Privacy Policy – Clear AML

3.1 Account and contact information

• Name, job title, firm name, email address, phone number, postal address.
• Login credentials (hashed passwords) and authentication details (MFA tokens).
• User settings and preferences.

3.2 Billing and transaction information

• Subscription plan, invoices and payment history.
• Limited payment card details processed by our PCI‑DSS compliant payment provider (Stripe). We do not store full card numbers.
• Wallet balance and transaction records within the Service.

3.3 Usage and technical data

• IP address, browser type, device identifiers, operating system.
• Pages visited, features used, timestamps and clickstream data.
• In‑app activity logs (verifications run, assessments completed, reports exported, team training completions).

3.4 Customer Data

Our customers may upload or generate information about their own clients, including:

• Identity details (name, date of birth, address, identity document details, citizenship).
• Business details (registration numbers, directors, beneficial owners, trust structures).
• Matters and transactions (nature of business relationship, source of funds, risk assessment outcomes).
• Biometric data — facial images and liveness‑check recordings collected for digital identity verification purposes. See section 16 for our specific treatment of biometric data.
• Staff compliance information (Personal Due Diligence records, training completion, role and AML/CTF responsibilities).

11.1 AML/CTF records

Customer Data that constitutes AML/CTF records (including identity verification records, transaction records, risk assessments and suspicious matter reports) is kept in the Service for as long as your subscription is active, unless the firm's account is deleted from within the Service (see section 11.2). The Anti‑Money Laundering and Counter‑Terrorism Financing Act 2006 (Cth) requires your firm, as the reporting entity, to keep these records — generally for 7 years from the date of the relevant transaction or the end of the customer relationship — so export what you need before a subscription ends. Section 11.2 sets out what happens after it ends. For a subscription that ended before 2 November 2026, we keep its AML/CTF records for 7 years from those dates, as earlier versions of this Policy said, unless the firm's account is deleted (section 11.2).

11.2 Account and Customer Data on subscription end

After a subscription is cancelled or terminated, you can request an export of your account information and Customer Data within 30 days of the date it ends (or within 90 days where it ended before 2 November 2026). After that period, we may delete or de-identify Customer Data at any time, subject to section 11.1 and any legal requirement to keep it. Until we do, it remains protected under this Policy.

If the Account Owner or an administrator instead deletes the firm's account from within the Service, the firm's records — including its AML/CTF records, audit trail and stored files — are deleted straight away and are no longer available to you. Export anything you need first: your firm remains responsible for keeping its own records for the period the law requires. Copies may remain in our hosting provider's backups until those backups expire, and we keep invoices and payment records as tax law requires. Deleting an account does not remove the separate record held by our identity-verification provider (see section 16.4).

11.3 Biometric data

Facial images, liveness captures and identity document images from a verification — of a client, or of a staff member as part of personnel due diligence (PDD) — are held in our systems for 7 days so that your authorised staff can review the result, and are then deleted by a daily clean-up. Images from staff checks completed before 3 October 2026 are kept until 2 November 2026 and then deleted, so download any PDD reports you need before then. The verification result and the details recorded from the check are retained as AML/CTF records under section 11.1. Our identity-verification provider keeps its own record of each verification. See section 16 for further detail.

11.4 Usage and technical data

Server logs and usage analytics are retained for a period of up to 2 years for security monitoring and compliance purposes, after which they are deleted or aggregated in de-identified form. The in-app audit trail of compliance actions forms part of your AML/CTF records and is retained under section 11.1.

14.1 Essential cookies

We use cookies that are strictly necessary for the Service to operate, including authentication sessions, security tokens, and user preferences. These cookies are placed without requiring your consent as they are essential to the functionality you have requested. You cannot opt out of essential cookies without also opting out of using the Service.

14.2 Analytics cookies

We use analytics cookies on our public marketing pages to understand how visitors interact with them (for example, pages visited, session duration, and error rates). Analytics are switched on by default; you can switch them off at any time in your cookie preferences (see section 14.4). This data is used in aggregated form to improve the Service and is not used to identify you personally. Separately, our hosting provider's performance and usage measurement runs across our websites and the Service. It does not use cookies or identify individuals, and is not affected by your cookie preferences. Our error-monitoring service also records a sample of sessions, with on-screen text masked and media blocked, so that we can diagnose faults; this too runs across our websites and the Service regardless of your cookie preferences.

