Privacy Policy

The Safe Place Pty Ltd (ABN 63 691 612 021) (Safe Place, we, us or our) operates The Safe Place platform, website and related services (together, the Platform).

This Privacy Policy explains how we collect, hold, use, disclose and otherwise handle personal information in connection with our website, Platform, client onboarding, support services and business operations.

Safe Place handles personal information in accordance with the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) and other privacy and data protection laws that apply to our activities.

For privacy enquiries, requests or complaints, contact:

Privacy Officer
The Safe Place Pty Ltd
1 Freshwater Place
Southbank, Victoria, Australia
Email: hello@thesafeplace.com.au

Depending on how you interact with Safe Place and the Platform, we may collect or handle:

• account and contact information, such as names, email addresses and contact details;
• identity, role, organisation and workspace information;
• billing, subscription, invoicing and transaction records relating to the Client relationship;
• communications with us, including support requests and feedback;
• device, browser, cookie and log information;
• authentication, security and audit events;
• Platform usage, search and activity information;
• content uploaded, stored, processed or otherwise made available through the Platform by or on behalf of Clients (Client Content);
• information contained in Client Content, which may include images, video, audio, recorded voices, names, location information, transcripts and metadata;
• AI-generated or AI-derived information, including labels, embeddings, classifications, matches and confidence information;
• marketing and communication preferences; and
• information relating to suppliers, contractors and other business contacts.

Client Content may contain personal information about people who do not themselves have a Safe Place account.

In some circumstances, Client Content may also contain sensitive information, biometric information, information relating to children, or confidential and unreleased material.

Safe Place does not currently use voice biometric identification or speaker-recognition technology unless expressly introduced and disclosed in the future.

We may collect information:

• directly from you;
• from our Clients and their authorised administrators;
• when you create an account or accept an invitation to a workspace;
• through Client Content uploaded or connected to the Platform;
• through connected services and integrations;
• from our service providers; and
• from lawful public or business sources where appropriate.

Where a Client provides personal information about another person to Safe Place, the Client is responsible for ensuring that it has the necessary rights, permissions or authority to provide that information to us and use the Platform in relation to it.

We hold information using systems operated by Safe Place and third-party infrastructure, storage and technology providers.

Information may be held across live systems, backups, security systems and audit systems in accordance with this Privacy Policy and our contractual obligations.

We may collect, hold, use and disclose information to:

• create, administer and secure accounts and workspaces;
• provide storage, processing, search, retrieval, export and other Platform functionality;
• provide customer support and respond to enquiries;
• administer subscriptions, invoicing and Client relationships;
• authenticate users and manage permissions;
• maintain security, operational and audit logs;
• detect, investigate and prevent fraud, misuse, security incidents and other harmful activity;
• operate, maintain, troubleshoot and improve the Platform;
• communicate service, security and operational changes;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal rights; and
• develop and improve Safe Place's technology, products and services in accordance with this Privacy Policy and applicable law.

Platform Improvement and Client Content

Safe Place may use aggregated or de-identified information for analytics, service improvement, benchmarking, capacity planning and business planning.

Safe Place does not currently use identifiable Client Content to train or improve general Safe Place algorithms or models unless the relevant Client has expressly authorised that use or another lawful basis permits it.

Where a Client expressly authorises such use, Safe Place may use authorised Client Content internally to test, train, develop or improve Safe Place algorithms, models or Platform functionality, subject to the Client agreement and applicable law.

A Client may withdraw that authorisation for future use by contacting Safe Place.

Withdrawal will stop future training or improvement activities covered by that authorisation.

To the extent permitted by applicable law, withdrawal does not require Safe Place to reverse or remove improvements or developments already lawfully produced before the withdrawal took effect.

Safe Place will not publicly publish, market or demonstrate identifiable Client Content without the Client's written approval.

The Platform may offer AI-assisted features, including facial recognition or face-matching functionality.

Facial recognition and face matching are optional, Client-controlled features and are not automatically enabled for Client Content.

