Privacy Policy

This policy explains how ezylegal Pty Ltd (“we”, “us”) collects, uses, and protects personal information from clients, lawyers, and law-firm administrators using the ezylegal platform. If you use the ezyLegal app on iPhone or Android, the ezyLegal app privacy page explains what the app does in addition to this policy.

When you sign up as a lawyer or firm administrator we collect your name, work email, mobile (optional), practice or firm name, state of practice, and a password (stored as a hash, never in plain text). When firms onboard for payments, we collect business identifiers, BSB / account details and KYC information collected and held by Stripe Connect. When a settlement payment is being prepared, we collect the client’s payout account details (account name, BSB, and account number); these are stored by ezylegal and appear in the settlement deed’s Schedule of Payments. When clients engage a lawyer, we collect the information necessary to handle the matter: contact details, documents uploaded, messages exchanged, and case metadata generated by the platform. Documents you share with us — including through your initial conversation with Rachel before your account is created — may contain personal information about other people connected to your matter, for example an opposing party, a witness, or a family member; we collect and hold that information as part of the document, not directly from that person. Some matters, particularly personal injury and related claims, involve documents containing health information, which the Privacy Act classifies as sensitive information; we collect and handle it with the additional protections that classification requires.

We use personal information to operate the platform: route matters to lawyers, generate Rachel’s case-management outputs, facilitate settlement payments, send notifications, and provide customer support. We do not sell personal information. What you tell us also helps us decide which court forms to support.

Rachel and the document-generation features process case data to assist lawyers. Personal information is processed by AI providers we engage (currently Anthropic and OpenAI) under contracts that prohibit using customer data to train their models. Documents you upload — including scanned files and photos — are read using optical character recognition and AI models to extract their contents; this currently also involves Mistral for OCR. If you ask us to prepare a letter of demand and later tell us what the recipient did, a short, de-identified summary of that answer (the type of matter, amounts and dates, and your words with names and contact details removed) may be classified by TypeSafe AI, a provider that processes data in the United States, so we can show you relevant next steps. Your full answer stays on our Australian servers. If the other side replies to Rachel’s address, the reply is filed on your case, a de-identified version may be classified by TypeSafe AI and by the AI tools named above, and our team reviews it. Our own team may also use your answers and documents, with the help of the AI tools named above, to assess where your matter stands and which of our services, if any, to offer you next. That assessment is kept for our team and is not shared with you or anyone else. Some of these providers may process information outside Australia. We do not use AustLII content as inputs to AI features. Other restrictions are set out in our internal AI governance posture.

Production data is stored in Australia (DigitalOcean Sydney region); analytics data and AI processing are the exceptions described in sections 4, 6b and 6c. File storage uses encrypted object storage. Email is delivered via ZeptoMail; SMS via Twilio.

We share information only as necessary to operate the platform: with the lawyers a client engages, with payment processors (Stripe) when payments are processed, with ezyshield (ezyshield.com.au), our payee-verification partner, when a client’s settlement payout account is verified — with the client’s consent we share their name, contact details, and bank account details, and any identity documents or biometric data collected during the verification are held by ezyshield, not by ezylegal — with email and SMS providers when notifications are sent, and as required by law. Between firms, a firm sees only the matters it acts on and the matters offered to it; the exceptions described below are the enquiry stage, our own practice, and matters shown to law practices on the platform so one can take them on.

When you make a new enquiry — including by speaking with ezyAgent, our phone assistant — the details you give us are collected by ezylegal Technology Pty Ltd, which operates this platform. We usually disclose those enquiry details, being your name, contact details and a summary of the matter you describe, to MPD Law Pty Limited trading as Ezylegal Law — ABN 44 616 321 236, our associated law practice, as well as to our own platform administrators. This happens for every new enquiry, at the time the enquiry is made, and before any decision about which law practice will act for you. It means Ezylegal Law may receive your enquiry details even where another firm goes on to take your matter, or where no one does. If you would prefer your enquiry not to be shared this way, tell us at the start of the call or email [email protected]. That choice covers the disclosure described above. It does not stop us showing your matter to other law practices so one can take it on, which we describe next.

Where your matter is waiting for a law practice to take it on, we may also show it to other law practices on the platform so one can take it on. At that stage they see details such as the type of matter, the state or territory it is in, the court or tribunal if there is one and what it is worth, and in some cases a short summary of what you told us with the names we hold for the people involved removed. A practice that takes your matter on then receives your full enquiry.

When you arrive from one of our marketing pages, the link may carry the name of that landing page and campaign codes. We keep those, together with the page you landed on and the referring site, in a cookie named _ezy_attr for up to 90 days, and we record them against your enquiry when a case is created so the firm can see how you reached us. We use PostHog for product analytics and Google Analytics for site analytics; both receive an identifier for you and the actions you take on the platform, and PostHog stores that data in the United States. Where you arrived from an advertisement we also send conversion signals (that a sign-up occurred, with hashed contact details) to the advertising platform that showed it — Google, Meta, TikTok or Reddit. The landing-page name and the routing decisions described in section 6c are sent only to PostHog, never to an advertising platform. Details you tell Rachel about your matter are never sent to any analytics or advertising provider.

Where your matter can be handled through our guided forms product at forms.ezylegal.ai, operated by ezylegal Technology Pty Ltd, we offer to send a copy of your conversation with Rachel across so you do not have to start again. That happens only when you choose to continue; an AI assistant on that side uses the conversation to help prepare your forms, and some of that processing happens outside Australia. When you submit your forms for a lawyer check, legal staff at the law practice checking your forms who have access to your matter can also read the conversation you had with that assistant for the round being checked, so they can understand what you meant. You are told this at submission, and it applies only to rounds you submit after agreeing to it.

Under the Australian Privacy Principles you may request access to, or correction of, personal information we hold about you. To make a request, contact [email protected].

We use TLS in transit and encrypted storage at rest. Access to production systems is restricted to authorised personnel. Authentication is handled by Better Auth with industry-standard hashing. Stripe Connect handles card and direct-debit payment credentials.

We retain personal information for as long as required to provide the service and to meet legal and professional record-keeping obligations. Closed cases and inactive accounts are reviewed for retention or deletion in line with those obligations.

If you believe we have mishandled your personal information you can contact us first at [email protected]. If unresolved, you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy. Material changes will be notified to users by email or in-product. The “Last updated” date at the top of this page reflects the most recent revision.

If you opt in at sign-up, we send you a short run of emails about your enquiry and ezyLegal’s services, personalised using the goal you described to Rachel. After that, we may send you occasional general check-ins for up to 12 months after you were last active. Every email includes a one-click unsubscribe, effective immediately. Opting out (or never opting in) does not affect emails about your account or active matters.