Privacy Policy

ContractReview is operated by KERCOM AI (“we”, “us”, “our”), a business based in Victoria, Australia. We provide an AI-assisted review service for Victorian Contracts of Sale.

If you have any questions about this Privacy Policy or how we handle your information, please contact us at kai8@kercom.org.

We collect information you provide directly to us, including:

• Account information — your name, email address, and (where provided) company or firm name when you create an account or request a demo.
• Contract documents — PDF files you upload for review. These may contain personal information about property buyers, vendors, or other parties named in the contract.
• Buyer context— any optional notes you provide about the buyer's situation (e.g. “first home buyer”, “investor”).
• Payment information — billing details are processed by Stripe and are not stored on our systems.
• Usage data — information about how you interact with the service, including review history and account activity.

We use the information we collect to:

• Provide, operate, and improve the ContractReview service.
• Process contract documents through our AI model (Anthropic Claude) to generate review reports.
• Send transactional emails — including review completion notifications, sign-in links, and account communications.
• Process payments and manage your subscription or credits.
• Respond to your enquiries and provide customer support.
• Comply with our legal obligations under Australian law.

We do not sell your personal information to third parties. We do not use your contract documents to train AI models.

We share your information only with the third-party service providers necessary to operate the service:

• Anthropic— contract document content is sent to Anthropic's Claude API for AI analysis. Anthropic's privacy policy applies to data processed through their API.
• Supabase — we use Supabase to store account data, review records, and uploaded PDF files. Data is stored on servers located in Australia or the United States.
• Stripe — payment processing. Stripe is PCI-DSS compliant and we do not store your card details.
• Resend — transactional email delivery.

We may disclose your information if required to do so by law or in response to a valid legal process.

PDF files you upload are stored securely in our cloud storage. Generated review reports are stored against your account and accessible via your dashboard.

You may request deletion of your account and associated data at any time by contacting us at kai8@kercom.org. We will delete your data within 30 days of a verified request, except where we are required to retain it by law.

We take reasonable steps to protect your personal information from unauthorised access, use, or disclosure. These measures include encrypted data transmission (HTTPS), access controls, and industry-standard cloud security practices.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or out-of-date information.
• Request deletion of your personal information (subject to legal retention obligations).
• Complain about a breach of the Australian Privacy Principles.

To exercise any of these rights, contact us at kai8@kercom.org. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We use session cookies and local storage to keep you signed in and maintain your preferences. We do not use advertising cookies or third-party tracking pixels.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice in the app. Continued use of the service after changes are posted constitutes acceptance of the updated policy.