These features are only made available where appropriate legal, consent, retention and operational requirements have been addressed.

Where a Client enables facial recognition or face matching, the Platform may generate, store, process or compare facial templates, embeddings or other information derived from images or video for the purpose of identifying or suggesting possible matches within authorised Client Content.

Facial templates and other information used for biometric identification may constitute sensitive information or biometric information under applicable privacy laws.

Safe Place will only process biometric information where permitted by applicable law and where applicable requirements concerning consent, authority, notice or another lawful basis for processing have been satisfied.

Clients must ensure that they have all rights, permissions, notices, consents and other legal authority required for Client Content they provide to Safe Place and for their use of facial recognition or face-matching functionality.

Safe Place may require a Client to provide information or confirmation regarding its authority to use these features and may restrict, suspend or disable facial recognition functionality where Safe Place reasonably considers this necessary to comply with applicable law.

Safe Place implements technical and organisational controls appropriate to the services being provided and applicable contractual and legal requirements.

Facial matching results are intended to assist authorised users by providing possible matches and confidence information.

Facial matching may not always be accurate.

Suggested facial matches require human review before being confirmed or relied upon for consequential action.

Safe Place does not use facial matching to make fully automated decisions that produce legal effects or similarly significant consequences for an individual.

We may disclose or make personal information available to:

• authorised users and administrators of the relevant Client workspace;
• cloud storage and infrastructure providers;
• hosting, computing and content-delivery providers;
• authentication and security providers;
• analytics and monitoring providers used for Platform operation and reliability;
• communications and customer-support providers;
• AI and machine-learning service providers where required to provide authorised Platform functionality;
• professional advisers, including lawyers, accountants, insurers and auditors;
• prospective purchasers, investors or transaction counterparties in connection with a proposed or completed sale, merger, financing, restructure or similar corporate transaction; and
• courts, regulators, law-enforcement agencies and other authorities where disclosure is required or permitted by law.

Our service providers and subprocessors may change as the Platform develops.

Where required by applicable law or contract, we will make relevant information about subprocessors available to affected Clients.

Safe Place does not sell personal information in the ordinary meaning of the word.

Where applicable privacy laws give individuals additional rights in relation to the sale, sharing or use of personal information for advertising or similar activities, Safe Place will provide those rights and choices where required by law.

When you connect a storage provider to The Safe Place, you grant us read-only access. We use that access for exactly one purpose: to copy the files you choose to import into your Safe Place library. We never modify or delete anything in your Google Drive or Dropbox.

What we retain. When you choose files or folders to import we first record a list of those files — such as name, folder path, size, modification time, file type and a content hash — so you can see what is there before it is copied. We copy file contents only for the files you import: the file itself plus basic metadata (title, original folder path), which becomes ordinary library data you manage like any other file. Disconnecting revokes our access and deletes the stored credentials; records of files found by a scan are retained with your import history until your workspace is deleted or you ask us to remove them. Import job history includes a per-file record (path, size and outcome, including any error) for the files a scan found.

Disconnecting. When you disconnect a provider, we revoke our access with the provider and delete the stored credentials. If the provider cannot be reached at that moment the connection stays listed so you can retry, and the credentials are deleted as soon as the revoke succeeds. Files you already imported remain in your library — disconnecting removes the connection, not your content.

Access credentials. Provider access tokens are encrypted at rest and are never shared with third parties. The one place a token leaves our servers is Google's own folder picker: when a workspace owner or admin opens it to choose folders, their browser receives a short-lived Google Drive token so Google can show them their folders. That token is not stored, and every issue of it is recorded in the workspace's audit log.

Deletion. If you close your account, we delete your account data — including imported files and all provider-derived metadata — from production systems within 30 days of your request. Residual copies in backups and storage versioning are removed within a further 30 days (60 days worst case).

