Pincite Privacy Policy

Effective: 4 August 2026

Pincite Pty Ltd (ACN 700 309 753 | ABN 43 700 309 753) (Pincite, we, us, our) provides an online tool that helps users format and manage legal citations. This policy explains how we collect, hold, use and disclose your personal information, and how you can access it, correct it, or make a complaint.

We handle personal information in accordance with the Australian Privacy Principles (the APPs) in the Privacy Act 1988 (Cth) (the Privacy Act). Because of our current size, the Privacy Act may not strictly require us to do this. We have chosen to comply, and we consider ourselves bound by this policy. You can read the APPs in full on the website of the Office of the Australian Information Commissioner (the OAIC) at https://www.oaic.gov.au.

This policy forms part of our Terms and Conditions. Capitalised terms not defined in this policy have the meanings given to them in clause 18 (Definitions) or in the Terms and Conditions.

1. Scope

This policy applies to personal information we collect through the Website, including when you browse our Website, create an Account, subscribe, use the citation generator, save Projects, or contact us for support. It does not cover the citation content itself (for example, case names or statute titles) unless that content also happens to identify you.

2. Personal information we collect, and why

2.1 What we collect. We collect the following personal information for the purposes described:

2.2 Payment details. We do not collect or store your full payment card details. They are collected and held directly by our payment processor, Stripe.

2.3 Sensitive information. We do not collect sensitive information (such as health, racial or ethnic information). You should not enter confidential, privileged or sensitive material into Pincite. If you send us sensitive information we have not asked for, we will only use it for the purpose for which you provided it, or as the law requires, and will delete it if it is not needed.

2.4 Children. Pincite is for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have, we will delete it and close the Account, and refund any unused Fees.

3. How we collect personal information

Where practical, we collect personal information directly from you — when you create an Account, subscribe (through Stripe's checkout), save a Project, contact support, or take part in our referral program. We also collect some information automatically through cookies and analytics tools when you use our Website (see clause 8).

4. What we will never do with your information

• (a) We will never use your Projects, your citation content, or other content you submit through Pincite to train, fine-tune, evaluate or develop any artificial intelligence or machine learning model, whether ours or anyone else's.
• (b) We will never permit a service provider to use that content for those purposes on our behalf. This does not prevent a provider from processing your content strictly as necessary to provide its service to us, subject to appropriate confidentiality and security obligations.
• (c) We will never sell your personal information, and we will never share it with data brokers or advertisers.
• (d) We will never publish your Project content.
• (e) We do not use artificial intelligence or machine learning to generate your citations. Pincite runs on rules-based logic that we author and maintain.

5. How we use your information to improve Pincite

We analyse aggregated and de-identified information about how Pincite is used — for example, which citation types most often produce errors, or which fields users most often leave blank — so that we can identify and remedy the parts of the product that do not work well. "De-identified" means the data does not identify you and you cannot reasonably be re-identified from it. This is subject to the commitments in clause 4; in particular, this data is never used to train an artificial intelligence model.

6. How we hold and secure your information

• (a) Your Account and Projects data is stored in a Supabase database hosted in the Sydney, Australia region.
• (b) Payment card details are held by Stripe, not by us.
• (c) We restrict internal access to what is needed to run the service, using database-level access controls (Row Level Security).
• (d) We use multi-factor authentication on all our administrative and infrastructure accounts.
• (e) We take reasonable technical and organisational steps to protect your information from misuse, loss, and unauthorised access, modification or disclosure.

No method of storage or transmission is completely secure, but we keep our practices current as Pincite grows.

7. Data breaches

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the OAIC as soon as practicable, and tell you:

• (a) what happened and what information was involved;
• (b) what we are doing about it; and
• (c) what you should do to protect yourself.

We make this commitment voluntarily, and we will follow it whether or not the Notifiable Data Breaches scheme strictly applies to us.

8. Cookies and analytics

Our Website uses cookies and similar technologies through:

• (a) Google Analytics — to understand traffic and how visitors use our Website;
• (b) Vercel Analytics — to monitor Website performance and usage; and
• (c) Clarity — to record how visitors move through our public pages.

