Privacy policy

Who we are

Zoe is a legal information service at zoelaw.ai. Zoe is operated by RS9 Systems Pty Ltd (ABN 90 633 414 052). In this policy, “Zoe”, “we”, “us” and “our” mean RS9 Systems Pty Ltd. You can contact us about privacy at hello@zoelaw.ai.

What we collect and how

If you use Zoe without an account

You can read legislation, cases and guides, and ask Zoe a limited number of questions, without creating an account or telling us who you are.

To keep track of anonymous conversations and apply the free message limit, we use your IP address. Our database doesn't store the address itself. It stores a shortened code worked out from it (a hash). To count free messages, our servers also hold the address in memory, outside the database.

Your account

When you sign up, Clerk collects your email address, your name if you give it, and your sign-in details. If you sign in with another service, Clerk receives your basic profile from that service. Clerk manages passwords; we never see or store them. We keep your Clerk account ID to link your chats, documents, research and subscription to you.

What you ask Zoe

We save every conversation with Zoe, including your questions, Zoe's answers, a title taken from your first message and any jurisdictions you choose. We save anonymous conversations too. If you sign in while continuing an anonymous conversation, we move that conversation to your account.

Legal questions often involve sensitive details about health, family, money or criminal matters. Zoe doesn't need names or identifying details to answer a general question, so please leave them out where you can.

Documents you upload

Pro and Enterprise subscribers can upload their own documents (PDF, Word, text or Markdown files up to 10 MB) and ask questions about them. We store the file, its name, type and size, and the text we extract from it. We don't keep the questions you ask about a document or Zoe's answers to them.

Letters you pay us to draft

If you buy a letter, we store what you give us for it: your account of what happened, the recipient, sender and purpose you enter, the text we extract from files you add (we keep the text, not the files), the timeline and facts you confirm, and every version of the letter. We also keep a record of each letter payment.

Research, notes and comments

If you save cases or legislation, write notes or link a conversation to something you've saved, we store that against your account. Comments you post on a Bill are public: anyone can read them, and we show a shortened version of your account ID beside each one. We don't show your name or email address.

Payments

Payments go through Stripe's checkout. Stripe collects your card details; we don't receive your full card number. We give Stripe your email address and account ID, and we keep your Stripe customer ID, plan, subscription status and renewal date. We also pass Stripe a few details about how you reached the checkout (a random visitor ID, the page you first landed on, the type of channel and the referring website's domain) so we can tell which pages lead to subscriptions.

Teams and the API

If you manage an Enterprise team, we store the email addresses you invite. If you use our API, we store your API keys as one-way hashes and count your daily requests. If you register a webhook, we store its address and an encrypted signing secret.

Usage and technical information

Like most websites, we collect information about how the site is used: pages you visit, links and buttons you click, terms you type into the legislation search, the site that referred you, your browser and device type, and approximate screen size. We use PostHog, Google Analytics and Vercel for this, and Sentry to record errors and slow pages. Once you sign in, PostHog links this activity to your account ID, name and email address. PostHog also records session replays: a reconstruction of how you moved through our pages. Form fields are masked in replays, and the chat and document screens are left out of replays and click tracking altogether. Our analytics events record the length of a chat message, not what it says, and a question you type on the home page is passed to the chat screen inside your browser, not through the page address.

How we use your information

• to answer your questions and show you your conversation history
• to answer questions about documents you upload
• to run your account, subscription and team, and to apply free usage limits
• to take payments and prevent abuse
• to understand how people use Zoe, fix errors and slow pages, and decide what to build next
• to reply when you contact us

To decide which free guides to write, we sometimes review the first questions people ask in chat. We may send a sample of them to Anthropic so its model can group them into topics. What comes out is a list of topics and example questions written by the model, which we use to plan new guides.

We only send you marketing if you ask for it. See Reminders, updates and marketing below.

