Privacy policy
Template. This page is a template. Have it reviewed by a lawyer before use.
AML Gap Check (ABN 00 000 000 000) is operated by Your name as a sole trader in Victoria, Australia. Contact: hello@example.com, 0400 000 000, Victoria, Australia.
This policy explains how AML Gap Check (“we”, “us”) collects, uses, stores and discloses personal information. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Even if we are a small business that would not otherwise be covered by the Act, we choose to follow the APPs.
1. What we collect
- Self-check answers. Your answers to the ten self-check questions, and the band and score we work out from them.
- Lead details. Name, agency, email, phone (optional), suburb and sales staff band, given when you ask for your full self-check results.
- Booking details. The review you chose, your name, role, agency, ABN (optional), email, phone, suburb, sales staff band, preferred time, meeting type and any notes.
- Review data. During a review: the agency's answers to the 18 checklist items, notes, a description of the evidence we were shown, owners, target dates, the written summary and report, and invoice and payment records.
- Uploaded documents. PDF and Word files an agency uploads through a private Auto check link, such as its risk assessment, AML/CTF program, procedures or training records, and the text read from them.
- Technical data. Your IP address, used briefly to limit repeated form submissions and failed console logins, and the dates and times shared report links are opened.
We do not ask for, and you should not send, identity documents or customer files belonging to the agency's own clients. We look at evidence during the meeting but do not keep copies unless we agree otherwise in writing.
2. Why we collect it
We use personal information to show you your self-check result, respond to your enquiry or booking, carry out and report on the gap review, issue invoices, arrange the 90-day follow-up where it is included, keep business and tax records, and protect the site from misuse. We do not sell personal information. We do not use it for unrelated marketing without your consent.
3. How it is stored
The site runs on Cloudflare Pages, and data is stored in a Cloudflare D1 database. Cloudflare is a US-based provider that runs data centres around the world. Your information may be stored or processed outside Australia, including in the United States and other countries where Cloudflare operates. We take reasonable steps under APP 8 to ensure overseas providers handle the information consistently with the APPs. You accept that it may be held overseas when you submit a form.
Reports are shared only through private, read-only links. Only a one-way hash of each link is stored, and links can be revoked at any time. The consultant console is protected by a passcode.
3A. Uploaded documents and Workers AI
Uploaded files are stored in a private Cloudflare R2 storage bucket, and their text is stored in the D1 database. Text is read from the files in your browser before upload. To suggest answers for the consultant, the text is processed by Cloudflare Workers AI, a large language model run by Cloudflare. Cloudflare states that it does not use customer inputs to train its models. AI suggestions are checked by the consultant and never change a review unless the consultant accepts them. R2 and Workers AI may store or process data outside Australia. Please do not upload identity documents or files about your own customers.
Uploaded files and their text are deleted automatically 90 days after upload. The consultant can delete them sooner, and you can ask us to.
4. Email (Resend)
If email notifications are turned on, the details of a self-check or booking are sent to us through Resend, an email delivery service that may process data in the United States. If notifications are off, no email is sent.
5. Disclosure
We disclose personal information only to the service providers named above, to our professional advisers (for example an accountant), where you have agreed, or where the law requires or authorises it. We do not report on your agency to AUSTRAC or any other regulator, except where the law requires it.
6. Retention
Uploaded documents are deleted 90 days after upload (see section 3A). Self-check leads that do not become clients are deleted within 24 months. Client review data, reports and invoices are kept for seven years to meet tax and business record obligations, then deleted or de-identified. You can ask us to delete information earlier if we do not need to keep it by law.
7. Access and correction
You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing hello@example.com. We will respond within 30 days. If we refuse, we will tell you why in writing and how to complain.
8. Cookies
The public site sets no cookies and uses no analytics or advertising trackers. The consultant console uses a single cookie, agc_session. It is strictly necessary to keep the consultant logged in, is HttpOnly, and expires after 12 hours. The site remembers your light or dark mode choice in your browser's local storage. That choice is not sent to us.
9. Complaints
To complain about how we handled your personal information, email hello@example.com. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
10. Changes
We may update this policy. The current version is always on this page.
Last updated: [date].