice areas, jurisdiction(s), and, where we verify eligibility, your practising certificate or admission details.
• Subscription and payment information: processed directly by our third-party payment processor [Stripe]. We do not directly store full card numbers; we retain records of plan selection, transaction status, invoices and payment history.
• Firm administrator information: details of users that a firm administrator adds to a firm account.

2.3 User Content (queries, uploads and outputs)

When you use the Service you may submit or generate:

• queries and prompts entered into the Service;
• uploaded documents and matter material (for example pleadings, contracts, advice, correspondence, evidence or file notes); and
• outputs, saved research, annotations, folders and drafts generated by or saved within the Service,

(together, "User Content"). User Content may include confidential information, information subject to legal professional privilege, and personal or sensitive information about your clients, opposing parties, witnesses and other third parties. You are responsible for ensuring you have the authority, and any required client consent, to submit User Content to the Service. You should not upload material that you are not permitted to disclose to a third-party service provider.

2.4 Court and tribunal data in the Service

The Service contains judgments, decisions, orders, transcripts (where available) and associated metadata from Australian courts and tribunals, obtained from publicly available sources, official court publications and licensed or authorised data providers [confirm sources]. This material may contain personal information about parties, witnesses, victims, judicial officers, legal representatives and other individuals, and in some cases sensitive information (such as health information, criminal history, or information about children).

We handle this material as follows:

• We apply, and take reasonable steps to give effect to, non-publication, suppression and anonymisation orders and statutory restrictions on identifying parties (for example in family law, child protection, and certain criminal and tribunal proceedings), consistent with the way the source court has published the material.
• We do not use court and tribunal data to build profiles of individuals for purposes unrelated to legal research, and we do not make court-derived personal information available for marketing, credit, employment or similar purposes.
• If you believe a decision in the Service identifies you contrary to a court order, or you wish to request removal or de-identification, please contact us using the details in Section 1.

2.5 Sensitive information

Some User Content and some court data may include "sensitive information" under the Privacy Act (for example health information, criminal record, or racial or ethnic origin). We collect sensitive information in User Content only where you choose to submit it, and we use it only to provide the Service to you as described in this Policy. Court data containing sensitive information is handled as described in Section 2.4.

3. How We Use Your Information

We use personal information to:

• Create and administer user and firm accounts;
• Provide the Service, including search, retrieval, summarisation, analysis and drafting-support features, and generate responses to your queries;
• Save, organise and return your User Content within your account;
• Process subscription payments, issue tax invoices and manage renewals via our payment processor;
• Send transactional and account-related communications (for example account confirmations, security alerts, billing notices and service updates);
• Provide customer support and respond to enquiries;
• Monitor, maintain and improve the security, performance, reliability and accuracy of the Service, including fraud and abuse prevention;
• Comply with our legal obligations; and
• With your consent, send you product updates and marketing communications, from which you may opt out at any time.

We do not sell personal information to third parties.

3.1 Our approach to AI and your User Content

• No training on your User Content by default. We do not use your User Content (queries, uploaded documents or outputs) to train or fine-tune any AI model, whether ours or a third party's, without your express opt-in. [Confirm: this must reflect your actual technical and contractual arrangements.]
• Service improvement. We may use de-identified and aggregated usage metrics (for example feature usage, latency and error rates) to improve the Service. Where you submit feedback (for example by rating a response), we may review that feedback and the associated query or output only to the extent you have agreed to share it.
• Third-party AI providers. To generate responses, relevant portions of your queries and User Content are sent to third-party AI model providers acting as our service providers. We require those providers by contract not to use that content to train their models and to handle it confidentially and securely. [Confirm provider names, data retention settings and zero-data-retention arrangements.]
• Isolation. User Content is logically separated by account and firm. One firm's User Content is not made available to another firm.

4. Use of Artificial Intelligence and Automated Processing

The Service uses artificial intelligence and machine learning, including large language models and retrieval of court data, to generate summaries, analysis and draft text.

AI outputs may be incomplete, inaccurate or out of date, and may reference authorities incorrectly. The Service does not provide legal advice and is not a substitute for the independent professional judgment of a qualified legal practitioner. You are responsible for verifying all outputs, including checking every citation and authority against the primary source, before relying on or filing them.

We do not use the Service to make decisions that have a legal or similarly significant effect on an individual without human involvement. [Confirm; update if this changes. If the Service uses automated decision-making that significantly affects individuals' rights or interests, additional transparency obligations under the Privacy Act reforms will apply.]

