Privacy Policy

This Privacy Policy (the “Policy”) is issued by Vaz Capital Pty Ltd as trustee for the Vaz Capital Trust (ABN 28 247 067 155), trading as FreeAML (the “Operator”, “we”, “us”, or “our”), the platform operator behind FreeAML (freeaml.com.au) (the “Platform”). The Operator is Vaz Capital Pty Ltd, acting as trustee for the Vaz Capital Trust (ABN 28 247 067 155), trading as FreeAML. Privacy enquiries may be sent to team@freeaml.com.au.

The Platform is AUSTRAC Tranche 2–oriented AML/KYC software for Australian businesses. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”) to the extent those laws apply to us. This Policy should be read with our Terms and Conditions.

This Policy describes personal information that the Operator collects and holds as operator of the Platform, including information about Users (business customers and their personnel), paying Clients, and website visitors.

It does not govern our registry verification provider’s independent collection of identity documents, biometric templates, liveness video, or government-verification payloads, except to the extent that provider returns status, outcomes, and related metadata to the Platform so that we can run the product. That provider’s handling is subject to its own terms and privacy documentation, which you and your Clients should review before completing a verification.

Third-party websites linked from the Platform (including AUSTRAC, payment-provider checkout, and registry-verification flows) are not controlled by us.

The Operator confirms that it does not use identity-document images or biometric identity data for its own secondary purposes (including marketing, advertising profiling, or unrelated product analytics). Responsibility for registry-verification data of that kind resides with our registry verification provider, under that provider’s terms and privacy notices.

When a verification is initiated, the individual typically interacts with that provider’s capture experience (which may include government identity documents, a selfie, and liveness or biometric matching). The Operator does not use those artefacts as a FreeAML marketing or analytics asset.

The Operator may receive, store, and display verification status, outcomes, reference identifiers (such as applicant or session IDs), and related result metadata reasonably required to operate the product (for example, to mark an order complete, generate a customer due diligence report for the User, record watchlist-screening outcome flags, or support a User’s dashboard). Where the provider’s APIs return extracted identity fields (such as name, date of birth, address, or document-type indicators) as part of a status payload, the Operator may persist those fields solely to provide the User-facing report and operational record — not to train unrelated models for advertising, and not to build a biometric matching database of our own.

Our registry verification provider captures identity documents, selfies, and liveness or biometric checks in its flow, and it holds that capture. The Operator stores workflow and outcomes, extracted fields (such as document type, number, or expiry), and reference identifiers so the User can review the result and produce a customer due diligence report. The Operator does not store the raw identity-document image bytes.

Depending on how the Platform is used, the Operator may collect and hold information such as:

• Account and contact details — name, email address, organisation name, role or profession, and similar details you or your organisation provide (including via cookies or a stored visitor profile used to pre-fill forms);
• Order and workflow metadata — verification type, reference notes, short codes, timestamps, questionnaire answers you submit, entity name and registration numbers you supply, beneficial-owner contact details you enter so that a check can be sent, and parent/child order relationships for ownership chains;
• Payment status and commercial fields — whether a session is pending, paid, failed, or refunded; amounts; client-pays flags; mark-up amounts; payment-provider session or payment-intent identifiers; connected-account identifiers; and payout or earnings status. We do not collect full card PAN/CVC on our forms;
• Verification outcomes we receive from our registry verification provider — applicant IDs, verification links, status values, review outcomes, screening result summaries, and related reference data as described in section 3;
• Document metadata that provider returns — document type, number, or expiry, and similar extracted fields, stored so the User can review the check and produce a report. Not the raw identity-document image bytes. Our registry verification provider holds those images;
• Operational and security logs — approximate technical logs such as timestamps, error events, and limited request metadata used to operate, debug, and secure the Platform; and
• Communications content — messages you send to us, and records of transactional emails we send (for example, one-time codes or verification links).

We do not invent additional categories in this Policy. If we later collect new kinds of personal information, we will update this Policy.

We collect personal information:

• directly from you when you use forms, dashboards, or support channels;
• from Clients when they open a link you send and complete payment or details on the Platform;
• from our registry verification provider, the payment provider, the email provider, and other processors as they return status;
• automatically via cookies, local storage, device identifiers (including a browser fingerprint identifier used to recognise returning visitors), and analytics tools; and
• from publicly available sources only where you ask the Platform to look up information you supply (for example, an ABN you enter) through integrated services.

