Privacy Policy

1. Introduction and Scope

1.1 About Us

CoeusX Pty Ltd (ABN 19 689 184 361) (“we”, “us”, “our”) operates the Lawg AI-powered tax research and legal information service (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information (“Personal Data”) when you access or use the Service.

1.2 Scope

This Policy applies to:

• Our websites at coeusx.ai and lawg.ai
• The Lawg AI tax research and information service
• The Lawg Chrome Extension
• Our communications with you
• Any other interactions with our business

This Policy does not apply to third-party websites or services linked from our Service.

1.3 Legal Framework

We are bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). If you are located outside Australia, additional rights may apply (see Section 14).

1.4 Purpose of this Policy

This Policy is a notice about our information-handling practices. It does not, by itself, mean that you have consented to every practice described in it. Where consent is required, we will request it separately.

For an overview of specific technical safeguards and their scope, see Security & data handling.

2. Information We Collect

2.1 Information You Provide to Us

• Account Information: Name, email address, and authentication credentials when you register
• User Content: Queries, inputs, documents, and other data you submit to the Service
• Team Workspace Information: Organisation name, membership, invitations, assigned role, active workspace, and content created or published within a team workspace
• Consultation Information: Audio you intentionally capture, transcripts, consent confirmation, live guidance, session settings, and requested post-meeting drafts
• Subscription and Billing Information: Plan, billing interval, seat quantity, subscription status, transaction references, and limited payment metadata. Payment-card details are collected by Stripe and are not stored by Lawg.
• Feedback: Survey responses, support requests, and user feedback
• Third-Party Integration Data: Data you authorise from connected services

2.2 Information We Generate and Collect Automatically

• AI-Generated Content: Responses generated by the Service’s artificial intelligence systems in response to your queries
• Session Data: Session identifiers, timestamps, and interaction data
• Technical Data: IP address, browser type, device information, operating system
• Usage Data: Features used, pages viewed, time spent on the Service
• Location Data: Approximate location derived from your IP address
• Team Access Audit Data: For authorised private-team-chat review, the organisation, reviewer, chat owner, operation, chat identifier, and time of access. The audit record does not copy chat titles, prompts, answers, or source references.

2.3 Information We Receive from Other Sources

• OAuth Providers: When you authenticate via Google or Microsoft, we receive your name, email, and profile picture
• Authentication Provider (Clerk): Verification and session management data
• Connected Services: Data from services you authorise
• Payment Provider (Stripe): Subscription, invoice, payment-status, and customer reference information

2.4 Chrome Extension Data

When using the Lawg Chrome Extension, we collect:

• Selected Text: When you highlight text and use “Ask Lawg”, the selected text is sent to our servers for analysis
• Questions: The suggested question you select or the question you enter is sent to our servers to generate a response
• Authentication: Clerk manages sign-in and sessions for the Extension.
• Request Metadata: Our API receives your IP address, request time, and the Lawg API operation used for quota enforcement, security, and service reliability.
• Page Context: When you activate “Ask Lawg”, the current page URL and title are transmitted with the selected-text request. The current API does not use or persist those fields as part of the answer or chat record.
• Local Storage: The Extension temporarily remembers which tabs are used for sign-in and returning you to your work. It clears that information when sign-in completes, is cancelled, or you sign out.

We do NOT collect through the Extension:

• A list of pages you visit or browsing activity when you do not activate “Ask Lawg”
• Activity tracking across websites
• Any data for advertising purposes

2.5 Chrome Web Store Limited Use

Notwithstanding any broader disclosure elsewhere in this Policy, our use and transfer of information received through the Chrome Extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

• We use Extension data only to provide or improve the Extension’s disclosed purpose and related security, reliability, and abuse-prevention operations.
• We transfer Extension data only when necessary to provide or improve that purpose, comply with applicable law, protect against security threats or abuse, or complete a merger, acquisition, or asset sale after obtaining the user’s explicit prior consent.
• We do not use or transfer Extension data for personalised, retargeted, or interest-based advertising.
• We do not allow humans to read Extension data unless the user has explicitly consented to access specific data, access is necessary for security or legal compliance, or the data is aggregated and anonymised for internal operations.

2.6 Consultation Data

Consultation starts only after you confirm the in-product notice and grant browser access to your microphone and a selected meeting tab. Your microphone audio is sent to Microsoft Azure Speech for transcription. Client meeting-tab audio is streamed through Lawg to OpenAI Realtime for transcription and live guidance. Audio is processed as a live stream; Lawg does not create a persistent audio recording in its application database or object storage.