14.3 Marketing and retargeting technologies

With your consent, we use the following third-party marketing tools on our public marketing pages to identify visitors and the organisations they belong to, and to follow up with relevant information:

• rb2b / Retention.com — These tools may identify the organisation you are visiting from and, where their own records allow, associate your visit with a business contact, so that we can send relevant marketing communications. They load only after you have accepted marketing cookies in our cookie consent banner.
• Sales-engagement visitor tracking — A website tracker provided by our sales-engagement platform identifies the organisations visiting our website and may display a chat widget. It loads only after you have accepted marketing cookies.

Neither these tools nor our analytics cookies are active within the Service, on our login and sign-up pages, or on the links we send to your clients and team members (such as document-upload, onboarding and invitation links), and they do not process Customer Data. They operate only on our public marketing pages. You can opt out at any time by: (a) withdrawing cookie consent via the consent banner on our website; (b) visiting retention.com/optout; or (c) contacting us at support@clearaml.com.au.

14.4 Consent and managing cookies

When you first visit our public website, a cookie consent banner is displayed. Analytics cookies are on by default and can be switched off in the banner's preferences. Marketing tools are off by default and load only after you actively accept them. You can change your preferences at any time using the button below or by adjusting your browser settings; switching a category off reloads the page so that the change applies straight away. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

15.1 What the feature does

The Service uses artificial intelligence (AI) / large language model (LLM) technology to draft written compliance narratives for your review. These are: the risk narrative in your firm's AML/CTF program, which is drafted when the program is generated; the written rationale for a client risk assessment, drafted when a staff member requests it; and a draft of the grounds for suspicion in a suspicious matter report, where a staff member requests one. Where a document-reading feature is offered, AI may also be used to read an ownership or structure document you select.

15.2 Data sent to our AI provider

The program risk narrative is drafted from information about your firm — its industry, the services it provides, its risk rating and risk indicators — and does not include information that identifies your clients.

For a client risk rationale or a suspicious matter report draft, the client's name is replaced with a placeholder before the request leaves the Service, and is put back into the draft you see. Dates of birth, business names and business registration numbers are left out. The remaining assessment details — such as entity type, age, nationality and country of residence, occupation or industry, source of funds, income or turnover, verification status, risk factors, transaction amounts and dates, and any free-text descriptions entered by your staff — are sent to our AI provider. Apart from the client's full name and surname, free text is sent as written, so a first name used on its own, and the names of controllers or other people that staff type into those fields, are not removed. Identity document details and biometric data are not sent.

Where you use an AI document-reading feature, the document you select is sent to our AI provider in full, including any names it contains.

15.3 Our AI provider

Our AI provider is based in the United States. Under its commercial terms it does not use data submitted through the Service to train its models. It may retain requests for a limited period for security and abuse monitoring before deleting them. Client risk rationales and suspicious matter report drafts are produced only when a staff member requests them, and can be written manually instead.

15.4 AI outputs are not professional advice

AI-generated narratives are drafts only. They must be reviewed and approved by a qualified compliance professional before use in any formal AML/CTF program, risk assessment or regulatory filing. Brive makes no warranty as to the accuracy, completeness or regulatory sufficiency of AI-generated outputs.

16A.1 How we use the DVS

Where an Australian identity document is used for verification, the document details you provide (such as your name, date of birth and document details) may be checked against records held by the official record holder or document issuer through the Australian Government's Document Verification Service (DVS), accessed via an authorised gateway service provider. The DVS confirms whether the details match official records — it does not disclose any additional information about you to us. Verification of identity in this way supports our customers' legal obligations under the Anti‑Money Laundering and Counter‑Terrorism Financing Act 2006 (Cth).

16A.2 Consent

A DVS check is only performed with your express consent, which is requested at the start of the verification journey before any check is initiated. The consent statement you agree to, and the time you agreed, are recorded.

16A.3 If you decline consent

You may decline consent. If you do, your identity cannot be verified electronically through the Service: the verification is cancelled and the business that requested it is notified. That business may offer you an alternative method of verifying your identity, or may be unable to provide its services to you where identity verification is a legal requirement — this is a matter between you and that business.

16A.4 Retention

Document credentials collected solely for a DVS check (such as card numbers and individual reference numbers) are deleted once the check is complete. The verification result and the consolidated identity outcome are retained as part of the requesting business's compliance records, in line with section 11.

16A.5 Complaints about identification information

If you have a question, correction request or complaint relating to the collection, use or disclosure of your identification information (including a DVS check or its outcome), you may contact the business that requested the verification, or contact us using the details in section 19. Complaints are handled in accordance with the process in section 19, and you may also contact the Office of the Australian Information Commissioner (OAIC).