Privacy Policy

1. What we collect

• Account information: your name, email address, organisation, role and what you mainly do (the persona you choose), and the professional details you add for the sign-off on documents you issue.
• Sign-in information: the one-time codes we send (stored only in a hashed form), and your session.
• Billing information: the organisation's billing contact and ABN. Card details are collected and held by Stripe; we never receive the full card number.
• Your organisation's content: the documents, records, drafts, notes, correspondence and issued reports your organisation puts into or creates in the service. These may contain personal information about other people, such as staff, contractors, customers or people involved in incidents.
• Usage and audit information: what you do in the service (the activity log, such as uploads, drafts, issues and approvals), and the capture signals and watermark identifiers described in the Acceptable Use Policy (screenshot and snipping shortcuts, printing and large copies, with the page, time, IP address and browser).
• Technical information: IP addresses, browser and device details, and logs our infrastructure keeps to run and secure the service.
• Enquiries: what you send us when you contact us or apply for bulk pricing.
• Affiliate program: if you apply to be an affiliate, your name, email address, business, ABN, GST registration, website and what you tell us about who you'd refer; once you're approved, the bank account you give us for payment (stored encrypted) and your referral statements.
• Website assistant: the conversation you have with the AI assistant on madeshield.com, the page you started it on and your IP address, and any details you choose to leave in it. Conversations are answered by an AI model run by Cloudflare on our behalf, kept so our team can follow up and improve the assistant, and a conversation in which you leave your details becomes an enquiry.

2. Why we collect and use it

• to provide the service: sign you in, run your organisation's workspace, draft with the AI assistant, and issue and verify documents;
• to administer the trial and billing, and send service and billing emails (such as sign-in codes, trial reminders and invoices);
• to send trial owners and administrators two optional getting-started emails about using the service; each has an unsubscribe link, which stops these emails while essential account notices continue;
• to protect the service and enforce the Terms and Acceptable Use Policy, including through the audit log and watermark;
• to support you and respond to your enquiries;
• to run the affiliate program: review applications, work out which organisations were referred through an affiliate's link, and pay affiliates; and
• to meet our legal obligations.

We handle your organisation's content as its service provider, only to provide the service to it. We don't sell personal information, and we don't use your content to train AI models.

3. Who we disclose it to

We use these service providers, each only for the purpose shown:

• Cloudflare, Inc. hosts the service and its data (compute, storage, email delivery and routing) and runs the in-app AI assistant's models on Cloudflare Workers AI.
• Stripe, Inc. and its affiliates process payments and issue invoices.
• Google LLC measures which of our ads lead to trial sign-ups and paying customers (see section 8).
• The providers of the AI models on Cloudflare Workers AI process the content of assistant requests through Cloudflare's platform to answer them.
• Anthropic, Microsoft or OpenAI, only if someone in your organisation connects the service to Claude, Microsoft 365 Copilot or OpenAI Codex. What they read through that connection goes to that provider under the terms of the account the person connects.

Within your organisation, the people your organisation adds can see its programmes; administrators can see the organisation's activity. We may also disclose information where the law requires or permits, such as to respond to a lawful request or to protect our rights.

4. Overseas disclosure

Our service providers operate globally. Cloudflare processes data through its network, including outside Australia; we do not guarantee Australian-only processing or storage. Stripe and external assistant providers may process information in the United States and other countries. We take reasonable steps, including through our provider agreements, to protect personal information consistently with the Australian Privacy Principles.

5. Security and retention

Each customer's workspace runs separately from others, access requires a signed identity for that organisation, and we restrict our own staff's access to what is needed to support the service. No system is completely secure, and we'll notify you and the Office of the Australian Information Commissioner of an eligible data breach as the Notifiable Data Breaches scheme requires.

We keep account and content data while your organisation's account is active. After a trial ends without billing or a subscription is cancelled, we keep it for 90 days and then delete it. We keep audit log entries, billing records and records we need for legal reasons for as long as those reasons require (for example, tax records for the period the law requires).

Private backups of document files and the platform's account database are kept for up to 30 days. Deleting an organisation removes its tenant document-file backup copies immediately; historical platform database backups can retain its account and personal information for up to a further 30 days, until those backups expire. If an older database backup is restored, deletion and purge are reapplied before access is reopened. Capturing document files is incremental, so a large workspace's completed backup can be more than a day old. Recovery of document files and programme records is managed separately and checked for consistency.

6. Access and correction

You can see and update most of your account information in the service. You may ask us for access to, or correction of, personal information we hold about you through https://madeshield.com/contact (choose "Privacy"). We'll respond within 30 days. If the information is part of your organisation's content, we may refer you to your organisation, which controls it.

7. Complaints

If you have a concern about how we've handled your personal information, tell us through https://madeshield.com/contact (choose "Privacy"). We'll acknowledge it within 7 days and aim to resolve it within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. Website

We keep daily aggregate counts of article page views and clicks on our campaign links to understand which content is useful. These counters store the article, day and campaign source, without visitor identifiers, IP addresses, cookies or raw referring URLs. Repeat visits may be counted more than once. This is separate from the advertising measurement below.

The public madeshield.com website uses the Google tag to measure which of our ads lead to trial sign-ups. The tag loads from Google, which receives your IP address, browser details and the page you're on, and it sets first-party cookies on madeshield.com (such as _gcl_au, and _gcl_aw when you arrive from one of our ads) that hold an identifier and, where there is one, Google's click identifier. We set the tag so that your visits aren't used for ad personalisation or remarketing, and we don't send Google your name or email address.

Your browser also keeps, in its own storage on madeshield.com, how you first reached the site (the page, any campaign tags in the link and, if you came from one of our ads, Google's click identifier) for up to 90 days, and separately the most recent click identifier from one of our ads, with its campaign tags and when it was recorded. When you start a trial, we record these with it. If your organisation later becomes a paying customer, we tell Google Ads that the click led to a customer, using only a click identifier.

If you reach the site through an affiliate's link, your browser keeps that affiliate's code in its own storage on madeshield.com for up to 90 days, and we record it with a trial you start in that time, so we can pay the affiliate. We count clicks on each affiliate's link per day, without visitor identifiers or IP addresses. An affiliate sees that a referral exists and where it stands (on a trial, paying, bounty earned), but not your name or your organisation's.

You can stop or limit this by clearing or blocking cookies and site data for madeshield.com in your browser, by using a browser or extension that blocks the Google tag, or through your Google ad settings (myadcenter.google.com). Blocking only third-party cookies doesn't stop it, because these cookies are set on madeshield.com itself. The site works the same without them.

The service itself (your organisation's workspace) doesn't use advertising or analytics cookies. The sign-up and sign-in forms use Cloudflare Turnstile to tell people from bots, and signing in sets a session cookie that the service needs to work.

9. Changes and contact

We may update this policy and will post the new version here, with its date. For a change of substance we'll also email account owners. Contact: Made AI Pty Ltd, https://madeshield.com/contact.