Final transcripts are held temporarily while the live session is active and may be processed by OpenAI to generate live guidance and the post-meeting drafts you request. The resulting consultation session record, prompts, summaries, and drafts are stored in the workspace in which the session was created. You are responsible for informing participants and obtaining any authority or consent required by applicable law and your firm's policies before capture begins.

3. How We Use Your Information

3.1 Providing the Service

We use your Personal Data and User Content to:

• process queries and generate AI-Generated Content;
• maintain chat history and session continuity; and
• authenticate users and manage Accounts;
• administer subscriptions, team seats, invitations, roles, and workspaces; and
• transcribe authorised consultation audio and generate live guidance and post-meeting materials.

3.2 Improving the Service

• Analysing usage patterns to improve functionality
• Debugging technical issues
• Developing new features based on user feedback

3.3 Safety and Security

We use your information to:

• enforce our Terms of Service;
• detect and prevent fraud, abuse, or unauthorised access; and
• apply automated safeguards, including filtering of prohibited or non-compliant queries.

3.4 Communications

• Responding to support requests
• Sending service-related notifications
• Marketing communications (with your consent)

3.5 Legal Compliance

• Complying with applicable laws and regulations
• Responding to legal requests and court orders
• Protecting our legal rights

3.6 Team Workspaces and Authorised Review

When a team workspace is active, chats, consultations, and uploaded documents created there are scoped to that organisation rather than your Personal workspace. All paid team members receive the product features included in the team's plan; the Member, Super Member, Manager, and Admin roles control collaboration and administration permissions, not product-feature entitlement.

• Member: Uses the team workspace and sees their own content.
• Super Member: Has Member access and may publish their own chats to the shared team library.
• Manager: Has Super Member access and, where the organisation has granted the relevant permission, may list and open private chats created by other members in that team workspace for oversight.
• Admin: Has Manager access and may manage members, invitations, roles, and team settings.

Manager and Admin private-chat review is read-only and recorded in a metadata-only audit trail. Personal workspace chats are not included. Managers and Admins are users authorised by the organisation, not CoeusX personnel. The organisation is responsible for assigning roles appropriately and giving its personnel any workplace, client, or privacy notice required by law. Lawg also displays this review notice in team member settings.

4. AI Features and Third-Party Data Processing

4.1 How We Use AI

The Service uses artificial intelligence to analyse User Content and generate AI-Generated Content for general information only. This includes:

• transforming queries into structured representations (embeddings);
• retrieving relevant Australian legal and tax materials; and
• generating natural language outputs.

AI-Generated Content may contain errors or inaccuracies and should not be relied upon as professional advice.

4.2 Third-Party Service Providers

We share data with trusted third-party providers to deliver the Service:

The table identifies primary hosting and processing locations. Providers may also process information or keep copies in other locations. Section 8 explains overseas processing, and Section 5 explains retention and deletion.

4.3 Data Sharing Principles

• We share Personal Data only to the extent reasonably necessary to provide the Service.
• We do not sell Personal Data.
• CoeusX does not use User Content to train AI models without your consent. External AI processing and retention are described separately in this Policy.
• We assess providers' security practices and applicable contractual and data-processing terms.

5. Data Retention

5.1 Data Retention

We retain Personal Data for as long as needed for the purposes described in this Policy, subject to the arrangements and exceptions below.

• Live Consultation transcripts are temporary and may be kept longer as transcript content is added or post-meeting processing begins. They may be deleted earlier after post-meeting materials are generated. Saved consultation session records, prompts, summaries, and generated materials are retained while the Account or team workspace remains active, unless deleted earlier.
• Deleting an Account removes its personal-workspace content. Team Workspace content remains with the Organisation and follows its own deletion arrangements. Limited account records may be retained for the purposes in Section 5.2.
• When a team workspace is deleted, it can no longer be used. Its chats, documents, stored document versions, and Consultation records are permanently removed within 30 days. A limited record of the Organisation may be retained for billing, security, evidence of deletion, and legal purposes.
• Private-team-chat access audit records are retained for accountability, security, and dispute handling. The complete audit trail for an Organisation is deleted after 12 consecutive calendar months without another audited access to private team content. A new audited access restarts that 12-month period.
• Cached answers expire automatically after a short period. Different retention arrangements apply to chat history, Consultation records, operational records and data held by external AI providers.
• Anonymised usage data may be retained for service improvement and analytics.

