Privacy Policy

Effective date: 22 October 2026

The change described in section 9.2 (the Google Ads sign-up tag in the application) takes effect on 23 November 2026.

1. Introduction

This Privacy Policy describes how AML Simple (“we”, “us”, “our”) collects, uses, stores, and protects personal information through AML Simple (“the Service”).

We are a New Zealand sole trader providing AML/CTF compliance software to Australian businesses. As a New Zealand entity providing services to Australian businesses and collecting personal information from individuals in Australia, we are subject to:

• Australian Privacy Act 1988 and the Australian Privacy Principles (APPs) — under section 5B (extraterritorial operation), the Privacy Act applies to us because we have an Australian link
• New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs) — as a New Zealand entity

2. What Data We Collect

2.1 Account Information (Direct Collection)

2.2 Customer Compliance Data (Entered by You)

You input personal information about your clients as part of your CDD processes:

Important: You determine the purposes for which your clients’ personal information is collected and used through the Service. We hold and process this information solely on your instructions and for the purpose of providing the Service. Under the Australian Privacy Act, we are an APP entity with obligations regarding the personal information we hold. Under the NZ Privacy Act, we are an agency with corresponding obligations.

2.3 Automatically Collected Data

2.4 Data We Do NOT Collect

• Copies of identity documents (we record details only, per AUSTRAC guidance)
• Financial account numbers
• Tax file numbers
• Biometric data

Note on electronic verification: Where you use our electronic identity verification feature (powered by Didit), the verification provider processes document images and performs a biometric liveness check on our behalf to confirm your client’s identity. AML Simple does not store these images or biometric data — only the verification result (approved/declined) and the associated audit record. See Section 6 for details on Didit as a data processor.

3. How We Use Data

We do NOT:

• Sell personal information to third parties
• Use customer compliance data for marketing
• Use customer data to train AI models
• Share data with third parties except as described below

If you use the AI assistant or SMR drafting, your clients' personal information you enter is processed by Anthropic in the United States (Section 4.3). You are responsible for any notice to your clients that your own privacy obligations require.

4. Data Storage and Security

4.1 Data Residency

Our database and file storage for your customer compliance data (CDD records, screening results, reports) are hosted in Sydney, Australia (ap-southeast-2). When you use some features, parts of that data are sent to providers outside Australia for processing. Section 4.3 and Section 11 list them.

4.2 Security Measures

• Encryption in transit (TLS 1.2+)
• Encryption at rest (AES-256)
• Row Level Security (database access scoped to your organisation)
• Role-based access control
• Audit logging of changes to compliance records
• Regular security updates and dependency patching

For a full overview of our security posture, infrastructure certifications, and data protection commitments, see our Security page.

4.3 AI Assistant and Overseas Processing

The in-app AI assistant (AML Simple Ask) and the SMR drafting tool use AI models provided by Anthropic PBC. When you use them, the content described below is sent to Anthropic servers in the United States, which is outside Australia, and a response is returned to you. We use the Anthropic commercial API. Anthropic commercial terms state that Anthropic may not train its models on this content. We do not use your data to train AI models.

What is sent:

• AI assistant: the messages you type and the earlier messages in the same conversation (up to 20), including the assistant replies. Your organisation name and plan, how many clients you have, your compliance officer name and your AUSTRAC enrolment number. If you have a form open, the values filled in so far, such as the name or date of birth of a client. The results of any action you ask the assistant to take, for example a list of up to 50 clients with their names, client types, CDD status and risk ratings, the screening result for a named client, or the name of a client and the email address a verification link is sent to.
• SMR drafting: the details you enter for the report, which can include the name, date of birth, address, citizenship and occupation of the subject, ABN or ACN, trustee and associated persons, and your description of the activity.

What is not sent: copies of identity documents and biometric data. Electronic identity verification is handled by Didit (Section 6). We do not store those images or that biometric data and we do not pass them to Anthropic.

Anthropic is also used for our own operations. When you email hello@amlsimple.com, the content of your email, together with details of your account such as your organisation name, is sent to Anthropic so that we can sort the email and draft a reply. When you sign up, your signup details, such as your organisation name, plan and progress in the product, are sent to Anthropic to help us draft a welcome message. If you used the AI assistant and gave us your email address, a transcript of that conversation is sent to Anthropic to produce a summary of key points that we email to you. For cold outreach (Section 14), prospect names, business email addresses and replies are sent to Anthropic to help us write and sort outreach emails.

5. Data Retention

After the retention period, data is permanently deleted.

Note: We hold AML/CTF records on your behalf to assist you in meeting your record-keeping obligations under the AML/CTF Act. The 7-year retention period is your legal obligation as a reporting entity. We store these records to support that obligation.

6. Third-Party Data Processors

We share personal information with these processors solely to provide the Service:

We rely on the data processing terms of each provider. We have not yet confirmed those terms for every provider. Entries marked * are still being confirmed.