The noise diary

The noise diary at zoelaw.ai/tools/noise-diary keeps your entries on your device first. You can log entries without an account. Printing or saving your diary needs a free account. What we hold depends on what you do:

• On your device only: your entries (date, start and end time, type of noise, how it affected you, any note), any short audio clips you record, and the printout details you type in. Nothing is uploaded unless you save the diary to your account.
• In your account, if you save it: the same entries and details are stored in our database in Sydney, and any audio clips in a private storage bucket. Audio clips are never public and are only played back to you. The printout details can include your name, home address, the address of the noise and your council.
• Your mobile number,only if you add one for reminders. It is stored in international format with your reminders consent. If we are not taking mobile numbers yet, the diary settings won't ask for one.

You can delete your whole diary, including audio, from the diary page at any time. That removes it from your device and, if you saved it, from your account.

Reminders, updates and marketing

We send email only if you ask for it. There are two separate choices. Both start unticked, and you can change either at any time:

• Diary reminders.If you tick the reminders box in your diary settings, we email you up to five times over the 14 days after your first entry: how to log well, a nudge, a halfway note, and when your diary is ready to print with some next steps. The last email mentions Ask Zoe's paid option to draft a polite letter to your neighbour. If you add a mobile number and text reminders are running, we may also text you. If we are only collecting numbers, the settings say so, and we won't text until we tell you reminders have launched.
• Zoe updates.If you tick the updates box, or the matching box on a sign-up form such as the Support at Home check, we may email you about new free tools, guides and offers. We don't send marketing texts. If that changes, we will ask you separately first.

Every one of these emails says it is from Zoe (zoelaw.ai), run by RS9 Systems Pty Ltd, gives our contact address, and has an unsubscribe link that works in one click with no login. Gmail and Apple Mail also show their own unsubscribe button. We act on an unsubscribe straight away, and always within five business days, as the Spam Act 2003 (Cth) requires. You can also turn either choice off in your email settings or by emailing hello@zoelaw.ai.

We keep a record of each consent: your email address, the exact wording you saw, when you agreed, where (for example, the noise diary), and a scrambled version of your IP address and your browser details. We keep the record after you unsubscribe, with the date you withdrew, so we can show we honoured it. Ticking a box does not change what you can use for free, and unticking it does not affect your diary or account. We don't sell your details or give them to anyone to market their own products. Our email provider, Resend, holds your address on our behalf.

Our marketing and reminders follow the Spam Act 2003 (Cth) and the direct marketing rules in Australian Privacy Principle 7. To see what we hold, correct it, or ask where we got your details, email hello@zoelaw.ai.

How the AI features handle your information

Zoe's answers are written by AI models run by other companies. When you ask Zoe a question, we send OpenAI your question, the earlier messages in that conversation and the legal material we found for it. We send these requests with OpenAI's optional response storage turned off. To find that legal material, your question is also turned into a search vector by an OpenAI model, sent through Vercel's AI Gateway.

When you ask about a document you've uploaded, we send Anthropic's Claude, through Vercel's AI Gateway, the file name, the document's text (or the parts that fit, for a long document) and your question. Your question, or a clause you pick, is also turned into a search vector by OpenAI so we can find related law.

When you buy a letter, we send OpenAI the material you gave us for that letter (your account, the text of files you added and the facts you confirmed) to organise it and draft the letter, with response storage turned off.

We don't use your questions, conversations or documents to train AI models. Each provider handles what we send it under its own terms and privacy policy.

Sending an enquiry to a law firm

When Zoe can't help with your own matter, she may show a card of law firms she picks for your area of law and city. Zoe can write you a short enquiry to one of them from what you told her in the chat (OpenAI writes it, as with every chat answer, using only your own messages). Nothing is sent anywhere at that point. You can copy the enquiry, open it in your own email app, or, for most free listings, choose “Send it for me”.