These periods apply to the specified Lawg-controlled records. External providers may retain request data and recovery copies under their applicable service terms and account settings. Provider-managed copies have separate retention arrangements and are not covered by Lawg's deletion deadlines.

By default, OpenAI retains API abuse-monitoring logs for up to 30 days, subject to its published exceptions. Other retention periods depend on the API feature and account settings.

5.2 Retention Exceptions

We may retain certain data where necessary to:

• comply with legal obligations;
• enforce our Terms of Service;
• resolve disputes; or
• retain billing, fraud-prevention, security, or transaction records for a period reasonably required for those purposes.

6. Automated Decision-Making

6.1 Content Filtering

We use automated systems (AI-based guardrails) to:

• Filter queries requesting illegal advice
• Redirect off-topic queries
• Detect and prevent misuse

Filtered queries receive an automated response. You can contact support if you need help.

6.2 No Significant Automated Decisions

The Service does not make decisions that have legal or similarly significant effects. It provides general legal information only and does not provide legal, tax, or financial advice.

7. Disclosure of Personal Information

We may disclose Personal Data to:

• Third-Party Providers: Solely for the purpose of delivering the Service
• Your Team Workspace: Content you publish to the shared library and team chats reviewed by authorised Managers or Admins as described in Section 3.6
• Professional Advisers: Including legal and accounting advisers
• Regulatory Authorities: Where required by law
• Business Transfers: In connection with mergers, acquisitions, or asset sales
• With Your Consent: For any other purpose with your explicit consent

8. International Data Transfers

8.1 Primary Storage

Lawg's primary application database, including stored chat history, and primary uploaded-document storage are hosted in Australia (Sydney). Identity, AI, and other supporting services have separate processing locations.

8.2 Overseas Processing

Authentication, AI, payment, email, analytics, caching, and network security providers may process Personal Data outside Australia as necessary to provide their services, including in the following jurisdictions:

• United States: OpenAI, Pinecone, Clerk, Stripe, Postmark, Google, Microsoft Clarity, and Cloudflare
• United States/Canada: Cohere
• Ireland: Sleekplan
• Other countries: Upstash, Stripe, Cloudflare, and other providers operating distributed infrastructure

8.3 Transfer Safeguards

• Review of applicable supplier terms and data-processing arrangements
• Selection of providers with recognised security practices
• TLS connections and encryption of primary uploaded-document storage and application-host disks

9. Your Rights

9.1 Rights Under Australian Privacy Law

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion (subject to legal requirements)
• Opt-out: Unsubscribe from marketing
• Complaint: Lodge a complaint with us or OAIC

9.2 How to Exercise Your Rights

• Email: privacy@coeusx.ai
• Response time: Within 30 days
• Verification: We may verify your identity

9.3 Chrome Extension Users

If you use the Lawg Chrome Extension, you can:

• Sign out at any time to clear your authentication data
• Uninstall the extension to remove all locally stored data
• Contact us to request deletion of any data associated with your account

9.4 Complaints

If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

10. Security

10.1 Technical Measures

• TLS connections for Lawg services
• Encryption at rest for primary uploaded-document storage and application-host disks
• Account and workspace access controls and authentication
• Automated abuse and content safeguards on supported request paths; their scope and availability vary by feature
• Security reviews and operational monitoring
• Malware screening in the document-upload workflow

The Security & data handling page explains these controls and their scope. Sections 4 and 8 describe provider processing and locations.

10.2 Organisational Measures

We take reasonable steps to protect Personal Data, including maintaining internal data handling practices, incident response capabilities, and assessing the security posture of our Third-Party Providers.

10.3 Limitations

We take reasonable steps to protect Personal Data using the measures described above. No method of transmission or storage is completely secure.

11. Cookies and Tracking Technologies

11.1 Types of Technologies

• Authentication Cookies: Set and managed by our authentication provider, Clerk, to maintain your login session
• Analytics Cookies: Set by Google Analytics and Microsoft Clarity to understand usage patterns and improve our services
• Local Storage: Used to store your cookie consent preference and UI state; this data remains in your browser and is not transmitted to our servers

Our embedded feature-request board connects to Sleekplan when you open that page. Sleekplan may use cookies or local storage to maintain board sessions and preferences. Public posts and comments can be seen by other visitors. Please do not include client or confidential information. See Sleekplan's privacy policy for details.

