Privacy policy

What we collect

• Account information. Your name, email address and password hash when you create an account, and the names and email addresses of people you invite to your organisation.
• Business information. The legal name, ABN, industry, states of work, sites, headcount and high-risk activities you enter so the software can write your policies.
• Content you create. Policies, register entries (hazards, incidents, chemicals, training, evidence, corrective actions), audit and management review records, uploaded logos and documents, and questions you ask the assistant. Register entries may contain personal information about your workers. You are responsible for having a lawful basis to record it.
• Billing information. Your plan, invoices and payment status. Card details are collected and stored by Stripe, our payment processor. We never see the full card number.
• Usage and device information. Pages visited, features used, browser type, approximate location from IP address, and error logs, collected through our hosting provider and Google Analytics on the public website.

Why we collect it

To create and secure your account. To generate and store your management system documents. To bill you. To send service emails such as password resets, invitations, training expiry and review date reminders. To answer support requests. To understand how the product is used so we can improve it. To meet our legal obligations. We do not sell personal information and we do not use your policies or register content to advertise to you.

AI processing

When you run onboarding, ask the assistant a question or run the AI internal auditor, the relevant business information and document content is sent to a third-party large language model provider to generate the response. We use providers whose terms prohibit training their models on customer content sent through their API. Do not enter information into the assistant that you are not permitted to disclose.

Who we share it with

• Cloud hosting, database and authentication providers that run the service.
• Stripe, for payments and invoicing.
• Large language model providers, for generating documents and answers as described above.
• Email delivery providers, for service emails.
• Google Analytics, on the public marketing pages only, not inside the application.
• Professional advisers, regulators or law enforcement where the law requires it.

Some of these providers store or process information outside Australia, including in the United States. By using the service you consent to that overseas disclosure. We choose providers with contractual privacy and security commitments consistent with the Australian Privacy Principles.

Cookies

The application uses strictly necessary cookies to keep you logged in. The public website uses Google Analytics cookies to measure traffic. You can block analytics cookies in your browser without affecting the service.

Security and retention

Data is encrypted in transit and at rest. Access inside your organisation is controlled by the roles you assign. We keep your content for as long as your account is active. If you cancel, we retain your data for 90 days so you can export it or reactivate, then delete it from live systems. Backups roll off on their own schedule. Invoices are kept for seven years as tax law requires.

Access, correction and complaints

You can view and edit most of your information inside the application. To request access to or correction of anything else, or to ask us to delete your account, email support@policysystem.com.au. We will respond within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

We will update this page when our practices change and note the date at the top. Material changes will be emailed to account owners.

Where to next

Terms of service · FAQ · Pricing