What changed

Every revision to our legal documents, newest first.

When we change the Terms of Service, Privacy Policy, Cookie Policy, data deletion instructions or data request policy, we write up what changed and why here. For a material change to the Terms, existing customers are asked to read and accept the new version the next time they sign in, and it takes effect for anyone who has not signed in by the date given.

27 October 2026

A minor update to the Privacy Policy's list of processors and to the Cookie Policy. Nothing changes for existing customers and no re-acceptance is asked.

Cloudflare (Turnstile). The live demo request form now carries a bot check run by Cloudflare, so a script cannot use it to send email in bulk. Cloudflare receives the visitor's network address and technical browser signals for that one form only; nothing typed into the form, and nothing from any signed-in page, goes to Cloudflare. Both policies describe it.

20 October 2026

Existing customers accept this version at their next sign-in; it applies to everyone from 4 November 2026. New sign-ups from 20 October are on this version.

Why

Three things prompted this revision. We went through every document against what the product actually does and fixed where the two had drifted. Features shipped since the last revision (sign-in with Microsoft, Google and Apple, the live demo, and organisation sharing) needed describing. And incident reports, which let a team record threats and safety incidents that happen off social media, are new in this release, so the documents say how that information is handled. We also added the disclosures the December 2026 changes to the Privacy Act will require about automated decisions.

Terms of Service

Incident reports (section 8). A statement is your team's own record, not a sworn document, and its author is responsible for its accuracy. Evidence files are kept with a content hash that shows they are unchanged since upload, and nothing more. Administrators can delete evidence, every deletion is logged, and you are responsible for not deleting anything that police, a regulator or a court may need. Uploaded recordings and footage must have been lawfully made. Cross-office matching suggestions are indications, not findings.
Personal information of other people (section 9) now covers people involved in incidents, including unidentified people, your staff and witnesses, and asks that injury or wellbeing details be recorded only with that person's agreement.
Billing (section 3) now spells out what the product already did: the 7-day trial with your card charged automatically when it ends, yearly plans, monthly allowances that do not carry over, one-off top-up packs, and promotional codes.
Accounts (section 2) adds a minimum age of 18, your responsibility for a Microsoft, Google or Apple account you sign in with, and a clause for agencies managing clients' accounts.
Safety (section 6) says "call 000 before you record anything in Clarify".
Housekeeping. The list of clauses that survive termination was corrected (section 16), overseas customers now get Tasmania as the governing law (section 19), and section 18 links to this page.

Privacy Policy

New collection sources: sign-in providers (Microsoft, Google, Apple), live demo requests, daily follower counts, and incident reports with the categories of information they can hold.
Automated decisions. A new section lists every automated assessment Clarify makes about personal information, what each one can affect, and the person who stays in control. This is the disclosure the amended Privacy Act requires from 10 December 2026.
Organisation sharing. What crosses between a workspace and the organisation it connects to, and between peer workspaces: escalated cases only, and for peers just the fact that an account is tracked and whether it is flagged, never comment content.
Overseas disclosure. The countries where our processors operate are now named, as the Australian Privacy Principles ask.
Google Fonts. Every page loads the Inter typeface from Google, which was not previously disclosed. It sets no cookies.
Storage of evidence. Files uploaded to a case live in a private container in Australia, are streamed only to signed-in members of the workspace, and are never removed by automatic clean-up.
Data breaches. A commitment to notify affected customers and the OAIC under the Notifiable Data Breaches scheme.
Your rights now extend to people described in an incident report, and explain that a correction to a statement is recorded as a new version.

Cookie Policy

A new Fonts section describing the Google Fonts request, and a correction to "no third-party scripts inside the signed-in service", which was true but left the font request unmentioned.

Data deletion instructions

Now mentions TikTok and X in the list for social-media users (both were missing), and the self-service Delete personal data page as well as email.
New sections on deleting incident evidence from inside Clarify, and on requests from people described in an incident report.

Data request policy

Now covers incident reports and evidence files, and says plainly that a customer handing their own case to police is their decision and outside this policy.

6 October 2026

Disclosed the Google Ads conversion tag on the public marketing pages and the sign-up form, the cookies it sets, where it never runs, and how to opt out.

4 October 2026

Added the threats, safety and reporting disclaimer (section 6): Clarify is not a monitoring or emergency service and can miss things.
Added our ABN, and a separate, optional marketing opt-in at sign-up with its own section on messages from us (section 17).

Contact

Questions about any change: support@clarify.net.au