These may collect your IP address, device and browser type, pages visited, and general location. You can control or disable cookies through your browser settings, though some parts of Pincite may not work properly if you do.

8.1 What Clarity records. On our public pages Clarity records user clicks and mouse movement. This will be used to find the places where our pages confuse people, so that we can fix them.

8.2 Where Clarity does not run. Clarity does not run on the citation generator, on your saved Projects, or on your Account settings. Your citation work is never recorded. We have also configured those parts of Pincite so that their contents are withheld from Clarity even if you move into them from a public page during the same visit.

8.3 What is excluded from Clarity. Anything typed into a sign-up, sign-in or password form, or any page accessed on your dashboard or settings, is not recorded.

8.4 Turning it off. Most browsers offer tracking protection, and content-blocking extensions will also block these services. Either will stop Clarity and our other analytics tools from recording your visit.

9. Overseas disclosure of personal information

Some services we rely on are provided by overseas companies. This means your personal information may be handled by staff, infrastructure or servers located outside Australia, even where we have chosen an Australian hosting region.

Before disclosing personal information to an overseas service provider, we take reasonable steps, appropriate to the nature of the information and the service involved, to ensure that provider handles the information consistently with the APPs. These steps may include contractual privacy, confidentiality, security and data-breach notification obligations, and appropriate controls over the provider's use of subcontractors. We remain responsible for our own handling of personal information, and where the Privacy Act applies, we will take the steps required by APP 8 in connection with overseas disclosures unless an exception under the Privacy Act applies.

By using Pincite, you acknowledge that your personal information may be disclosed to the overseas providers identified in this clause for the purposes described in this policy. This acknowledgement does not reduce any rights you may have under applicable privacy law. We encourage you to review each provider's own privacy policy.

10. How we use and disclose your information

10.1 Purposes. We use and disclose your personal information for the purposes in clause 2, and for closely related purposes you would reasonably expect, such as:

• (a) responding to support requests;
• (b) sending you service emails (renewal reminders, receipts, security notices);
• (c) detecting and preventing fraud or misuse; and
• (d) improving Pincite, as described in clause 5.

10.2 Disclosure. We only disclose personal information to:

• (a) the service providers listed in clause 9, to the extent needed for them to perform their function;
• (b) anyone else with your consent; or
• (c) where required or authorised by law.

10.3 Direct marketing. We will only send you marketing emails if you have consented, and every one will contain an unsubscribe link. Service emails (billing, security, renewal reminders) are not marketing, and you will receive them while you hold an Account.

11. If our business is sold

If Pincite is sold, merged, or restructured, your personal information may transfer to the purchaser, successor or relevant related body corporate as part of that transaction. In that event:

• (a) before any transfer of personal information takes effect, we will take reasonable steps to require the recipient to handle that information in accordance with this policy, or under a privacy policy that provides materially equivalent protection;
• (b) we will take reasonable steps to require the recipient not to use your Projects, your citation content, or other content you submit through Pincite to train, fine-tune, evaluate or develop any artificial intelligence or machine learning model;
• (c) we will give you reasonable notice by email before a material transfer takes effect, where reasonably practicable, so that you can export your Projects or delete your Account first if you would prefer; and
• (d) if a future owner proposes a material change to the commitments in clause 4, it must give you notice and obtain any consent required by law before using your personal information in the changed manner.

12. Anonymity

You can browse our public pages anonymously. To use most Pincite features you will need an Account, so full anonymity is not possible for those.

13. How long we keep your information

13.1 Cancelled subscriptions. If you cancel your subscription but keep your Account, we keep your Account and Projects so that you can return to them. Cancelling does not delete anything.

13.2 Inactive accounts. If an Account has no login activity for 24 months, we may delete it and its data, but we will never do so without warning you. We will email you 30 days before deletion, and again seven days before deletion, each time with a link to keep your Account and a link to export your Projects. If you log in at any point, the 24-month period resets. We will not delete an Account under this clause while you have a current paid subscription, unless the Account is suspended or terminated under our Terms and Conditions.

