Privacy Policy

CrossCourtAI Pty Limited
Last updated: 19 October 2026

This Privacy Policy explains how CrossCourtAI Pty Limited (CrossCourtAI, we, us or our) handles personal information. It covers our website at https://crosscourtai.com (the Website) and our Harper platform (Harper), an AI platform that helps our business clients review and report on deal and investment documents.

We are bound by the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs).

1. Key terms

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true and whether or not it is recorded in a material form.

Sensitive information is a type of personal information defined in the Privacy Act. It includes information or an opinion about an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union or professional association, sexual orientation, criminal record, and health or genetic information.

Client means a business that has a contract with us to use Harper. Client content means the documents, files and other material a client or its users put into Harper, and the outputs Harper produces from them.

2. Our two roles

We handle personal information in two different ways.

For ourselves. We decide how we handle personal information about Harper users, website visitors, people who contact us, and prospective and existing client contacts. This policy describes how we do that.
For our clients. Client content can include personal information about other people, for example the names of directors, employees or counterparties in deal documents. The client decides what goes into Harper. We handle that information only to provide Harper to that client under its contract with us, and not for our own purposes. If you think your personal information is in a client's documents, please contact that client first. If you contact us, we will tell the client and act on its instructions.

3. What personal information we collect

The personal information we collect depends on how you deal with us.

Harper users: your name, email address and sign-in details. Sign-in is managed by our identity provider, Auth0, which holds your password in hashed form. We do not see or store your password. We also keep records of how you use Harper, such as when you signed in and the actions you took. These records can include your name or email address. We use them for security, support and running Harper, store them in Australia, and keep them for up to two years before deleting them.
Client content: whatever personal information a client or its users put into Harper (see section 2).
Website visitors and contacts: your name, email address, phone number, business details and anything else you send us, for example when you contact us, ask for a demo or sign up for updates. When you visit the Website, we also record your IP address, the pages you visit, the page that referred you, your browser type and your approximate location (city and country). We use this to understand how the Website is used and to keep it secure. We store these visit records in Australia and delete them after two years.
Business contacts: names and contact details of people at our clients, prospective clients, suppliers and partners, and the content of our emails and meetings with them.

We do not intend to collect sensitive information about you. Client content may contain sensitive information about other people, which we handle only as described in section 2.

4. How we collect personal information

We collect personal information:

directly from you, for example when you use Harper, contact us or meet with us;
from your employer or organisation, for example when a client sets up a Harper account for you; and
from client content, as described in section 2.

Where we collect information about you from someone else, we take reasonable steps to make sure you are aware of it, unless the information is client content, in which case the client is responsible for that.

Cookies. Our Website and Harper use cookies and similar technologies to keep you signed in and for performance and diagnostics, such as measuring how quickly pages load and finding errors. Our Website also uses Google Analytics cookies to measure visits and see which campaigns bring people to the Website. When you book a demo, Calendly sets its own cookies. We do not use cookies for advertising. You can block or delete cookies in your browser, but parts of Harper may not work without them.

5. Why we collect, use and disclose personal information

We use personal information to:

provide, secure, support and improve Harper and the Website;
create and manage Harper user accounts;
deliver Harper to our clients under their contracts, including processing client content;
communicate with you, including service and security notices;
manage our relationships with clients, prospective clients and suppliers;
send you information about our business that you would reasonably expect to receive (see section 6); and
meet our legal obligations.

We only use personal information for the purpose we collected it for, or for a related purpose you would reasonably expect, or where you consent or the law requires or allows it.

AI models. Harper uses third-party AI models to read and analyse client content. Client content is used only to deliver Harper to the client that provided it. Client content is not used to train AI models, either by us or by our AI model providers.

We do not sell personal information.

6. Direct marketing

We may send you information about our business if you have given us your details and would reasonably expect to hear from us. Every marketing email includes a simple way to unsubscribe, and you can also ask us to stop at any time using the contact details in section 13. We do not use sensitive information for marketing. We do not use client content for marketing.