If you do not provide information reasonably required for a feature, we may be unable to complete a verification, payment, or account function.

We collect and use personal information to:

• provide, operate, maintain, and improve the Platform;
• create and manage orders, organisations, team access, and Pro features;
• arrange registry verification through our registry verification provider and display outcomes to the User;
• process payments and mark-up payouts through the payment provider;
• send transactional communications (links, receipts, one-time codes, status updates);
• provide customer support and investigate incidents;
• measure product usage via product analytics, including (where enabled) aggregated funnels and, for the Operator’s product improvement, session replay / autocapture as configured;
• protect the Platform against fraud, abuse, and security threats; and
• comply with law, enforce our Terms, and establish, exercise, or defend legal claims.

We do not sell personal information. We do not use identity-document or biometric verification artefacts for secondary marketing purposes.

Our registry verification provider is an independent provider. When you instruct a verification, personal information necessary to commence the check (such as a Client email address, and entity identifiers you enter) is transmitted to that provider so that it can create an applicant and verification link. The provider then collects identity evidence directly from the individual.

FreeAML does not use ID documents, selfies, or biometrics as a FreeAML marketing or analytics asset. We may receive verification status, outcomes, and reference IDs (and related result metadata) as needed to run the product. Our registry verification provider states that it may store identity information in Australia or overseas. Overseas processing can include the United States, Germany and the European Union. For that provider’s collection practices, retention, overseas processing, and individual rights in respect of the raw identity evidence, please refer to its published terms and privacy notices. We do not control that provider’s systems. The provider’s name is in the Data Processing Agreement.

Payments are processed by an independent payment provider. Card details are typically entered on that provider’s hosted pages or components. The provider handles cardholder data in accordance with its terms and privacy policy, and it processes payment data in the United States and other countries where it operates. The Operator receives payment status, identifiers, and limited billing metadata required for fulfilment, receipts, mark-up, and accounting — not your full card number.

If you onboard for mark-up payouts, the payment provider will collect identity and bank details from you as its customer or connected account. That collection is the payment provider’s. The provider’s name is in the Data Processing Agreement.

We use email to send one-time passcodes, verification links, beneficial-owner capture requests, and similar transactional messages. The email provider processes the recipient address and message content for delivery. Email is sent from Japan. Message content, delivery logs, and open and click events are stored in the United States. Sign-in uses a one-time passcode by email. The sign-in provider processes your email address, IP address, and device details in the United States. You may receive operational messages that are not marketing. If we send optional marketing, we will do so in accordance with the Spam Act 2003 (Cth) and APP 7, with an unsubscribe where required. The providers’ names are in the Data Processing Agreement.

The Platform uses cookies, local storage, and similar technologies, including:

• Functional cookies / storage — for example, verifier contact pre-fill cookies, a session cookie associated with authenticated use, and a visitor identifier stored locally (including a fingerprint-derived identifier) to recognise returning browsers;
• Product analytics — where a project key is configured, the analytics provider may use cookies and local storage, capture page and product events (custom events are limited to allowlisted operational properties such as order identifiers, amounts, and status), and may enable autocapture and session replay, which can record interactions in the browser interface. Custom analytics events are designed not to forward emails, one-time codes, identity-verification payloads, or verification links; session replay and autocapture may still capture on-screen content. The analytics provider stores this analytics data in the United States; and
• Third-party cookies on the payment provider’s or our registry verification provider’s domains when you use those flows.

You can control cookies through your browser settings. Blocking cookies may degrade features such as sessions or pre-fill. Analytics may be unavailable in environments where the analytics key is not configured.

We use first-party systems and third-party processors to operate the Platform. They process personal information on our instructions or, in some cases (notably our registry verification provider and the payment provider, in respect of their own hosted collection), as independent handlers of data they collect. Your FreeAML records, meaning the database, uploaded files, and backups, are hosted in Sydney, Australia, and the application servers that read and write them run in Sydney. Processors commonly used include:

• Database, file storage, and backups — hosted in Sydney, Australia;
• Application hosting — application servers run in Sydney, Australia. Content delivery is global, and logs and account data can be processed in the United States;
• Sign-in — one-time passcode sign-in for firm users, United States;
• Transactional email — sent from Japan and stored in the United States;
• Payments and payouts — United States and other countries where the payment provider operates;
• Product analytics — including autocapture and session replay, United States;
• Registry verification — our registry verification provider states that it may store identity information in Australia or overseas. Overseas processing can include the United States, Germany and the European Union. It uses its own sub-processors; and
• In-app assistant — Sarah. Messages you send, and the account details she reads, may be processed outside Australia, including in the United States. Section 23 describes Sarah.