11.2 Partner referral attribution

Links from partners or their sales representatives to lawg.ai may contain a referral code. We send the code to our first-party API at api.lawg.ai to identify the active partner and specific sales representative or referral source.

We record the first partner referral for an eligible new account to measure attributed registrations, administer the partner program and prepare accurate registration reports. Referral attribution is not connected to checkout or billing and does not measure subscription or payment outcomes. We do not use it for cross-site advertising, behavioural profiling, fingerprinting or remarketing, or use a third-party affiliate pixel for this purpose.

A recognised code sets a first-party cookie named __Host-lawg_ref. It is limited to api.lawg.ai and has a maximum lifetime of 90 days. It records the referral without containing your name, email address, Lawg questions, uploaded documents, payment-card details or other matter content. Before registration, this is pseudonymous identifier data, not permanently anonymous data.

When you create or sign in to an account, we check whether the referral qualifies. For an eligible new registration, we record the first qualifying referral, linking the account, partner, specific sales representative or referral source, and relevant dates and times. A later referral link cannot replace that first attribution.

Appropriately authorised personnel may access referral records and reports. Partners and sales representatives receive only appropriately aggregated registration counts at the partner level and, where appropriate, the representative level. Reports exclude user identifiers, email addresses, Lawg questions, uploaded documents and other matter content, registration timestamps, subscription status, payment amounts, invoice identifiers and payment timestamps. We do not share your identity, client work or payment information with partners or their representatives.

We keep only referral identifiers, attribution relationships and timestamps needed for eligible first registrations and aggregate reporting. The cookie is cleared after successful processing, rejection, or a determination that the account is ineligible. If registration does not occur, it expires after no more than 90 days. When a Lawg account is deleted, we remove the direct user identifier from its attribution record. We may retain historical records without that identifier to maintain accurate aggregate totals, prevent fraud, protect reporting integrity, meet operational needs or satisfy legal retention requirements. These records are not necessarily anonymous. We continue to handle retained personal information under this Policy.

You can block or delete cookies through your browser controls. Doing so may prevent or remove referral attribution but will not prevent normal use of Lawg. To ask about referral information or to request access, correction, or deletion (subject to applicable legal and retention requirements), contact us at privacy@coeusx.ai.

11.3 Analytics Services

We use the following analytics services to understand how visitors interact with our website:

These services help us understand how users navigate our website, identify areas for improvement, and optimise the user experience. We use the data in aggregate form and do not use them to identify individual visitors.

If you accept analytics, Google Analytics may measure a visit from coeusx.ai to our product at lawg.ai as one journey. This uses Google's cross-domain linker and the same Lawg analytics destination on both owned domains. We do not use this mechanism for cross-site advertising, and we do not send Lawg research queries, document content, account email addresses, or payment-card details to Google Analytics.

11.4 Your Choices

• Analytics Choices: You can accept or decline Google Analytics and Microsoft Clarity via our cookie banner
• Browser Settings: Configure your browser to block or delete cookies
• Opt-Out Tools: Use Google’s opt-out browser add-on or Microsoft Clarity’s opt-out feature
• Disabling analytics cookies will not affect the core functionality of our website

11.5 Do Not Track

We do not currently respond to Do Not Track browser signals but may update this as standards develop. You can use our cookie consent mechanism to control our website analytics preferences.

12. Children’s Privacy

The Service is not intended for individuals under 18. We do not knowingly collect information from children. If we learn we have collected data from a child, we will delete it promptly.

13. Changes to This Policy

We may update this Policy from time to time. When we make material changes:

• We will update the “Last updated” date
• We will notify you by email or through the Service of significant changes

We will give any notice, and seek any consent, required for material changes before applying them. This Policy remains a notice of our practices rather than blanket consent to processing.

14. Additional Disclosures for Specific Regions

14.1 European Economic Area, Switzerland, and United Kingdom

If you are located in these regions, you may have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Legal Basis: We process data based on the performance of a contract, legitimate interests, legal obligations, or consent
• Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Supervisory Authority: Lodge a complaint with your local data protection authority

Where applicable, we rely on Standard Contractual Clauses or other approved transfer mechanisms.

14.2 New Zealand

If you are located in New Zealand, you have rights under the Privacy Act 2020 similar to those described in Section 9.

15. Contact Us

For privacy-related enquiries:

CoeusX Pty Ltd (ABN 19 689 184 361)

Privacy Officer

Email: privacy@coeusx.ai