Privacy Policy

1. Who this covers

This policy explains how Dutch Digital Dynamics Pty Limited (ABN 86 081 237 087) of Queensland, Australia handles personal information across EveryVerdict and its products, including everyverdict.com, everyverdict.com.au, vanverdict.com and car.everyverdict.com.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. What we collect

Information you give us

• Account details: your email address, a first name if you choose to give one, and a password which we store only as an Argon2id hash. We never store your password itself.
• Two factor authentication: if you turn it on, the secret needed to verify your codes.
• Your records: the notes, photos, voice notes, documents, brochures, quotes, checklist answers and buyer profile you create. These can include incidental personal information about other people, for example a dealer's name in a note or a person in the background of a photo.
• Support correspondence: emails you send us and our replies.
• Survey answers: if you tell us what you ended up buying when a pass expires.

Information collected automatically

• Session and security logs: your IP address, browser user agent, and the time of sign in, sign out, password reset and similar security events. We keep these to protect accounts and to investigate abuse.
• Consent records: which version of these policies you accepted, and when.
• Usage counters: how many AI research requests you have used, so we can apply quotas.
• Email delivery records: which service emails we sent you and whether they were sent successfully.
• Cookies: a single essential session cookie that keeps you signed in, and a companion token used to protect against cross site request forgery. We use no advertising, profiling or third party analytics cookies.

Information from others

• Stripe: confirmation that a payment succeeded, the amount, the currency, the pass purchased, and a Stripe reference. We never receive or store your full card number, expiry or security code.

3. Why we collect it

We use personal information to create and run your account, store and sync your records, produce the features you ask for, take payment and issue receipts, tell you when a pass is about to expire, answer your support questions, keep accounts secure and detect abuse, meet our tax and legal record keeping obligations, and improve the service.

We send you service emails, for example receipts, expiry notices and security alerts, because you need them to use what you paid for. If we ever send anything promotional it will carry an unsubscribe link.

4. Who we share it with

We do not sell your personal information and we do not share it for advertising. We disclose it only to the following, and only as far as needed:

• Stripe Payments Australia Pty Ltd and Stripe, Inc. to take payment and manage receipts and refunds. Stripe handles your card details directly under its own privacy policy.
• Anthropic, PBC where you trigger an AI assisted research or document extraction feature. The text or document content of that request is sent to Anthropic's API for processing and the result is returned to you. Do not put information in a note that you would not want processed this way.
• Contract check documents. An order form or contract you upload is stored with your records on our Brisbane servers like any other document. It is only sent to Anthropic if you choose the optional AI read, and only at that moment. The read comes back to you on screen and is not kept by us; we keep a usage record of the date, the number of files and the processing cost, not the document or its contents. A contract usually carries your name, address and the dealer's details, so treat the AI read as you would any overseas disclosure described in section 5, and skip it if that is not acceptable to you.
• A partner account you have linked. If your pass includes a partner and you link one, that person can see and work on the shared records. That is the point of the feature, so link only someone you intend to share with.
• Our hosting provider, Host Universal Pty Ltd, which operates the Brisbane infrastructure the service runs on.
• Professional advisers, and law enforcement or regulators, where we are required or authorised by law, or where it is necessary to protect someone's safety or our legal rights.
• A buyer of the business, if the service is ever sold or transferred, in which case the new operator must honour this policy or give you notice of a new one.

5. Where your information is stored, and overseas disclosure

Your account, your records and your uploaded files are stored on our own servers in Brisbane, Queensland, Australia. Email is sent from that same Australian infrastructure.

Two of the services above process data outside Australia, principally in the United States: Stripe, for payment processing, and Anthropic, for AI assisted features you trigger. By using those features you consent to that overseas disclosure. We take reasonable steps to deal only with providers that are bound to protect the information, but we cannot control an overseas provider to the same degree as our own systems.

6. Security

We protect your information with HTTPS in transit, Argon2id password hashing, session tokens stored only as SHA-256 hashes, optional two factor authentication, cross site request forgery protection, rate limiting on sensitive endpoints, and access controls on administrative functions. Our administrative interface is separate from the product and every administrative request is authorised on the server.

No system is perfectly secure. If a data breach occurs that is likely to cause you serious harm we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

7. How long we keep it

• Your account and records: while your account exists. When a pass expires the account becomes read only, your records remain so you can view and export them, and nothing is deleted for that reason alone.
• If you ask us to delete your account: we delete your account and records within 30 days, except where we must keep something by law.
• Payment and tax records: seven years, as Australian tax law requires. These are transaction records, not card details.
• Security and authentication logs: up to 12 months.
• Backups: deleted content can persist in routine backups for a short period until those backups age out.

8. Your rights

You can:

• Access the personal information we hold about you. Most of it is visible in your account, and you can export your records from inside the app at any time.
• Correct anything inaccurate, in the app or by emailing us.
• Delete your account and records by emailing us. Where we must retain something by law we will tell you what and why.
• Withdraw consent to optional features, for example by not using the AI assisted research.
• Complain if you think we have mishandled your information.

Email support@everyverdict.com for any of these. We respond within 30 days and we do not charge for access requests.

9. Complaints

Tell us first, at support@everyverdict.com, and we will investigate and reply in writing within 30 days. If you are not satisfied with our response you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

10. Children

The service is not intended for anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.

11. Changes

We may update this policy. The version and date at the top tell you which one applies. For material changes we will notify you by email or in the app before they take effect.

12. Contact

Privacy enquiries: support@everyverdict.com. Full business and postal details are on the support page.