Privacy Policy

Matter Desk Pty Ltd (ACN 697 017 502) (“Matter Desk”, “we”, “us”) provides an AI-powered legal workbench for Australian law firms. This Privacy Policy explains how we collect, use, store, and disclose personal information, including the limits of the arrangements currently verified. It is not a certification of compliance with the Privacy Act 1988 (Cth) or the Australian Privacy Principles (APPs).

1. Who this policy applies to

This policy applies to personal information we handle about visitors to our website, prospective customers, individual users of the Service (lawyers, paralegals, support staff), administrators of a firm workspace, and people whose details appear in customer content uploaded by a firm.

2. What we collect

We collect the following categories of personal information:

• Account data: name, work email, role within the firm, profile preferences, and authentication credentials.
• Firm data: firm name, billing email, business address, ABN where supplied, and the configuration choices the partner administrator makes.
• Customer content: matter records, documents, notes, deadlines, draft correspondence, generated memos, search history, and other material a firm chooses to upload or generate inside the Service. This may include personal information about the firm’s clients, opposing parties, witnesses, or counterparties.
• Usage data: information about use of the Service, such as browser and device details and operational signals. Product analytics and error-tracking services are described in section 9.
• Payment data: Matter Desk does not store full card numbers. Our payment processor handles card capture and tokenisation. We retain a customer identifier, the last four digits of the card used, the card brand, and invoice history.
• Support communications: emails, in-app chat, and screen-share sessions when a firm asks us for help.

3. How we use it

We use personal information to:

• provide, maintain, and secure the Service;
• respond to research, drafting, and matter management requests submitted by users on behalf of the firm;
• manage subscriptions, billing, trials, invoices, and refunds;
• send service notifications (deadline reminders, billing notices, security alerts) and product updates the firm has opted in to;
• investigate misuse, enforce our terms, and meet legal and regulatory obligations including responses to lawful demands;
• improve the Service: aggregate, de-identified usage analysis to find rough edges and prioritise upgrades.

Matter Desk does not use customer content to train models that it owns, and we do not sell or rent personal information to advertisers or data brokers. Third-party AI handling and the limits of verified provider controls are described below.

4. AI processing of customer content

AI-assisted research, analysis, and drafting send relevant customer-content excerpts for the requested feature to a third-party AI provider. That processing and storage may occur outside Australia.

Matter Desk does not use customer content to train models it owns. We do not promise provider zero retention or no training unless the applicable account controls and written provider terms have been independently verified.

Where a cited authority is not matched to a retrieved source record, the Service may return the phrase “Authority not verified”. A source-record match is provenance only; independent legal verification is required before relying on the output.

5. Where we store data

Primary customer databases and matter-document storage use Australian regions. This does not establish Australian storage or processing for every operational record or service provider. AI processing is described separately above because it may occur outside Australia. Primary customer data is protected with encryption in transit and at rest, with access controls for workspace and document data. These controls do not establish the safeguards of every external service or an independent security certification.

Payment and email services may involve overseas handling of personal information. The locations of all provider logs have not been verified. Assessment of overseas providers’ locations, terms and controls, including the steps required under APP 8 where applicable, is not yet complete.

6. Disclosure

We disclose personal information only:

• to the firm whose workspace the information lives in, scoped by the access controls the partner administrator configures;
• to our service providers, including hosting, AI processing, payments and email delivery, under their applicable service, privacy, and data-processing terms. Provider handling and the limits of verified controls are described above;
• to law enforcement or regulatory bodies where compelled by valid legal process, and only to the extent compelled. We will tell the affected firm wherever the law allows; and
• to a successor entity in the event of a corporate transaction (merger, acquisition, asset sale), under confidentiality obligations no less protective than this Policy.

7. Retention and deletion

You can delete your account from inside the app. Open Settings, then Profile, then Delete account. The screen shows what is removed and what your firm keeps before anything happens.

When you delete your account, your sign-in, email address, password, name and profile details are removed straight away and you are signed out on every device. Your notifications, search history and private AI chats go with them.

Records a law practice has to keep stay with the firm whose workspace they belong to. Matters, documents, time entries, notes and audit history remain in that firm’s client files, without your contact details and without the device and network details recorded against your actions. Text you typed into documents, notes and messages is kept as you wrote it, so your name can still appear inside that text.

If a task you started was already running when you delete your account, it can finish and leave one record behind, which is retained without your contact details and without the device and network details recorded against your actions.

A Principal can close a firm workspace in the same place. Closing a workspace cancels the subscription immediately and removes everyone’s access. A closed workspace is kept securely, is not visible to anyone, and can be restored on request for 60 days. A workspace with no matters or documents is deleted straight away. We will publish the deletion schedule for closed workspaces in this policy once it is in force.

Billing records are kept as tax law requires. Backup copies expire on our normal backup cycle rather than being removed on the day of a request.

Contact us to confirm retention, export and deletion arrangements for your workspace, including backups and external services. A complete retention and deletion schedule has not yet been verified. Applicable legal obligations may require some records to be retained. This policy does not set a fixed deletion date.

8. Access, correction and other requests

You can ask us to:

• tell you what personal information we hold about you;
• give you a copy of that information;
• correct information that is inaccurate or out of date;
• delete personal information, subject to applicable retention requirements; and
• stop sending marketing communications (you can also opt out via the unsubscribe link in any marketing email).

You do not have to ask us to delete your account. You can do it yourself in the app, at Settings, then Profile, then Delete account. Section 7 sets out what is removed straight away and what a firm keeps.

Send requests to privacy@matterdesk.ai. We respond within the period required by applicable law and aim to acknowledge requests promptly. If we cannot grant a request in full, we will tell you why.

If you are unhappy with how we have handled your personal information, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

9. Cookies and similar technologies

The Service uses essential cookies for authentication and session management and stores preferences, including your theme, in your browser. Product analytics and error-tracking services are not currently configured. You can manage cookies through your browser settings.

10. Children

The Service is not intended for individuals under 18 and we do not knowingly collect personal information from minors. If you believe a minor has signed up, contact us so we can remove the account.

11. International users

The Service targets Australian law firms. Where personal information about residents of other jurisdictions is involved, contact us about the applicable data-handling arrangements and requests. This policy does not certify compliance with overseas privacy laws.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified to the firm’s billing email. Review the updated policy before relying on a data-handling assurance. The “last updated” date at the top of this page records the most recent change.

13. Contact

Matter Desk Pty Ltd (ACN 697 017 502) handles this policy. Privacy questions or complaints can be sent to privacy@matterdesk.ai. General questions can be sent to hello@matterdesk.ai.