Noventis Tech Pty Ltd (ABN 52 699 803 604) trading as AML Mate (“we”, “us”, “our”) is committed to protecting your privacy. This policy explains how we collect, use, disclose, and safeguard your information when you use our platform at amlmate.com.au (“the Service”).
We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
The Service handles two kinds of personal information, and our role is different for each:
-
Part A: Information about you (our customers, their team members, and website visitors). We collect and hold this information for our own purposes and are directly responsible for it under the Privacy Act.
-
Part B: Information about your clients (the individuals whose details you enter into or upload to the Service as part of your AML/CTF compliance). You remain responsible for this information under the Privacy Act; we store and process it on your behalf, only to provide the Service.
Part A: Information about you
2.1 Information you provide
-
Account information: Name, email address, password (hashed).
-
Business information: Business name, ABN, industry, designated services, compliance officer details.
-
Contact form submissions: Name, email, and message content.
-
Email forms on our website: When you give us your email without creating an account (to download a free resource such as a checklist or casebook, to receive your free check or cost calculator results, to join an early-access list, or in the public AI assistant), we collect your email address, the form you used and, where a form asks and you choose to answer, your industry. If you tick a separate box agreeing to marketing emails, we also record when you agreed and the wording you agreed to.
2.2 Information collected automatically
-
Usage data: Pages visited, features used, activity logs.
-
Device information: Browser type, operating system, IP address.
-
Cookies: Session cookies for authentication; first-party analytics cookies (PostHog) tied to an opaque user id, with no name or email attached; and Google Analytics and Google Ads cookies, which measure site usage and advertising conversions (see Section 8).
We use information about you to:
-
Provide and maintain the Service.
-
Send transactional emails (account verification, password reset, compliance alerts).
-
Process payments via Stripe.
-
Respond to support requests.
-
Email you the resource, results or update you asked for.
-
Improve the Service based on usage patterns (pseudonymous analytics keyed to an opaque user id; see Section 8).
-
We may occasionally email you product updates or a personal note from the founder about getting set up. Every such email includes a one-click unsubscribe link, and you can manage email preferences (alert digests, deadline reminders) in your account settings.
-
If you leave your email on a download form without an account, we send you only what you asked for, unless you tick the separate, unticked box agreeing to receive occasional AML Mate updates. Those emails each include a one-click unsubscribe link.
-
Unsubscribing does not affect essential account emails (security, billing, verification).
-
We never use your clients' information (Part B) for marketing of any kind.
Part B: Information about your clients
-
Client records: Client names, identification details, risk assessments, and KYC/CDD records you enter into the Service.
-
Documents: Files you upload, or your clients upload via a KYC link you send them (ID documents, financial records).
-
Verification results: Where you use electronic identity verification (EIV), the verified name, date of birth, and document details returned by the verification provider.
-
We store and process your clients' information only to provide the Service to you: generating compliance plans, risk assessments, and reports; screening against sanctions and PEP lists; and keeping your KYC/CDD records.
-
We never sell this information, never use it for our own marketing, and never use it to train AI models.
-
You are responsible for this information under the Privacy Act: for collecting it lawfully, for giving your clients any required collection notices (including that it will be stored with service providers such as us), and for your own retention obligations under the AML/CTF Act.
-
Screening: Client names are checked against public sanctions and PEP databases (DFAT, OpenSanctions) as part of the Service's compliance features.
-
Identity verification: Where you request it, client identities are verified electronically via Stripe Identity (see Section 8 for what the provider receives).
-
Collection notice on KYC links: When you send a client a KYC link to collect their information, the page displays a collection notice identifying you as the collecting business and explaining that the information is collected for AML/CTF identity verification, and asks the client to confirm their consent before submitting. This assists you in meeting your APP 5 obligations, but you remain responsible for the lawfulness of the collection.
Several features use Google Gemini for compliance guidance, drafting and review. The application reduces identifying information in model requests using the controls below.
-
Identity masking before model requests. Structured identity fields can be replaced with a presence flag where only completeness is needed. Free-text processing masks known client names and common email, date, phone and long-number patterns. Some report workflows also mask known address and document details. The exact controls depend on the feature and information available to it.
-
Automated masking has limits. Masking is not a guarantee of anonymity. Unrecognised names, addresses or other identifying details can remain in free text, and the surrounding narrative may identify someone. Do not enter unnecessary client identifiers, document images or confidential material into chat.