7. Your Rights

Under Australian Privacy Act (APPs)

• Access: Request access to your personal information (APP 12)
• Correction: Request correction of inaccurate information (APP 13)
• Complaint: Lodge a complaint with us or the OAIC

Under NZ Privacy Act 2020 (IPPs)

• Access: Request access to your personal information (IPP 6)
• Correction: Request correction (IPP 7)
• Complaint: Lodge a complaint with us or the NZ Privacy Commissioner

Additional Rights We Provide

• Data export: Export all your data at any time (CSV, PDF)
• Data deletion: Request deletion of your account and data (subject to 7-year retention requirements for AML/CTF records)
• Data portability: Download structured data in standard formats

How to Exercise Your Rights

Contact us at hello@amlsimple.com. We will respond within 30 days.

Note: AML/CTF records subject to the 7-year retention requirement cannot be deleted before the retention period expires, even upon request. This is a legal requirement under the AML/CTF Act.

8. Data Breach Notification

Australian Notifiable Data Breaches Scheme

In the event of a suspected eligible data breach under Part IIIC of the Australian Privacy Act 1988:

• We will assess the breach as quickly as possible and within a maximum of 30 days of becoming aware of grounds to suspect a breach, as required by law
• If we determine the breach is an eligible data breach (where serious harm to affected individuals is likely), we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable
• Our notification will include: a description of the breach, the kinds of information involved, and recommended steps for affected individuals
• We will notify you (as the reporting entity whose client data may be affected) separately so you can meet your own notification obligations
• We will take steps to contain the breach and mitigate harm

New Zealand Privacy Act 2020

Under the NZ Privacy Act 2020 (sections 112–117), if a privacy breach has caused, or is likely to cause, serious harm to affected individuals:

• We will notify the NZ Privacy Commissioner and affected individuals as soon as practicable
• We will take steps to contain the breach and reduce the risk of harm

9. Cookies and Tracking

9.1 Essential Cookies

The following essential cookies are used in the AML Simple application (app.amlsimple.com):

9.2 Advertising Cookies and Tags

We use the Google Ads tag and the LinkedIn Insight Tag to measure whether our advertising leads to sign-ups. On our marketing website (amlsimple.com) they load only after you accept cookies in the cookie banner. The AML Simple application (app.amlsimple.com) does not load the LinkedIn Insight Tag. From 23 November 2026, it loads the Google Ads tag only if you accepted cookies on amlsimple.com before you arrived, and uses it to count one event, a completed sign-up. Until then, and if you did not accept or came to the application directly, no advertising tag loads. LinkedIn sets its own cookies on the marketing site, including bcookie, lidc and li_gc. The Google cookies are listed below.

These cookies record whether you clicked on one of our ads before visiting our site and track when a conversion event occurs (e.g., completing our readiness quiz or signing up for email updates).

9.3 Enhanced Conversions

On our marketing website (amlsimple.com), where you provide your email address (for example, via our readiness quiz or newsletter sign-up), we may send a hashed (one-way encrypted) version of your email address to Google to improve the accuracy of our conversion measurement. This hashed data is used solely for advertising attribution and cannot be reversed to recover your email address. This feature operates on the marketing site only and is not used in the AML Simple application.

9.4 Remarketing

On our marketing website (amlsimple.com), after you accept cookies, we may use Google Ads remarketing to display our advertisements to previous visitors of amlsimple.com on other websites and apps across the Google Display Network and Google Search. Google uses cookies set during your visit to our site to serve these ads. The Google Ads tag also loads in the AML Simple application in the limited case described in Section 9.2.

9.5 Product Analytics (PostHog)

On both amlsimple.com and the application we use PostHog (European Union) for product analytics, without a cookie banner. PostHog records page views and clicks, including the address of the page and the label of the button or link that was clicked, which can include the name of a client if you click on it. PostHog sets a first-party cookie that stores a random identifier. When you sign up, your activity is linked to an internal account ID, not to your name or email address.

PostHog session recording is switched off in the code of both amlsimple.com and the application, so no PostHog screen recordings are made and a setting in the PostHog account cannot turn them on. We would update this policy before changing that.

9.6 Session Recording on the Marketing Site (Microsoft Clarity)

On amlsimple.com only, and only after you accept cookies, we use Microsoft Clarity to record how visitors use our marketing pages (clicks, scrolling and screen recordings) so that we can improve them. Clarity is not loaded in the application.

9.7 Opt-Out

You can opt out of Google advertising cookies and personalised ads at any time:

• Change or withdraw your cookie choice on our sites: Use the "Cookie settings" link in the footer of amlsimple.com to accept or decline advertising cookies at any time. In the application, use the "Cookie settings" card on the Settings page. A change applies from your next page load. If you decline on amlsimple.com, the next time you follow a link into the application your decline is passed on and the application stops loading the Google Ads tag.
• Google Ad Centre: Visit myadcenter.google.com to manage your ad personalisation preferences
• Browser cookie controls: Delete or block cookies through your browser settings (note: blocking essential cookies may affect service functionality)
• Network Advertising Initiative (NAI) Opt-Out: Visit optout.networkadvertising.org to opt out from participating ad networks

Opting out will not prevent you from seeing ads, but ads shown to you will be less personalised.

