Privacy

1. About this policy

This policy explains how DisputeX Pty Ltd (ABN 81 699 300 260) ("DisputeX", "we", "us") collects, uses, shares and protects personal information when you use disputex.com.au, run a market value check or contact us.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our approach is simple: we collect only what your check and report need, we never sell it, and we delete it on a fixed schedule.

2. The information we collect

About your claim and your car:

• your state, the type of cover (or that you aren't insured), your insurer's name and its offer
• the date of loss
• your car's details, such as year, make, model, variant, body, engine and transmission, and its registration number or VIN if it's in a document you upload
• the car's kilometres, and its colour if you add it
• your name and claim number, only if you add them to be printed on your report
• your accessories, and the comparable cars you add

Documents and images you upload: your insurer's valuation or letter, screenshots of listings, and invoices or listings for accessories. These can contain more than we need, such as your address, policy number or another person's name. We only use the details needed for your check, but the file itself is stored until your check is deleted. Please crop out anything that isn't needed before uploading.

Contact details: your email address, if you give it to receive your report and reminders, or when you pay. If you use the contact form or ask us to delete your data, we collect your name, email, phone number (if you give it) and your message.

Payment information: Stripe processes payments and collects your card details. We never see or store your full card number. We receive limited details from Stripe, such as the amount, the date, whether the payment succeeded and the email used.

Technical information: your IP address, browser and device type, and the times you took actions on your check, kept in an audit trail for security and to prevent misuse. Our analytics tools also collect information about how you use the site (see section 8).

Your feedback: if you answer our follow-up email, what your insurer did and, if you choose, how much it changed its offer.

We don't ask for sensitive information, such as health information, and we don't collect licence photos. If a document you upload happens to contain sensitive information, we don't use it.

3. How we collect it

Almost everything comes directly from you: what you type, choose and upload. We also receive payment details from Stripe, and technical information from your browser and our analytics tools. We don't collect information about you from your insurer, and we don't buy personal information.

4. Using DisputeX without identifying yourself

You can run a check and see your result without giving your name or email. Your name and claim number are optional and only appear on your report if you add them. To pay, you'll need to give Stripe your payment details and an email address.

5. Why we collect it and how we use it

We use your personal information to:

• run your market value check, read your documents and screenshots, calculate the result and prepare your report
• take payment, issue your tax invoice and handle refunds
• email you your report and tax invoice, a confirmation if we refund you, one reminder before an unpaid draft is deleted, and, after you pay, a follow-up about 3 weeks later (and once more if you're still waiting) asking what your insurer did
• reply to messages and handle requests about your information
• keep DisputeX secure, prevent fraud and misuse, and fix problems
• understand how the site is used and improve it, mostly using anonymous or combined information
• meet our legal obligations, such as keeping tax records

We don't use your information for any other purpose unless you agree or the law allows or requires it. We don't use it to make decisions about you, and we don't share it with your insurer. You decide whether to send them your report.

6. Automated processing

DisputeX uses automated tools to read details from the documents and screenshots you upload, including an artificial intelligence service provided by Anthropic. Everything these tools read is shown to you to confirm or correct before it's used. The calculation is then done automatically from the figures you confirmed, using the method on our How we calculate page.

This processing prepares a document for you. It doesn't make a decision about you or your claim. Your insurer decides your claim.

7. Who we share it with

We share personal information only with the service providers who help us run DisputeX, and only what they need to do that:

• Vercel, which hosts the website (its servers for DisputeX run in Sydney; Vercel is based in the United States)
• Amazon Web Services, which stores uploaded files in Sydney, and Neon, which runs our database on Amazon Web Services in Sydney
• Stripe, which processes payments (United States, and other countries where Stripe operates)
• Resend, which sends our emails (United States)
• Anthropic, which reads documents and screenshots for us (United States). Its commercial terms say it doesn't use what we send to train its models.
• Google, through Google Tag Manager, and Microsoft, through Clarity, for analytics (United States)

We may also share information with our professional advisers (such as lawyers and accountants) under a duty of confidentiality, with a business that takes over DisputeX (who must handle it under this policy), or where the law requires or allows it, such as to a court, regulator or law enforcement agency.