13.3 Deleting your account. Before deleting your Account, you can export your Projects from your Account settings. If you delete your Account, we remove your Account and Projects from our live production systems and disable access to them. Copies may remain in encrypted database backups after deletion; these are not available for ordinary use, and we access them only where reasonably necessary to restore the service after a failure. Backups are overwritten within 30 days after deletion, unless a longer period is required by law or is reasonably necessary for disaster recovery, security or legal purposes. Once overwritten, the data cannot be recovered. If we restore a backup after you delete your Account, we will take reasonable steps to ensure your deleted Account and Projects are not returned to active use.

13.4 Deletion on request. You may also ask us by email to delete your personal information. We will complete a verified request within 30 days after we receive it, and may take reasonable steps to confirm you are the Account holder before acting. Our deletion obligations are subject to clause 13.5.

13.5 Retention required by law or for limited purposes. After your Account is deleted, we may retain only the minimum personal information reasonably necessary to:

• (a) comply with a legal, tax, accounting or record-keeping obligation;
• (b) establish, exercise or defend legal claims;
• (c) investigate or address fraud, security incidents, payment disputes or misuse of Pincite; or
• (d) keep a record that we completed your deletion request.

We will not retain your Projects, and will not use retained personal information for ordinary product, marketing or analytics purposes, after your Account is deleted, unless the law requires it or you give us separate consent. Any information retained under this clause is access-restricted, kept only for the period reasonably necessary for the relevant purpose, and securely deleted or de-identified when it is no longer required.

14. Accessing and correcting your information

We want your information to be accurate, complete and up to date. If anything we hold is wrong or outdated, tell us and we will correct it. You can ask to access or correct the personal information we hold about you at any time (see clause 16). We will not charge a fee, though we may need to verify your identity first, and may charge a reasonable administrative fee only if you ask for a large volume of copies. You can export your Projects yourself, at any time, from your Account settings.

15. Complaints

If you are unhappy with how we have handled your personal information:

• (a) Contact us first, in writing, using the details in clause 16. We will acknowledge your complaint within five business days and aim to resolve it within 30 days.
• (b) If you are not satisfied with our response — or at any time, if you would rather not come to us first — you can complain to the OAIC at https://www.oaic.gov.au or on 1300 363 992.

You are never required to come to us first, and you can go straight to the OAIC.

16. Contact

Pincite Pty Ltd Email: privacy@pincite.com.au ACN 700 309 753 | ABN 43 700 309 753

17. Changes to this policy

We may update this policy as Pincite grows or our practices change. The current version is always available on the Website.

• (a) For minor changes, we will update the "Effective" date.
• (b) For material changes — anything that meaningfully affects how we handle your information — we will give you at least 30 days' notice by email before they take effect.
• (c) We will never weaken the commitments in clause 4 without first asking for your express opt-in consent. Continuing to use Pincite is not consent to that.

Previous versions are available on request.

18. Definitions

In this policy:

Account means the account you create to access Pincite.

APPs means the Australian Privacy Principles in the Privacy Act.

Clarity means Microsoft Clarity, the third-party service we use to record how visitors move through our public pages.

Google Workspace means Google Workspace, the service we use to receive and manage email you send to us.

OAIC means the Office of the Australian Information Commissioner.

Personal information has the meaning given in the Privacy Act.

Privacy Act means the Privacy Act 1988 (Cth).

Projects means the citation work you save in your Account.

Resend means Resend, our third-party email delivery provider.

Stripe means Stripe, our third-party payment processor.

Terms and Conditions means our Terms and Conditions governing the Pincite citation tool, available at https://pincite.com.au/terms, as updated from time to time.

Upstash means Upstash, our third-party provider of rate-limiting and abuse-prevention infrastructure.

Website means the Pincite website at https://pincite.com.au and its subdomains and pages.

you and your mean the individual whose personal information we hold.