10. Children’s Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

11. International Data Transfers

Our database and file storage for customer compliance data (CDD records, screening results, reports) are hosted in Australia (Sydney, ap-southeast-2). Some features send personal information to providers outside Australia. They are listed below.

The following categories of personal information may be disclosed to overseas recipients:

• Ireland/EU: Paddle (name, email, billing information for payment processing); dilisense (name, DOB for sanctions/PEP screening); Didit (name, DOB, document image, biometric liveness data for electronic identity verification — EU processing, specific country pending DPA confirmation)
• EU: Zoho Mail (email address, name and email content for our support and enquiry mailbox); PostHog, Frankfurt (page addresses, clicks and the label of what you click, for product analytics)
• United States: Anthropic (the content you send to the AI assistant and the SMR drafting tool, which can include client names, dates of birth and other details; see Section 4.3); Resend (email address and name for account, reminder and notification emails, and operational alerts); Instantly (prospect name, business email address and replies, for cold outreach; Instantly is a US company). Anthropic also processes the content of emails you send to hello@amlsimple.com, to help us sort and draft replies, and prospect names, email addresses and replies, to help us write outreach emails.
• Location not yet confirmed: Microsoft Clarity (marketing site only) and LinkedIn Insight Tag (cookie IDs, page addresses, conversion events and IP address) and HeyReach (prospect name and LinkedIn profile URL; being retired)
• United States / Ireland: Google LLC (cookie IDs, conversion events, IP address, and hashed email for Enhanced Conversions, for advertising attribution and remarketing): marketing site after you accept cookies, and in the application only as described in Section 9.2

Under APP 8, we take reasonable steps to ensure these overseas recipients handle personal information consistently with the APPs, including by relying on the data processing terms of each provider where they apply. We remain accountable for the handling of personal information by these overseas recipients.

Where a provider is outside Australia, it may be subject to the laws of that country, including access by its authorities, and you may not be able to seek redress under the Australian Privacy Act against that provider directly. We remain accountable under s 16C.

Under the NZ Privacy Act (IPP 12), we disclose personal information overseas only where permitted, and we are working to confirm comparable safeguards for the providers marked * above.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email and in-app notice at least 30 days before taking effect.

14. Marketing and Business Contact Information

14.1 What We Collect

In addition to data collected through the Service, we collect business contact information for marketing and outreach purposes:

14.2 How We Source This Information

We collect business contact information from:

• Agency websites: “About Us” and “Contact” pages where business contact details are conspicuously published
• Professional directories: REIV member directory, RateMyAgent, Google Maps business listings
• Referrals: Where another business professional introduces us
• Inbound enquiries: Where you contact us, complete our readiness quiz, or sign up for our service

We do not scrape email addresses from LinkedIn profiles or other platforms where addresses are not conspicuously published for the purpose of receiving business communications.

14.3 Legal Basis

Under the Australian Privacy Act 1988 (APP 3), we collect this information because it is reasonably necessary for one of our functions or activities: providing relevant, targeted information about AML/CTF compliance tools to businesses with a legal obligation to implement AML programs by 1 July 2026.

Under the Spam Act 2003, our commercial electronic messages rely on:

• Inferred consent via conspicuous publication (Schedule 2, clause 4): where a business email address is (a) published to enable public contact in a business capacity, (b) conspicuously published, (c) published with apparent agreement, and (d) not accompanied by a statement that the person does not wish to receive unsolicited commercial messages — and our message is relevant to the recipient’s business role
• Express consent: where you have directly opted in to receive communications from us (e.g., by completing our readiness quiz, subscribing to our newsletter, or contacting us)

For contacts introduced via referral, we send a single introductory message only. Ongoing communication requires express opt-in from the recipient.

All commercial electronic messages comply with ss 17–18 of the Spam Act: they include accurate sender identification and a functional unsubscribe mechanism.

When we first contact you using information collected from a public source, our message will include a link to this privacy policy, in accordance with APP 5 (notification of collection of personal information).

14.4 Unsubscribe and Opt-Out

Every commercial message we send includes a free, functional unsubscribe mechanism. You can also email hello@amlsimple.com to opt out at any time. We honour unsubscribe requests within 5 business days as required by the Spam Act.

14.5 Retention and Deletion

14.6 Your Rights

You have the same rights over your marketing contact data as described in Section 7, including access (APP 12), correction (APP 13), and complaint rights. Contact hello@amlsimple.com.

14.7 Overseas Disclosure

Marketing contact data is processed through Instantly (a US company) for cold outreach email and Zoho Mail (EU) for correspondence, and LinkedIn contact details through HeyReach (being retired). Anthropic also processes the content of emails you send to hello@amlsimple.com, to help us sort and draft replies, and prospect names, email addresses and replies, to help us write outreach emails. See Section 11 for our approach to international data transfers and overseas recipient accountability.

15. Contact and Complaints

Privacy enquiries: hello@amlsimple.com

Complaints:
If you are not satisfied with our response, you may contact:

• Australia: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au
• New Zealand: Office of the Privacy Commissioner — www.privacy.org.nz