We do not claim particular security certifications (for example ISO or SOC reports) in this Policy. Any certifications held by a processor belong to that processor and should be verified with them if material to you. This Policy names providers by type and country. The Data Processing Agreement names each provider.

If you are a firm customer, the Data Processing Agreement describes how we process personal information for you, including the sub-processors above. Our registry verification provider’s data-processing terms are between that provider and the Operator. You do not sign that provider’s DPA by using the Platform.

Your FreeAML records, meaning the database, uploaded files, and backups, are hosted in Sydney, Australia, and the application servers that read and write them run in Sydney.

It is likely that some personal information is disclosed to, and stored or processed by, providers outside Australia:

• United States: sign-in (your email address, IP address, and device details); transactional email (recipient addresses, message content, and delivery, open, and click events); payments (payer name, email, and card and billing details); product analytics, including session replay. Hosting logs and account data can be stored in the United States. If you connect it, the ChatGPT connection is also processed in the United States.
• Japan: transactional email is sent from Japan before delivery.
• Outside Australia, which may include the United States: the in-app assistant (messages you send it, and the account details it reads to answer).
• Australia or overseas, including the United States, Germany and the European Union: registry verification. Our registry verification provider states that it may store identity information in Australia or overseas. Overseas processing can include the United States, Germany and the European Union, and it uses sub-processors in other countries.
• Other locations, for support and operations: our database and hosting providers can access or log limited information from outside Australia to support and secure their services.

Australian Privacy Principle 8 applies to these disclosures. Those countries may not have privacy laws equivalent to Australia’s. We take reasonable steps so that overseas recipients do not breach the APPs in relation to the information, including by using providers bound by written data-processing terms. We cannot control every aspect of a provider’s global operations. Integrations you connect yourself, such as Zapier, Make, n8n, or Microsoft Power Automate, run under your own agreement with that provider.

We aim to keep your FreeAML verification records for at least 7 years from the date of the check, so you can open order history and export what you need while you have access. That supports your file. It does not replace your duty, if you are a reporting entity, to keep the AML/CTF records the law requires, for the period and in the form the law requires. That period is often measured from the end of a business relationship, not only from the date of a check. Leaving a check in FreeAML is not, by itself, that statutory file. FreeAML is not your system of record for AUSTRAC retention.

Retention for other personal information, such as short-lived logs or payment records kept for tax, can be shorter or longer as reasonably necessary to run the Platform, resolve disputes, enforce agreements, and meet legal and accounting duties. We may delete or de-identify information when it is no longer reasonably required, subject to legal holds, the daily backups described below, and the wind-down access described in the Terms.

For continuity and disaster recovery, we keep daily backups of your FreeAML records with our hosting provider for 7 days. Those backups are for recovery if the live system fails. They are not a long-term archive, and they do not include uploaded files.

If the operator of FreeAML enters insolvency, administration, or a controlled wind-down of the Platform, we aim to keep your access available for 12 months from the date we notify you that the wind-down has started, with reminder emails to the contacts we hold for your firm, so you can download your data. Details are in the Terms and the Data Processing Agreement. This is an operational commitment, not a guarantee that a liquidator or court will preserve the systems. This section is subject to this Policy, the Terms, and the Data Processing Agreement.

FreeAML does not retain raw identity-document image bytes. Our registry verification provider holds that capture. Identity-document and biometric retention by that provider is determined by the provider, not by this Policy. We do not restate a timetable the provider has not fixed.

We take reasonable steps to protect personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure, including access controls, encrypted transport (HTTPS), and limiting staff access on a need-to-know basis. No method of electronic storage or transmission is completely secure. Third-Party Services apply their own security measures.

You must protect verification links, one-time codes, and account access as described in the Terms.

We take steps to detect, contain and assess security incidents that affect personal information we hold.