If you choose “Send it for me”, this is exactly what happens:

• What you give us:your name, your email address, and your phone number if you choose to add one. You must tick a box that reads “Send this enquiry and my contact details to [the firm]. ZoeLaw is not a law firm and doesn't receive anything from this firm.” We don't send anything without it.
• Confirming your address:before anything goes to the firm, we email the address you gave a link, with the subject “Confirm and send your enquiry to [the firm]”. That email does not contain your enquiry. Opening the link and pressing the button is what sends it, so nobody can send an enquiry in your name from an address that is not theirs. The link works once and expires 24 hours after you asked. If you are signed in and your account's email address is verified and is the address you entered, we skip this step.
• What we hold until you confirm: so the link can send it, we briefly store your draft: the text of your enquiry, your name, your email address and your phone number if you gave one. We delete all of that as soon as the enquiry is sent, or 24 hours after you asked if you never confirm, whichever comes first. A short record of the unconfirmed request (the firm, its city and area of law, the time and the scrambled codes below, but none of your words) is deleted two days after that.
• What we send, and to whom:once you have confirmed, one email to the firm's general enquiries address, which we took from the firm's own website, never one you type in. It contains the text in the box (as you edited it), your name, your email address and your phone number if you gave one, and a short note that ZoeLaw sent it on your behalf and is not a law firm. It comes from a zoelaw.ai address, with your email address as the reply address, so the firm replies to you directly and ZoeLaw does not receive the reply.
• Your copy: we email the same text to the address you gave, so you have a copy.
• What we keep:a short record that the email was sent: the firm, its city and area of law, the date and time, which version of the tick-box wording you agreed to, and the email provider's message ID. If you are signed in, we also keep your account ID. We also keep a scrambled copy of the confirm link's one-time code, which only lets the link say it has already been used. To limit how often one person or one connection can send, we keep two scrambled codes (keyed one-way hashes) made from your email address and your IP address, and we count unconfirmed requests toward that limit too. Your email address and IP address themselves are not stored in this record.
• What we don't keep:once your enquiry has been sent, or the 24 hours are up, the text of your enquiry, your name, your email address or your phone number in our database. Resend, our email provider, handles both emails and keeps its own delivery log, which can include their content. Once the firm has your enquiry, what it does with it is covered by the firm's own privacy practices, not this policy.
• When we won't send it for you:for sponsored (paid) listings, for any personal injury listing, and where we don't hold the firm's published enquiries address. In those cases you copy the enquiry or open it in your own email app and send it yourself, and we never see it. If the email provider can't send your enquiry, we tell you straight away and keep no record of a send.
• Analytics: we record that an enquiry was sent or failed, with the firm and the area of law, but never your name, email address, phone number or the text.

To see or delete the send record we hold for you, email hello@zoelaw.ai. Because the record holds no name or email address, we may ask you for the firm, the date and the email address you used so we can find it.

ChatGPT plugin

Zoe is also available as a plugin in ChatGPT. When ChatGPT calls one of Zoe's tools (search legislation, get a section of an Act, find a guide, find legal help or continue in Zoe), our servers receive only what ChatGPT sends for that one call, such as a search phrase, an Act name, or a city and area of law. We use it to find the answer and send it back. We don't receive your ChatGPT conversation, your name or your account.

• What we record for analytics: which tool was called, the area of law or jurisdiction involved, and how many results came back. We send this to PostHog without any account or personal identifier.
• What we don't store:the text of what was asked. Our tools don't save it to our database or write it to our logs.
• Topic searches:when you search court decisions by topic, the search words are sent to our search provider to find matching sources. We don't store them, and our search provider is listed under "Who we share it with" below.
• IP address:to limit how fast the plugin can be used, our servers hold the IP address of each request in memory, outside the database. For plugin calls this is usually an OpenAI server's address rather than yours.

What OpenAI does with your ChatGPT conversation is covered by OpenAI's own terms and privacy policy, not this one.

Who we share it with

We share personal information only with the service providers that run parts of Zoe for us, and when the law requires it. We don't sell personal information.

• Vercel

  Hosts the website and runs our server code, which handles every request you make. Also provides cookie-free page view statistics.

  Server code runs in the United States (Washington, D.C. region)

• Neon

  Our database: chat history, document records and extracted text, saved research, notes, comments and subscription status.