5. How We Disclose Your Information

We disclose personal information only as reasonably necessary to operate the Service, including to:

• Your firm – if you use the Service through a firm or organisation account, your account details, usage information and User Content may be accessible to your firm's administrators, according to the settings the firm has chosen.
• AI model providers – to process queries and generate outputs, as described in Section 3.1.
• Payment processor ([Stripe]) – for payment processing, invoicing and fraud prevention.
• Cloud hosting and storage providers (for example [AWS or equivalent]) – to host the Service and store User Content and account data.
• Analytics and monitoring providers (for example [Google Analytics or equivalent]) – to understand how the Service is used.
• Email delivery providers (for example [SendGrid or equivalent]) – to send transactional emails.
• Our service providers, contractors and advisers (for example IT support, security, legal and accounting) who are bound by confidentiality obligations.
• Regulators, courts, law enforcement or other third parties where required or authorised by law, or to protect the rights, safety or property of us, our users or the public. Where permitted, and where it is lawful and practicable to do so, we will notify you before disclosing User Content in response to a legal demand, so you have the opportunity to assert privilege or confidentiality.
• A purchaser or prospective purchaser, in the event of a sale, merger, restructuring or other transfer of all or part of our business or assets, subject to confidentiality obligations.

Access by our personnel to User Content is restricted to authorised personnel, is limited to what is necessary for support, security, abuse investigation and legal compliance, and is logged. [Confirm.]

6. Overseas Disclosure

Some of our service providers (including our AI model providers, cloud hosting provider, payment processor, analytics provider and email delivery provider) may store or process personal information on servers located outside Australia, including in [the United States / other countries – list]. [If feasible, state that User Content is stored in Australian data centres, and identify any processing outside Australia.]

Where personal information is disclosed overseas, we take reasonable steps in accordance with APP 8 to ensure the overseas recipient handles that information consistently with the Australian Privacy Principles, including through contractual and security commitments. If you are a legal practitioner, you should consider whether overseas processing is consistent with your professional obligations and your clients' instructions before uploading User Content.

7. Data Security and Storage

• All data is encrypted in transit (HTTPS/TLS) and [encrypted at rest].
• Passwords are stored using industry-standard hashing; we never store passwords in plain text.
• Access to production systems and User Content is restricted by role-based access controls, authentication (including [multi-factor authentication]) and logging.
• We conduct [regular security testing and reviews] and require our service providers to maintain appropriate security standards.
• We use reasonable technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data Retention

• Account and profile information is retained for as long as your account remains active.
• User Content is retained while your account is active so you can access your saved work. You can delete individual queries, documents and saved research at any time within the Service, after which we will delete them from our active systems within [30] days and from backups within [90] days. [Confirm.]
• Where an AI provider processes your query, we require that provider not to retain it beyond what is necessary to deliver the response, or [for up to X days for abuse monitoring only]. [Confirm.]
• If you close your account, we will delete or de-identify your personal information and User Content within a reasonable period, except where retention is required by law or for legitimate business purposes such as financial record-keeping (for example payment and tax invoice records).
• Court and tribunal data is retained as part of the Service's research database for as long as it remains lawfully available, subject to any removal or de-identification request or order described in Section 2.4.

9. Your Rights

Subject to the Privacy Act, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate, out-of-date or incomplete information;
• Request deletion of your account and associated personal information, subject to our legal and legitimate retention needs;
• Withdraw consent to particular uses (for example marketing communications, or any opt-in to share feedback or content for service improvement) at any time; and
• Lodge a complaint, as set out in Section 13 below.

You can access, update and delete most account information and User Content directly within the Service. For other requests, contact us using the details in Section 1. If you are an individual who is not a user but whose personal information appears in court data in the Service, you may also contact us as set out in Section 2.4.

Where we process User Content on behalf of a firm or practitioner, that firm or practitioner is generally responsible to their clients for that information, and we may refer requests relating to such content to them.

10. Data Breaches

We maintain a data breach response plan. If we become aware of an eligible data breach likely to result in serious harm, we will assess it and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme in the Privacy Act. Where a breach affects User Content, we will also notify the relevant account holder or firm administrator promptly so that they can consider their own professional and regulatory obligations.

11. Children's Privacy

The Service is intended for use by legal professionals and is not intended for individuals under the age of 18. We do not knowingly collect personal information from children through account registration. Court and tribunal data may contain information about minors; this is handled in accordance with Section 2.4. If we become aware that we have collected personal information from a person under 18 through registration, we will take reasonable steps to delete it.

12. Cookies and Analytics

The Service and any associated web properties may use cookies, SDKs or similar technologies, and analytics tools such as [Google Analytics], to understand how the Service is used and to improve our services. You can control cookies and device-level permissions through your browser or device settings, though some features may not function properly if cookies are disabled.

13. Complaints

If you believe we have breached the Australian Privacy Principles, please contact us first using the details in Section 1 so we can investigate and respond. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technology (including our use of AI) or legal requirements. We will update the "Last updated" date at the top of this page and, where changes are material, provide notice within the Service or by email before the changes take effect.

15. Contact Us

Questions, requests or complaints about this Privacy Policy can be directed to:

CrunchAI PTY LTD (trading as Verdex AI)
ABN: [ABN]
Email: privacy@verdex.ai [confirm/replace with live address]
Address: [address], Australia