Privacy Policy

This policy explains how ezylegal Pty Ltd (“we”, “us”) collects, uses, and protects personal information from clients, lawyers, and law-firm administrators using the ezylegal platform.

When you sign up as a lawyer or firm administrator we collect your name, work email, mobile (optional), practice or firm name, state of practice, and a password (stored as a hash, never in plain text). When firms onboard for payments, we collect business identifiers, BSB / account details and KYC information collected and held by Stripe Connect. When a settlement payment is being prepared, we collect the client’s payout account details (account name, BSB, and account number); these are stored by ezylegal and appear in the settlement deed’s Schedule of Payments. When clients engage a lawyer, we collect the information necessary to handle the matter: contact details, documents uploaded, messages exchanged, and case metadata generated by the platform. Documents you share with us — including through your initial conversation with Rachel before your account is created — may contain personal information about other people connected to your matter, for example an opposing party, a witness, or a family member; we collect and hold that information as part of the document, not directly from that person. Some matters, particularly personal injury and related claims, involve documents containing health information, which the Privacy Act classifies as sensitive information; we collect and handle it with the additional protections that classification requires.

We use personal information to operate the platform: route matters to lawyers, generate Rachel’s case-management outputs, facilitate settlement payments, send notifications, and provide customer support. We do not sell personal information.

Rachel and the document-generation features process case data to assist lawyers. Personal information is processed by AI providers we engage (currently Anthropic and OpenAI) under contracts that prohibit using customer data to train their models. Documents you upload — including scanned files and photos — are read using optical character recognition and AI models to extract their contents; this currently also involves Mistral for OCR. Some of these providers may process information outside Australia. We do not use AustLII content as inputs to AI features. Other restrictions are set out in our internal AI governance posture.

Production data is stored in Australia (DigitalOcean Sydney region). File storage uses encrypted object storage. Email is delivered via ZeptoMail; SMS via Twilio.

We share information only as necessary to operate the platform: with the lawyers a client engages, with payment processors (Stripe) when payments are processed, with ezyshield (ezyshield.com.au), our payee-verification partner, when a client’s settlement payout account is verified — with the client’s consent we share their name, contact details, and bank account details, and any identity documents or biometric data collected during the verification are held by ezyshield, not by ezylegal — with email and SMS providers when notifications are sent, and as required by law. Firm data is isolated from other firms’ data by our multi-tenancy model.

Under the Australian Privacy Principles you may request access to, or correction of, personal information we hold about you. To make a request, contact [email protected].

We use TLS in transit and encrypted storage at rest. Access to production systems is restricted to authorised personnel. Authentication is handled by Better Auth with industry-standard hashing. Stripe Connect handles card and direct-debit payment credentials.

We retain personal information for as long as required to provide the service and to meet legal and professional record-keeping obligations. Closed cases and inactive accounts are reviewed for retention or deletion in line with those obligations.

If you believe we have mishandled your personal information you can contact us first at [email protected]. If unresolved, you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy. Material changes will be notified to users by email or in-product. The “Last updated” date at the top of this page reflects the most recent revision.

If you opt in at sign-up, we send you occasional emails about your enquiry and ezyLegal’s services, personalised using the goal you described to Rachel. Every email includes a one-click unsubscribe, effective immediately. Opting out (or never opting in) does not affect emails about your account or active matters.