We never sell, rent or trade personal information, and we don't share it with insurers, listing websites, advertisers or data brokers.

8. Overseas disclosure

Your check's database records and uploaded files are stored in Sydney. Some of our providers may access, process or store information outside Australia, mainly in the United States, as listed in section 7. We choose providers with strong security and privacy commitments, and we take reasonable steps, including through our agreements with them, to make sure they handle your information in a way that's consistent with the Australian Privacy Principles.

9. Analytics and cookies

We use Google Tag Manager to measure how people use the site, such as how many start a check or reach the report page. We send it events, never your personal details, documents or your car's identifiers.

We use Microsoft Clarity to see how pages are used, such as where people click and scroll, so we can make the site easier to use. Clarity can record your visit to public pages, but everything inside your check, including anything you type or upload, is masked and never recorded.

These tools use cookies and similar technology. We also use our own cookies: one remembers your private link on this device so you can come back to your check, and others keep the site secure. You can block or delete cookies in your browser settings, but parts of the site may not work, and you'd need your private link to return to your check.

10. Emails

We only email you if you give us your email address. Emails about your check, payment and report are part of the service. The follow-up emails asking what your insurer did can be stopped at any time from the link in each one. We don't send marketing emails unless you've agreed to receive them, and you can unsubscribe at any time.

11. How we protect it

• Your check is reached through a private link with a long random code. We store only a scrambled (hashed) version of that code, so it can't be read from our database.
• Information is encrypted in transit, and uploaded files are kept in a private storage bucket and only shown through short-lived links.
• Access to our systems is limited to people who need it and protected by strong passwords.
• We keep an audit trail of actions on each check.

No system is perfectly secure, so please keep your private link to yourself: anyone who has it can see and change your check.

12. Data breaches

If there's a data breach that's likely to result in serious harm to you, we'll notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and tell you what you can do to protect yourself.

13. How long we keep it

• Unpaid drafts and their uploads are permanently deleted 24 hours after you start, at the time shown on screen. If you gave your email, we send one reminder a few hours before.
• Paid reports and their uploads are kept for 12 months after payment, then permanently deleted.
• You can delete your check and all its files yourself at any time from your private link.
• Contact messages and data requests are kept as long as we need them to respond and keep a record of what we did.
• Payment records are kept by Stripe, and we keep the records we need for tax law (such as invoice numbers, amounts and dates), usually for 5 years.

When a check is deleted, we keep only an anonymous record for our statistics and accounts: the state, insurer, offer, our figure, how far the check got, the payment amount and dates, your own estimate if you gave one, and what your insurer did if you told us. It doesn't include your name, email, claim number, documents or your car's identifiers, and it can't be linked back to you through your private link, which stops working.

Deleted information can remain in encrypted backups for a short time until they're overwritten.

14. Accessing and correcting your information

You can see and correct most of your information yourself, from your private link. For 14 days after paying, you can also correct your report's details.

You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing support@disputex.com.au or using our delete my data page. We may need to confirm it's your information, for example by asking you to send a request from the email used or to show your private link. We respond within 30 days, and there's no charge. If we can't do what you ask, we'll tell you why and how to complain.

15. Children

DisputeX is for people aged 18 and over. We don't knowingly collect personal information from children.

16. Complaints

If you have a concern about how we've handled your personal information, email support@disputex.com.au and tell us what happened. We'll acknowledge it within 5 business days and aim to respond in full within 30 days.

If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

17. Changes to this policy

We may update this policy from time to time, for example if we add a service provider. The latest version is always on this page with its date. If a change significantly affects how we handle information we already hold about you, we'll tell you by email if we have your address.

18. Contact

DisputeX Pty Ltd, ABN 81 699 300 260. Email support@disputex.com.au or use our contact page.