  Sydney, Australia

• OpenAI

  Writes Zoe's chat answers from your question, the earlier messages in that conversation and the legal sources we retrieve. Organises and drafts letters you pay for, from the material you give us for that letter. Also turns your questions into search vectors so we can find relevant law.

  United States

• Anthropic

  Answers questions about documents you upload, reached through Vercel's AI Gateway. We also use it to group chat questions into topics (see below).

  United States

• Cloudflare

  Stores the files you upload, in a private storage bucket.

  United States-based provider; we have not restricted the storage location

• Clerk

  Sign-up, sign-in and your account details (name, email address, sign-in method).

  United States-based provider

• Stripe

  Checkout, card payments, invoices, subscriptions and letter purchases.

  United States-based provider

• PostHog

  Product analytics: pages visited, clicks and other interactions, and for signed-in users your account ID, name and email address.

  United States

• Google Analytics

  Website traffic statistics.

  United States-based provider

• Sentry

  Error and performance monitoring for the website and our servers.

  United States

• Resend

  Sends our team an internal email when someone signs up or subscribes, which includes that person's email address, and when someone asks Zoe for something it can't provide without a lawyer (advice on their own matter, a prediction, a court or tribunal document, a letter of demand, or someone to act for them), which includes the text of that question. These emails are kept in our internal mailbox. Also sends the diary reminder emails you ask for, and holds the email addresses of people who chose to get Zoe updates. Also sends the email asking you to confirm an enquiry before it is sent. Also sends the enquiry emails you ask us to send to a law firm, and your copy of each one (see “Sending an enquiry to a law firm” below). It receives your name, email address, phone number if you gave one, and the text of the enquiry, and keeps its own delivery log.

  United States-based provider

Sending information overseas

Our database is in Sydney, but most of the providers above are in the United States, and our server code runs there. That means your questions, Zoe's answers, uploaded documents, account details and usage information are sent to, or stored in, the United States. Where the list above says a provider is United States-based, it may also store or process information in other countries where it operates.

Cookies and similar technologies

We and our providers use cookies and browser storage to:

• keep you signed in (Clerk)
• remember whether you chose the Australian or United States version of Zoe
• remember a random ID, the page you first landed on, the type of channel you came from and the referring domain, for 30 days, so we can tell which pages lead to sign-ups and subscriptions
• keep the version of a page you see consistent while we test changes, for 30 days
• measure usage (PostHog and Google Analytics)

Vercel's page view statistics don't use cookies. You can block or delete cookies in your browser settings. If you block the sign-in cookies, you won't be able to stay signed in.

How we store and protect it

• The site is served over HTTPS.
• Uploaded files sit in a private storage bucket, filed under your account. We never create a public link to them.
• Every request for your documents, notes and saved research is checked against your account, so other users can't reach them.
• We don't write the contents of your documents to our logs.
• API keys are stored as one-way hashes and webhook secrets are encrypted.
• Passwords are handled by Clerk and card numbers by Stripe, so we never hold them.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner as the law requires.

How long we keep it

We don't currently delete conversations, saved research or notes automatically. They stay until you ask us to delete them.

You can delete a letter yourself once no payment for it is still in progress. When you do, we erase its material and every version, and keep only the payment record.

You can delete an uploaded document yourself at any time. When you do, we remove its extracted text from our database and ask our storage provider to delete the file. We keep a record that the document existed, with its name, type, size and the dates it was uploaded and deleted.

Our providers keep analytics, error and payment records under their own retention settings.

Seeing, correcting and deleting your information

You can change your name and email address from the account menu when you're signed in. To get a copy of the personal information we hold about you, have it corrected, or have your conversations, research or account deleted, email hello@zoelaw.ai. We may need to confirm you're the account holder before we act. If we can't do what you ask, we'll tell you why.

Complaints

If you think we've mishandled your personal information, email hello@zoelaw.aiand tell us what happened. If you're not satisfied with our response, or you haven't heard back within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

When we change how we handle personal information, we'll update this page and the date at the top.

Contact us

Email hello@zoelaw.ai with any privacy question or request.