Limited Use disclosure (Google user data). The Safe Place's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, Google user data:

• is never used for advertising purposes;
• is never sold, and is not transferred to third parties except as necessary to provide or improve user-facing features you have asked for — such as importing your files, and the AI tools you choose to run on them — for security purposes, to comply with applicable law, or as part of a merger or acquisition (with prior notice to you);
• is never used to train generalized artificial-intelligence or machine-learning models;
• is read by humans only in narrow circumstances: with your explicit consent (for example, a support request you initiate), where necessary for security or abuse investigation, or where required by law.

We apply these same commitments to data received from Dropbox.

Safe Place operates internationally and uses service providers that may process or store information in different countries.

Depending on the infrastructure used to provide the relevant services, personal information may be processed or stored in:

• Australia;
• New Zealand;
• the United States;
• the United Kingdom;
• countries within the European Union; and
• other locations disclosed to the relevant Client where required or agreed in connection with the services.

Specific data-residency or infrastructure arrangements may be agreed with a Client where available and appropriate.

Backups and redundant copies may be stored separately from live data.

Before disclosing personal information to an overseas recipient, Safe Place will take the steps required by applicable law in the circumstances.

This may include contractual, organisational and technical safeguards designed to protect personal information transferred or disclosed internationally.

Information about relevant provider locations or subprocessors may be made available to Clients where required by applicable law or contract.

We use administrative, technical and organisational safeguards designed to protect information against unauthorised access, loss, misuse, interference, alteration or disclosure.

Depending on the service and circumstances, these safeguards may include:

• access controls and permission management;
• least-privilege access practices;
• authentication and account-security controls;
• security and audit logging;
• infrastructure and provider security controls;
• monitoring and incident-response procedures; and
• organisational policies and access restrictions.

No method of electronic storage, transmission or processing is completely secure, and we cannot guarantee absolute security.

Clients should maintain independent copies of irreplaceable original material where appropriate.

We retain personal information for as long as reasonably necessary for the purposes for which it was collected, to provide the Platform, meet contractual commitments, and satisfy legal, accounting, security and regulatory requirements.

Client Content is generally retained for the duration of the relevant Client relationship.

Unless otherwise agreed, following termination of a Client relationship or trial opt-out, Client Content will normally remain available for a 30-day retrieval period.

After that period, Safe Place may permanently delete Client Content in accordance with its operational processes, subject to applicable legal requirements, backups, disaster-recovery systems, legal holds and other permitted retention.

Files deleted through the Platform may remain recoverable for up to 30 days and may continue to count toward the Client's storage usage during that period.

Authorised Client administrators may request permanent deletion of Client Content.

Permanent deletion requests remain subject to technical limitations, backup retention, legal holds and other legal or contractual requirements.

Where Client Content has previously been lawfully and with appropriate authority used to develop or improve Safe Place's algorithms, models or Platform, deletion of the original Client Content does not necessarily require Safe Place to reverse improvements or developments already produced from that use, to the extent permitted by applicable law.

Biometric information will be retained only for as long as reasonably necessary for the authorised purpose for which it is processed, subject to applicable contractual and legal requirements, and will be deleted or de-identified when it is no longer required unless retention is required or permitted by law.

The applicable Client agreement may contain additional retention, recovery, deletion and offboarding terms.

You may request access to personal information Safe Place holds about you or ask us to correct information that you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Depending on where you are located and the circumstances in which we process your information, you may also have rights to:

• request deletion of certain information;
• restrict certain processing;
• object to certain processing;
• request portability of certain information;
• withdraw consent where processing is based on consent; and
• request information about how your personal information is processed.

To exercise your rights or request access or correction, contact:

Privacy Officer
The Safe Place Pty Ltd
1 Freshwater Place
Southbank, Victoria, Australia
Email: hello@thesafeplace.com.au

Please describe your request and the information concerned.

We may need to verify your identity before completing a request.

Where Safe Place processes information on behalf of a Client and that Client determines how the information is used, we may refer the request to, or consult with, the relevant Client before responding.

We will respond to privacy requests within the time required by applicable law.

We may refuse or limit a request where permitted or required by law.