7. Who we share personal information with

We share personal information only as needed for the purposes in section 5, with:

our service providers who host, run and support Harper and our business. These include cloud hosting (Microsoft Azure, Amazon Web Services and Fly.io), sign-in (Auth0), AI model providers (Anthropic, OpenAI and Google), email delivery (SendGrid), website hosting and analytics (Netlify and Google Analytics), demo bookings (Calendly), and the business tools our team uses (such as Google Workspace, Microsoft 365 and Granola). Our service providers may only use personal information to provide their services to us;
the client you are associated with, for example your employer's Harper administrators can see your account and your activity in their Harper environment;
our professional advisers, such as lawyers, accountants and auditors; and
others where the law requires or allows it, for example a regulator or a court, or where needed to protect the safety or security of people or systems.

8. Overseas disclosure

Where Harper stores data. Harper stores client content and Harper account data in Australia, in Microsoft Azure (Australia East), Amazon Web Services (Sydney, ap-southeast-2) and Fly.io (Sydney). Our sign-in provider, Auth0, uses an Australian tenant.

Where some processing happens outside Australia. Some of our service providers process personal information outside Australia:

AI model providers. When Harper analyses client content, the relevant text is sent to an AI model provider for processing. We use Anthropic's Claude models (mainly through Amazon Web Services' Bedrock service), OpenAI and Google's Gemini (paid service). Some of these requests are processed outside Australia, in the countries where those providers or their cloud providers run their systems, which can include the United States.
Business tools. Our team uses business software such as Google Workspace, Microsoft 365, SendGrid (email delivery) and Granola (meeting notes). These services may store or process personal information, such as emails, contact details and meeting notes, outside Australia, including in the United States.
Website services. Our Website is hosted by Netlify, uses Google Analytics, and takes demo bookings through Calendly. These services may process visitor and booking details outside Australia, including in the United States.

Before we use a service provider that processes personal information overseas, we take reasonable steps, usually through the provider's terms, to make sure it handles the information in a way that is consistent with the APPs. We review our providers regularly and update this policy when we add a new overseas provider.

9. How we protect personal information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include keeping each client's Harper data in its own environment, encrypting data, controlling and regularly reviewing who can access it, and operating an information security management system.

If we have a data breach that is likely to result in serious harm, we will assess it and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

10. How long we keep personal information

We keep personal information only for as long as we need it to provide Harper, to meet our contracts with clients, or to comply with the law. After that we delete or de-identify it. When a client stops using Harper, we delete that client's Harper environment and its data unless the contract says otherwise.

Deleted data can remain in our backups for up to about 30 days until those backups expire.

11. Access, correction and deletion

You can ask us to:

give you access to the personal information we hold about you (APP 12);
correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13); or
delete your personal information, including closing your Harper account.

To make a request, email us at the address in section 13. We will confirm your identity before we act, and we will respond within 30 days. There is no charge to make a request. If we refuse a request, for example because the law allows or requires us to, we will tell you why in writing and how to complain.

Some information may be kept after a deletion request where we need it for legal, regulatory or record-keeping reasons. Deleted data can remain in backups for up to about 30 days (see section 10).

If your request is about personal information in a client's documents, we will tell that client and act on its instructions (see section 2).

12. Complaints

If you have a concern or complaint about how we have handled your personal information, please contact us using the details in section 13. Complaints are handled by our Chief Technology Officer, James Oliver. We may ask you for more information to understand your concern. We aim to respond within 30 days. If we agree your complaint is well founded, we will work with you to put things right.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

Website: https://www.oaic.gov.au
Phone: 1300 363 992

13. Contact us

For privacy questions, requests or complaints, contact:

Privacy contact, CrossCourtAI Pty Limited
Email: [email protected]
ABN 86 684 463 134

14. Changes to this policy

We review this policy at least once a year, and update it when the way we handle personal information changes, including when we start using a new overseas service provider. The current version is always available on our Website, with the date it was last updated.