If a confirmed security incident compromises personal information we hold for your firm’s FreeAML workspace, we notify you without undue delay and no later than 72 hours after we become aware of the incident, using the contact details we hold. That period starts when we become aware of a confirmed incident. It does not start on mere suspicion. The first notice covers what we know at the time, and we then keep you updated as we learn more. The commitment to your firm is set out in the Data Processing Agreement.

If we suspect an eligible data breach under the Notifiable Data Breaches scheme (Privacy Act, Part IIIC), we assess it as soon as practicable. The scheme expects that assessment within 30 days. If we believe an eligible data breach has occurred and we are the notifying entity, we notify the Office of the Australian Information Commissioner and the individuals at risk as soon as practicable. Where personal information is held jointly with your firm or another APP entity, we cooperate so that one of us notifies, as the Privacy Act allows, and we give you information we hold that you reasonably need for your own assessment. Telling you about an incident does not move your AML/CTF duties onto us.

If identity evidence sits only with our registry verification provider, we will point you to that provider. The provider’s name is in the Data Processing Agreement.

Report a suspected incident or privacy concern to team@freeaml.com.au with “Privacy” or “Security vulnerability” in the subject.

See the OAIC’s Notifiable Data Breaches guidance.

We may disclose personal information:

• to the User organisation that initiated a check, as the customer of the Platform;
• to processors listed above, to provide the service;
• to professional advisers, insurers, or prospective buyers of the Operator’s business, under confidentiality arrangements;
• if required or authorised by law, court order, or a regulator (which may include AUSTRAC or law enforcement) — without converting the Operator into your reporting agent; and
• with your consent, or as otherwise permitted by the Privacy Act.

In plain but formal terms, the APPs require (among other things) that we: manage personal information in an open and transparent way (APP 1); give you this Policy (APP 1.3–1.4); not collect information unless reasonably necessary for our functions (APP 3); collect fairly and lawfully, and usually from you where reasonable (APP 3–4); notify you of collection at or around the time of collection (APP 5); use and disclose only for the primary purpose or a related purpose you would reasonably expect, or with consent, or as required/authorised by law (APP 6); not use government identifiers as our own (APP 9); take reasonable steps to ensure quality (APP 10) and security (APP 11); give access (APP 12) and correction (APP 13) on request, subject to lawful exceptions.

You may request access to, or correction of, personal information we hold about you by emailing team@freeaml.com.au with sufficient detail for us to identify you and the information sought. We may need to verify your identity. We will respond within a reasonable period. We may refuse in the circumstances permitted by the APPs (for example, where giving access would unreasonably impact another person’s privacy, or is frivolous). If we refuse, we will provide written reasons and information about how to complain, unless it is unreasonable to do so.

If you are not satisfied with our handling of a privacy complaint, you may complain to the Office of the Australian Information Commissioner (OAIC) (oaic.gov.au). We encourage you to contact us first so that we can attempt to resolve the matter.

Requests relating solely to identity documents or biometrics held by our registry verification provider should be directed to that provider, although we will reasonably assist by pointing you to the relevant provider where we can. The provider’s name is in the Data Processing Agreement.

We may use contact details to send information about the Platform where permitted by APP 7 and the Spam Act, including where you would reasonably expect this in connection with your use of a business product. You may opt out using the mechanism in the message or by emailing us. Transactional messages about existing orders or security are not marketing.

The Platform is intended for Australian businesses and adult professional users. It is not directed at children. We do not knowingly collect personal information from children for the purpose of offering the Platform to them. Identity verification of adults may incidentally involve dates of birth. If you believe we have collected information from a child contrary to this Policy, contact us and we will take reasonable steps to delete it where appropriate. Our registry verification provider’s age and identity rules apply to its capture flows.

We may update this Policy from time to time by publishing a new version on the Platform and revising the “Current as at” date. Material changes may additionally be notified by email or in-product notice where reasonably practicable. The version published at freeaml.com.au/privacy is the current Policy.

This section was added on 10 October 2026. It covers the FreeAML connection you can add in ChatGPT and similar assistants. It does not change how identity checks work on freeaml.com.au.