Where required, we will explain the reason for doing so and any available complaint mechanisms.

Our website and Platform currently use cookies and similar technologies that are necessary to operate, authenticate, secure and provide core functionality for the service and to remember certain user preferences.

We do not currently use advertising or marketing cookies through the Platform.

If Safe Place introduces non-essential analytics, advertising, marketing or similar technologies in the future, we will update this Privacy Policy and obtain consent where required by applicable law.

Users may also manage cookies using browser or device settings, although disabling strictly necessary cookies may affect Platform functionality.

Safe Place maintains processes for assessing and responding to suspected data breaches and security incidents.

Where a breach triggers notification requirements under the Australian Notifiable Data Breaches scheme or another applicable privacy or data-protection law, we will notify affected Clients, individuals and regulators as required by applicable law.

We will also cooperate with affected Clients where reasonably necessary to assist them in meeting their own applicable notification obligations.

If you believe Safe Place has breached your privacy rights, the Australian Privacy Principles or another applicable privacy or data-protection requirement, you may make a complaint to:

Privacy Officer
The Safe Place Pty Ltd
1 Freshwater Place
Southbank, Victoria, Australia
Email: hello@thesafeplace.com.au

Please provide enough information for us to understand and investigate your concern.

We will acknowledge and investigate privacy complaints and aim to provide a response within 30 days.

If we require additional time because of the complexity of the matter, we will let you know.

We encourage you to contact us first so that we have an opportunity to investigate and resolve your complaint.

If you are not satisfied with our response, you may have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC) or another privacy or data-protection regulator with jurisdiction over your complaint.

If Safe Place is involved in a merger, acquisition, financing, sale of assets, corporate restructure or similar transaction, information held by Safe Place may be disclosed to relevant advisers and transaction counterparties and may be transferred as part of that transaction.

Any such handling of personal information will remain subject to applicable privacy and data-protection obligations.

Safe Place Platform accounts are intended for people aged 18 years or older.

Safe Place does not currently use date-of-birth or age-verification checks as part of standard account creation.

A person under 18 may access a Client workspace only through a supervised arrangement expressly approved by both the relevant Client and Safe Place and subject to any additional requirements imposed by Safe Place.

Client Content may nevertheless depict, identify or contain information relating to children.

Clients are responsible for ensuring that they have the authority, permissions, notices and consents required by applicable law to upload and process such Client Content through the Platform.

Safe Place may require additional safeguards or consent before particular features, including biometric or AI-assisted features, are used in relation to children.

Safe Place may restrict or disable particular functionality where necessary to comply with applicable children's privacy or data-protection requirements.

The Platform may process images, audio, video, metadata, account activity and related information using automated or AI-assisted systems.

These systems may generate:

• search results and recommendations;
• labels, tags and classifications;
• transcripts and metadata;
• possible facial matches;
• confidence information;
• similarity results; and
• other AI-assisted outputs designed to organise, search or understand Client Content.

AI-assisted outputs may be incomplete, inaccurate or incorrect and should be appropriately reviewed before being relied upon for consequential decisions.

Safe Place does not use facial matching to make fully automated decisions that significantly affect a person's legal rights or interests.

Safe Place does not currently use automated processing to make decisions that could reasonably be expected to significantly affect an individual's rights or interests without appropriate human review.

If Safe Place introduces functionality under which a computer program uses personal information to make, or substantially and directly assist in making, decisions that could reasonably be expected to significantly affect an individual's rights or interests, we will update this Privacy Policy as required by applicable law.

We may update this Privacy Policy from time to time to reflect changes to the Platform, our business practices, service providers or applicable laws.

The current version will be published on our website with its effective date.

Where required by law, or where we make material changes affecting how personal information is handled, we will provide additional notice.

For privacy enquiries, requests, access or correction requests, or complaints, contact:

Privacy Officer
The Safe Place Pty Ltd
ABN 63 691 612 021
1 Freshwater Place
Southbank, Victoria, Australia
Email: hello@thesafeplace.com.au