Trust

Data processing terms

Last updated 22 October 2026

Draft under legal review. Published so that customers and their advisers can read it before it is finalised; it may change before it takes effect.

1. Roles

The customer decides why and how personal information in Customer Data is processed, and is responsible for its own obligations to End Users. We process it as the customer's service provider, only to provide the Service, and act on the customer's instructions given through the Service's settings, the Terms and these terms.

2. What we process

Conversation turns and replies submitted for grading (held only until graded), findings and metadata, quoted spans where the customer retains them, and the names and email addresses of the customer's users. The categories of people are End Users of the customer's AI systems and the customer's own staff.

3. Our commitments

• Process the information only to provide the Service, and never to train a general-purpose AI model.
• Make sure our staff are bound to confidentiality, and limit their access as our security overview describes, including two-person approval for any access to content.
• Maintain the technical and organisational measures in the security overview, and not reduce their overall protection.
• Notify the customer without undue delay, and within 72 hours of becoming aware, of a personal information breach affecting Customer Data, and help the customer respond, including with notifications the law requires.
• Help the customer respond to requests from individuals and regulators, as far as the Service allows.
• On the end of the Terms, delete Customer Data 28 days after the account closes, except where the law requires us to keep it; and while the account is open, delete each record seven years after it was recorded, after at least 30 days' notice, unless a legal hold applies.
• Make available the information reasonably needed to show compliance with these terms, including our security documentation and, once available, independent audit reports.

4. Sub-processors

The customer authorises the sub-processors on our sub-processor page. We will give at least 30 days' notice, by email to owners and in the console, before a new sub-processor processes Customer Data; a customer that objects on reasonable grounds may end the affected Service without penalty. We remain responsible for our sub-processors' performance of these obligations.

5. Transfers

Customer Data is processed in Australia. Account and billing information is processed overseas by the sign-in, payment and email providers named on the sub-processor page, under their own terms, which we review for protections substantially similar to the Australian Privacy Principles.

6. Liability

The limits in the Terms apply to these terms, except where a separately signed agreement says otherwise.