What is collected. If you connect a workspace, we receive the email you sign in with and the workspace you choose. When you prepare a verification we receive the client email, and any reference, role, payer choice, and check type you provide. Public questions about AML obligations are received without a sign-in. We do not ask the assistant for identity document numbers, dates of birth, card details, or passwords.

Why. We use that information to show your workspace, your verifications, and your credit balance, to prepare an invite, and to email it only after you confirm. Public answers explain FreeAML’s checks and point you to published AUSTRAC or FreeAML pages. They are general information, not legal advice.

Who receives it. The operator of FreeAML receives the tool call so it can run. The assistant provider (for ChatGPT, OpenAI) receives the reply it shows you, under that provider’s own terms. OpenAI processes that information in the United States. Your client receives the verification email when you confirm a send. We do not sell this information. This section is about an assistant you connect yourself. Section 23 covers Sarah, the assistant inside FreeAML.

How long it is kept. A confirmation lasts 10 minutes and works once. Verification records stay with your workspace under the retention section of this Policy. Public questions are not stored as a client file. Short-lived rate-limit counters for those questions are kept in memory and then discarded. The chat transcript stays in your assistant account under that provider’s settings.

Your controls. You can disconnect the assistant in its settings, which stops new calls on that connection. Nothing is emailed until you confirm a card. You can ask for access or correction under section 17. Questions about this connection can go to team@freeaml.com.au or to our support page.

This section was added on 12 October 2026. It covers the FreeAML Chrome extension. It does not change how identity checks work on freeaml.com.au.

You can add it from the Chrome Web Store. Add to Chrome.

What is collected. If you sign in, we receive the email you use and the workspace you choose. When you send a verification we receive the client email, and any reference, role, payer choice, check type, and service charge you set for that verification. While you are signed in, on a site you have allowed, the extension sends us email addresses it finds on that page so it can show the latest verification status in your workspace. We do not ask the extension for identity document numbers, dates of birth, card details, or passwords.

Why. We use that information to show status beside an email, to list your recent checks, and to email a verification link when you confirm Send. Your client enters their own details on that link.

Who receives it. The operator of FreeAML receives the request so it can run. Your client receives the verification email when you send a check. Chrome stores the connection on your browser. We do not sell this information.

How long it is kept. The extension connection is stored as a hash and expires after 90 days unless you sign out sooner. A sign-in grant lasts 10 minutes and works once. Allowed sites are kept until you remove them. Verification records stay with your workspace under the retention section of this Policy. Status lookups are not stored as a browsing history.

Your controls. You choose each site before the extension can read it. You can remove a site in the extension, sign out on this browser, or sign out everywhere to revoke every extension connection for that workspace. You can ask for access or correction under section 17. Questions about this connection can go to team@freeaml.com.au.

This section was added on 23 October 2026. Sarah is an AI assistant inside FreeAML. She answers questions about the Platform and can prepare actions for you to confirm. This section does not change how identity checks work, and it is separate from section 21, which covers an assistant you connect yourself.

What Sarah accesses. Sarah reads only what your login can already see in FreeAML, such as checks in your workspaces, your team list, and your credit balance. She can’t see other firms’ data. Email addresses Sarah reads from your team list are masked. What is sent to the AI provider can include client or entity names and, for a single check, your client’s email address. The messages you type can include a client email or a reference, and those messages are part of what is sent to the AI provider.

Where that processing happens. When you use Sarah, the messages you send, and the account details Sarah reads to answer, are sent to an AI provider. That processing may happen outside Australia, including in the United States. The provider’s name is in the Data Processing Agreement. Sarah does not ask for identity document numbers, dates of birth, card details, or passwords, and you should not type them.

What is stored, and what needs your confirmation. Nothing is emailed to your client, and no account change is made, until you confirm. FreeAML does not keep a separate copy of the chat transcript with your records. We keep an activity log of which tools and actions Sarah used. That log does not include the message text. The activity log, a short-lived confirmation of an action you are about to take, and usage limits for Sarah, are stored with your FreeAML records in Sydney.

Privacy requests, questions, and complaints: team@freeaml.com.au. Please include “Privacy” in the subject line and sufficient detail for us to investigate.

Vaz Capital Pty Ltd as trustee for the Vaz Capital Trust (ABN 28 247 067 155), trading as FreeAML · FreeAML (freeaml.com.au) · Current as at 23 October 2026 (Melbourne, Australia)