Australian privacy framework

Privacy Policy

Effective 19 August 2026

Brocha Pty Ltd, trading as ClearanceProof, respects your privacy. This policy explains how we handle personal information in alignment with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply, and as our operating standard where they do not mandatorily apply.

1. Information we collect

• name, date of birth, email, address and country information;
• police certificates, translations and criminal-record information;
• passport, driver licence, national identity card or residence-permit details;
• application, review, source-check, report and sharing-link records;
• payment status and Stripe transaction references, but not full card details;
• security, access, device and technical logs reasonably needed to operate and protect the service; and
• communications, complaints and support requests.

Criminal-record and some identity information is sensitive. Before you select documents, we display a short Collection Notice and ask for a separate, unselected, express consent covering criminal-record information, identity documents, AI-assisted extraction, translation and document-detail comparison, mandatory human review, relevant overseas processing and creation of the requested report. Contractual acceptance of our Terms is separate from this consent. We retain evidence linked to the application and user, including the consent time and the versions of the consent wording, Collection Notice and Privacy Policy. If you do not provide this consent, we cannot collect the documents or prepare a report.

2. How we collect information

We collect information directly from you when you apply, pay, sign in, communicate with us or manage a link. We may also record information returned by an official government portal, QR code or digital-signature check where an official-source check is requested and available.

3. Why we use it

We use personal information to provide the requested translation and report; compare identifying information appearing across supplied documents; perform human and AI-assisted extraction; conduct manual official-source checks; process payments; communicate about an application; issue and verify reports; operate revocable sharing links; prevent fraud and misuse; resolve disputes; maintain audit integrity; and comply with law. A document-detail comparison does not independently establish the applicant's identity.

AI assists extraction, language identification, translation and comparison. It does not independently approve or issue a report. A human reviewer must assess the source documents, approve relevant fields and decide whether to issue the report.

4. Disclosure and service providers

We disclose only what is reasonably necessary to providers that support the service, including Cloudflare for hosting and private document storage, OpenAI for AI-assisted processing, Stripe for payments and Resend for transactional email. These providers process information under their own security and privacy obligations.

Authorised report recipients see the issued report and live verification status through the link you share. They do not receive your uploaded identity document or original police certificate from us. We may disclose information to advisers, insurers, regulators, courts or law-enforcement bodies where authorised or required by law, or where reasonably necessary to establish or defend legal claims.

5. Overseas processing

Our providers and authorised operational personnel may process information outside Australia, primarily in New Zealand and the United States, and in other locations used by those providers. We take reasonable steps appropriate to the circumstances before using overseas providers and assess their contractual and security safeguards. Overseas privacy protections may differ from Australian law.

6. Security

We use private object storage, encryption in transit, access controls, restricted administrative access, signed sessions, audit records and human approval controls. No internet service can guarantee absolute security. If a data breach is likely to cause serious harm and the Notifiable Data Breaches scheme applies, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

7. Retention and deletion

• Uploaded police certificates and identity documents are scheduled for deletion 30 days after a report is issued or an application is finally closed, unless reasonably required for an active dispute, fraud investigation or legal obligation.
• Issued reports remain available while your account is active or until you request deletion, subject to integrity, dispute and legal requirements.
• Revoked or expired links stop providing access, but a recipient may retain a copy they previously downloaded.
• Payment, consent, security and business records may be retained for the period reasonably required by Australian accounting, corporate, fraud-prevention and legal obligations.
• Residual encrypted backups may persist for a limited rotation period before being overwritten.

We destroy, de-identify or place information beyond use when it is no longer reasonably needed and no law requires retention.

8. Access, correction and choices

You may request access to or correction of personal information we hold, revoke a sharing link, request account closure or ask us to delete information that we are not required to retain. We may need to verify your identity before acting. If we refuse a request, we will explain why where required.

Transactional messages are necessary to deliver the service. We will not use police-certificate or identity information for direct marketing. Any future marketing will require the appropriate consent and include an unsubscribe method.

9. Privacy complaints

Email the Privacy Officer at hello@clearanceproof.com with enough information for us to investigate. We aim to acknowledge a complaint within 5 business days and provide a substantive response within 30 days. If you are not satisfied and the Privacy Act applies, you may complain to the Office of the Australian Information Commissioner.

10. Updates

We may update this policy when our practices, providers or legal obligations change. Material changes will be identified by a new effective date and, where appropriate, notified to account holders.