Privacy Policy

1. Who we are

Rules Mate (“we”, “us”, “our”) is part of the Mate Network. Our website is https://rulesmate.com.au.

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). This policy explains how we handle personal information.

2. What personal information we collect

We collect only the personal information necessary to operate and improve Rules Mate. Specifically:

• Email address — when you join the AI advisor waitlist or contact us
• Business profile — industry, entity type, state of operation (optional, for product personalisation)
• ABN data — only when you actively use the ABN lookup feature in the obligation finder; lookup results are not stored
• Technical data — IP address (hashed), browser type, pages visited, referring URLs (analytics + abuse prevention)
• Tool inputs — values you enter into our free tools are processed in-browser only and are not transmitted to our servers unless you choose to export
• AI advisor questions and uploaded documents — the questions you ask and the text of documents you upload for review (see section 5A)

3. Why we collect it

• To provide the service — render relevant compliance information, generate calculator outputs
• To send service emails — waitlist notifications, product update communications you've opted into
• To improve the corpus — anonymous, aggregated usage patterns inform what we publish
• To prevent abuse — rate limiting, fraud detection

We do not sell personal information. We do not engage in cross-context behavioural advertising.

4. How we collect it

• Directly from you — when you join the waitlist, contact us, or use ABN lookup
• Automatically via cookies — see our cookies section below
• Indirectly via service providers — limited technical data via hosting and analytics providers

5. How we store and protect personal information

Personal information is stored in our database, which our database provider hosts in Australia. AI processing takes place overseas (see sections 5A and 7). We apply industry-standard security controls including TLS in transit, encryption at rest, role-based access, and audit logging.

We retain personal information only as long as needed for the purpose collected. Waitlist emails are deleted on request and on unsubscribe.

5A. AI processing and uploaded documents

Rules Mate's AI advisor uses artificial intelligence to answer compliance questions and to review documents you upload, such as AML/CTF programs, privacy policies and WHS documents. This section is our notice about that collection (APP 5).

• What we collect — your account email, the questions you ask, and the text of documents you upload, including any personal information those documents contain.
• Why— to answer your question, assess your documents against the obligations that apply to your business, and produce findings such as scores, gaps and evidence summaries. If you don't provide a document, we can't review it; the rest of the service still works.
• Scrubbed before analysis— before any AI processing, we automatically replace personal details with placeholders such as [PERSON_1]: names of people, tax file numbers, Medicare and card numbers, bank details, passport and driver licence numbers, Centrelink reference numbers, phone numbers, personal email addresses, home addresses and dates of birth. Only the scrubbed text is sent for AI processing. Your business's own ABN and ACN are kept, because they are public register details the assessment needs. File names are scrubbed in the same way.
• Redaction is automated and not perfect— unusual names or numbers in free text can be missed. Please remove information you don't need reviewed, especially sensitive information such as health or criminal record details.
• Scanned documents — we do not send images of scanned pages for AI processing. Scanned documents are either read on your own device (only the extracted text is uploaded, then scrubbed as above) or not accepted; upload a text-based PDF or Word file instead.
• What we keep — we keep the findings of a review (for example scores, gaps and short scrubbed excerpts). We do not store the original uploaded file, and the scrubbed text of a document attached to the advisor is deleted within 24 hours of upload.
• No training — we do not use your documents or questions to train AI models. Our AI providers do not use the content we send them to train their models, under the commercial terms we use.
• Retention by our AI providers — Our AI providers may keep that content for up to 30 days to operate their services and monitor for misuse, and longer only where it is flagged for a breach of their usage policies or where the law requires it. Deleting a document or finding from your Rules Mate account does not shorten that period.
• Overseas processing — scrubbed question and document text is processed by our AI providers. AI processing takes place outside Australia. Your scrubbed advisor question is also converted into a search vector by one of our AI providers, to find the most relevant sources (see section 7).
• Other people's information — documents you upload may contain personal information about other people, such as your clients or staff. You are responsible for having authority to share it with us. We handle it under this policy and scrub it before AI processing.
• Automated decisions— we use computer programs, including AI, to score compliance documents. These scores concern a business's compliance posture and are not used to make decisions about individuals. AI outputs can be inaccurate and are general information, not legal advice.

6. Cookies and tracking

We use cookies sparingly:

• Essential — session, CSRF, preference cookies (no consent required under Australian Privacy Act)
• Analytics — aggregated, privacy-respecting analytics. You can opt out via the cookie banner.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking.

7. Overseas disclosure (APP 8)

Some service providers may process personal information outside Australia. Where this occurs, we take reasonable steps to ensure the recipient does not breach the APPs. Current overseas processors:

• AI providers (the United States; one provider may also route requests through Europe, Asia or Australia) — receive scrubbed question and document text only, to generate answers, document findings and search vectors. Personal details are replaced with placeholders before anything is sent (section 5A). Our AI providers do not use the content we send them to train their models, under the commercial terms we use. Our AI providers may keep that content for up to 30 days to operate their services and monitor for misuse, and longer only where it is flagged for a breach of their usage policies or where the law requires it.
• Hosting provider (content delivery and build infrastructure operate in several countries) — runs our application servers. Your questions and uploaded files pass through the application servers, where personal information is scrubbed in memory before anything is stored or sent for AI processing. Uploaded files are not stored.
• Email delivery provider (the United States) — transactional email delivery.
• Payment processor (the United States and other countries) — billing for paid plans. We store only a customer reference, never card details.

Our database is hosted in Australia. Accounts, saved conversations and document findings are held there.

8. Access, correction, and complaints (APP 12, 13, 1)

You can request access to or correction of your personal information at any time by emailing hello@rulesmate.com.au. We respond within 30 days. If you believe we have breached the APPs, please first raise your concern with us; we will investigate and respond within 30 days. If you are not satisfied, you can complain to the OAIC at oaic.gov.au.

9. Notifiable Data Breaches

We follow the approach of the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act). If we suffer a data breach likely to result in serious harm, we will notify affected individuals and the OAIC as soon as practicable.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified via email to waitlist subscribers and posted on this page.