-
Context used to generate guidance. Model requests may include relevant business and risk context, such as industry, client type, occupation, nationality, risk factors and transaction details. Removing direct identifiers does not necessarily make this context non-personal information.
-
Google processing and retention. Under Google's paid Gemini API terms, prompts and responses are not used to improve its products. Those terms still allow limited safety logging and processing for required legal or regulatory disclosures. Data may be stored transiently or cached outside Australia. This is separate from our own conversation retention.
-
Conversations stored in AML Mate. Stored conversations may include the text you originally enter, before masking for the model request, as well as the responses. They are subject to our access controls and the conversation retention policy in Section 12.
-
Screening is a separate process. Sanctions, PEP and identity-verification providers may receive identifying information needed to perform their checks. The AI masking controls do not apply in the same way to those checks. Automated adverse-media screening is not provided; the product prompts manual review.
Google Gemini API terms, checked 18 October 2026. See also our AI security overview.
Applying to both Parts A and B
Some processors (Google for Gemini, Analytics and Ads; Vercel; Stripe; PostHog) may store or process data outside Australia, including in the United States. By using the relevant features you consent to this disclosure. We take reasonable steps to ensure overseas recipients handle your data consistently with the Australian Privacy Principles.
-
Authentication is handled by Supabase Auth. We never store your password; password hashing is performed by Supabase.
-
All data is transmitted over HTTPS (TLS 1.2+).
-
Sessions use short-lived signed tokens managed by Supabase Auth, and every request is re-verified on our servers.
-
Database access requires application credentials, and every query is scoped to the requesting business, so one business can never read another's data.
-
Uploaded documents are stored in a private storage bucket in Sydney, Australia. Each download is authorised against your business and served via a signed URL that expires after 60 seconds.
-
Sensitive identifiers are encrypted at rest: client identity document numbers are encrypted at the application layer (AES-256), in addition to the encryption applied by our storage provider.
We comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). If a data breach occurs that is likely to result in serious harm, we will assess it promptly and notify affected individuals and the Office of the Australian Information Commissioner as required. If a breach affects your clients' information (Part B), we will notify you promptly so you can meet your own obligations.
-
Website email form records: Kept so we can honour your choices, including a record that you unsubscribed. Ask us to delete them at any time using the details in Section 16.
-
Account data: Retained while your account is active. When the last member of a team deletes their account, all business and client data is deleted immediately; the remaining account record (name and email) is deleted or de-identified within 30 days.
-
Client records and documents: When you delete a client, or your account is deleted, that client's uploaded documents are removed from storage immediately along with the record. To minimise the sensitive data we hold, uploaded identity document images are automatically destroyed 90 days after you mark a client's CDD as complete; the verification record (document type, number, expiry, and result) is kept as your AML record. When you mark a client relationship as ended, we start a 7-year retention clock (aligned with the record-keeping period under the AML/CTF Act). Seven years after the relationship ends, we automatically destroy the client's uploaded identity documents and de-identify the client record: name, contact details, date of birth, address, nationality, identity-document details, beneficial owner details, and screening and verification results are removed. A minimal, non-identifying record is retained only where needed to preserve the integrity of related reports (such as suspicious matter or threshold transaction reports). You remain responsible for marking when a relationship has ended and for your own retention obligations under the AML/CTF Act.
-
AI conversation history: Retained for 12 months, then automatically deleted.
-
Payment records: We store only your Stripe customer reference and subscription status. Invoices, receipts, and card details are held by Stripe, and we retain billing records as required by Australian tax law.
If you are our customer (Part A), under the Australian Privacy Principles you have the right to:
-
Access: Request a copy of personal information we hold about you.
-
Correction: Request correction of inaccurate information.
-
Deletion: Request deletion of your account and associated data (subject to legal retention requirements).
-
Export: Export your client data in CSV format at any time via the dashboard.
-
Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs.
If you are a client of one of our customers (Part B): access, correction, and deletion requests should be directed to the business that collected your information. They are responsible for it under the Privacy Act, and we will assist them in responding. If you contact us directly, we will refer your request to that business unless the law requires otherwise.
The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 14 days before they take effect.
For privacy-related inquiries or to exercise your rights, contact us at: