Pincite Privacy Policy

Effective: [date of publication]  |  Version: 3.0

Pincite Pty Ltd (ACN [insert] | ABN [insert]) ("Pincite", "we", "us" or "our") provides an online tool that helps users format and manage legal citations. This policy explains how we collect, hold, use and disclose your personal information, and how you can access it, correct it, or make a complaint.

We handle personal information in accordance with the Australian Privacy Principles (the "APPs") in the Privacy Act 1988 (Cth) (the "Privacy Act"). Because of our current size, the Privacy Act may not strictly require us to do this. We have chosen to comply, and we consider ourselves bound by this policy. You can read the APPs in full on the website of the Office of the Australian Information Commissioner (the "OAIC") at https://www.oaic.gov.au.

This policy forms part of our Terms and Conditions. Capitalised terms not defined in this policy have the meanings given to them in clause 18 (Definitions) or in the Terms and Conditions.

1. Scope

This policy applies to personal information we collect through the Website, including when you browse our Website, start a free trial, subscribe, use the citation generator, save Projects, or contact us for support. It does not cover the citation content itself (for example, case names or statute titles) unless that content also happens to identify you.

2. Personal information we collect, and why

2.1 What we collect. We collect the following personal information for the purposes described:

2.2 Payment details. We do not collect or store your full payment card details. They are collected and held directly by our payment processor, Stripe.

2.3 Sensitive information. We do not collect sensitive information (such as health, racial or ethnic information). You should not enter confidential, privileged or sensitive material into Pincite. If you send us sensitive information we have not asked for, we will only use it for the purpose for which you provided it, or as the law requires, and will delete it if it is not needed.

2.4 Children. Pincite is for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have, we will delete it and close the Account, and refund any unused Fees.

3. How we collect personal information

Where practical, we collect personal information directly from you — when you create an Account or start a free trial, subscribe (through Stripe's checkout), save a Project, contact support, or take part in our referral program. We also collect some information automatically through cookies and analytics tools when you use our Website (see clause 8).

4. What we will never do with your information

• (a) We will never use your Projects, your citation content, or anything you enter into Pincite to train, fine-tune, evaluate or develop any artificial intelligence or machine learning model, whether ours or anyone else's.
• (b) We will never sell your personal information, and we will never share it with data brokers or advertisers.
• (c) We will never publish your Project content.
• (d) We do not use artificial intelligence or machine learning to generate your citations. Pincite runs on rules-based logic that we author and maintain.

5. How we use your information to improve Pincite

We analyse aggregated and de-identified information about how Pincite is used — for example, which citation types most often produce errors, or which fields users most often leave blank — so that we can identify and remedy the parts of the product that do not work well. "De-identified" means the data does not identify you and you cannot reasonably be re-identified from it. This is subject to the commitments in clause 4; in particular, this data is never used to train an artificial intelligence model.

6. How we hold and secure your information

• (a) Your Account and Projects data is stored in a Supabase database hosted in the Sydney, Australia region.
• (b) Payment card details are held by Stripe, not by us.
• (c) We restrict internal access to what is needed to run the service, using database-level access controls (Row Level Security).
• (d) We use multi-factor authentication on all our administrative and infrastructure accounts.
• (e) We take reasonable technical and organisational steps to protect your information from misuse, loss, and unauthorised access, modification or disclosure.

No method of storage or transmission is completely secure, but we keep our practices current as Pincite grows.

7. Data breaches

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the OAIC as soon as practicable, and tell you:

• (a) what happened and what information was involved;
• (b) what we are doing about it; and
• (c) what you should do to protect yourself.

We make this commitment voluntarily, and we will follow it whether or not the Notifiable Data Breaches scheme strictly applies to us.

8. Cookies and analytics

Our Website uses cookies and similar technologies through:

• (a) Google Analytics — to understand traffic and how visitors use our Website; and
• (b) Vercel Analytics — to monitor Website performance and usage.

These may collect your IP address, device and browser type, pages visited, and general location. You can control or disable cookies through your browser settings, though some parts of Pincite may not work properly if you do.

9. Overseas disclosure of personal information

Some services we rely on are provided by overseas companies. This means your personal information may be handled by staff, infrastructure or servers located outside Australia, even where we have chosen an Australian hosting region.

We take reasonable steps to ensure these providers handle your information consistently with the APPs, and we encourage you to review their own privacy policies. By using Pincite, you acknowledge that your information may be disclosed to these providers overseas.

10. How we use and disclose your information

10.1 Purposes. We use and disclose your personal information for the purposes in clause 2, and for closely related purposes you would reasonably expect, such as:

• (a) responding to support requests;
• (b) sending you service emails (trial expiry reminders, renewal reminders, receipts, security notices);
• (c) detecting and preventing fraud or misuse; and
• (d) improving Pincite, as described in clause 5.

10.2 Disclosure. We only disclose personal information to:

• (a) the service providers listed in clause 9, to the extent needed for them to perform their function;
• (b) anyone else with your consent; or
• (c) where required or authorised by law.

10.3 Direct marketing. We will only send you marketing emails if you have consented, and every one will contain an unsubscribe link. Service emails (billing, security, renewal reminders) are not marketing, and you will receive them while you hold an Account.

11. If our business is sold

If Pincite is sold, merged, or restructured, your personal information may transfer to the new owner as part of the business. If that happens:

• (a) the buyer must be bound by this policy, or by a policy that is no less protective of you;
• (b) the commitments in clause 4 — including the commitment never to train an artificial intelligence model on your work — bind the buyer too; and
• (c) we will email you before any transfer takes effect, so that you can export your Projects and delete your Account first if you would prefer.

12. Anonymity

You can browse our public pages anonymously. To use most Pincite features you will need an Account, so full anonymity is not possible for those.

13. How long we keep your information

13.1 Cancelled subscriptions. If you cancel your subscription but keep your Account, we keep your Account and Projects so that you can return to them. Cancelling does not delete anything.

13.2 Inactive accounts. If an Account has no login activity for 24 months, we will delete it and its data, but we will never do so without warning you. We will email you 30 days before deletion, and again seven days before deletion, each time with a one-click link to keep your Account and a link to export your Projects. If you log in at any point, the 24-month period resets.

13.3 Deleting your account. If you delete your Account, we delete your Account and Projects from our live systems immediately. Copies may persist in encrypted database backups for a short period as those backups cycle; these are fully overwritten within 30 days, and we do not access them except to restore the service after a failure. After that, the data cannot be recovered.

13.4 Deletion on request. If you ask us by email to delete your information, we will do so within 30 days.

13.5 Retention required by law. We may keep some information longer where the law requires it (for example, transaction records for tax purposes). Where we do, we keep only what is required, and nothing more.

14. Accessing and correcting your information

We want your information to be accurate, complete and up to date. If anything we hold is wrong or outdated, tell us and we will correct it. You can ask to access or correct the personal information we hold about you at any time (see clause 16). We will not charge a fee, though we may need to verify your identity first, and may charge a reasonable administrative fee only if you ask for a large volume of copies. You can export your Projects yourself, at any time, from your Account settings.

15. Complaints

If you are unhappy with how we have handled your personal information:

• (a) Contact us first, in writing, using the details in clause 16. We will acknowledge your complaint within five business days and aim to resolve it within 30 days.
• (b) If you are not satisfied with our response — or at any time, if you would rather not come to us first — you can complain to the OAIC at https://www.oaic.gov.au or on 1300 363 992.

You are never required to come to us first, and you can go straight to the OAIC.

16. Contact

Pincite Pty Ltd Email: privacy@pincite.com.au ACN: [insert] | ABN: [insert]

17. Changes to this policy

We may update this policy as Pincite grows or our practices change. The current version is always available on the Website.

• (a) For minor changes, we will update the "Effective" date.
• (b) For material changes — anything that meaningfully affects how we handle your information — we will give you at least 30 days' notice by email before they take effect.
• (c) We will never weaken the commitments in clause 4 without first asking for your express opt-in consent. Continuing to use Pincite is not consent to that.

Previous versions are available on request.

18. Definitions

In this policy:

"Account" means the account you create to access Pincite.

"APPs" means the Australian Privacy Principles in the Privacy Act.

"OAIC" means the Office of the Australian Information Commissioner.

"Personal information" has the meaning given in the Privacy Act.

"Privacy Act" means the Privacy Act 1988 (Cth).

"Projects" means the citation work you save in your Account.

"Stripe" means Stripe, our third-party payment processor.

"Terms and Conditions" means our Terms and Conditions governing the Pincite citation tool, available at https://pincite.com.au/terms, as updated from time to time.

"Website" means the Pincite website at https://pincite.com.au and its subdomains and pages.

"you" and "your" mean the individual whose personal information we hold.