fairgo
Sign inStart free
§ Company · Privacy Policy

How we handle your information.

Plain English first, formal terms underneath. We aim to collect only what we need to run the analysis and the letter, keep our database in Australia, and never sell your information. We share it only with the service providers that run fairgo for us, listed below, or where the law requires or authorises it.

Last updated · 10 October 2026

1. Who we are

This privacy policy applies to fairgo (the “Service”), an online tool that helps Australian consumers prepare demand letters under the Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth)). In this policy, “we”, “us”, and “our” refer to the operator of fairgo. References to “you” mean any user of the Service, whether you have created an account or are using the Service as a guest. You can contact us through our contact form.

We are bound by the Australian Privacy Principles (APPs) set out in Schedule 1 of the Privacy Act 1988 (Cth) where they apply to our activities, and we aim to handle your information in accordance with that framework regardless.

2. Information we collect

We collect most information directly from you, when you use the wizard, the chat assistant or the contact form, or create an account. Some information is collected automatically as you use the site (§2.3).

2.1 Information you provide

  • Your situation description — the free-text story you enter at Step 1 of the wizard. This is the most sensitive item we collect; we treat it accordingly.
  • Optional context — whether the dispute concerns goods or services, an approximate incident date, the outcome you want, your state or territory.
  • Business details — the name, ABN (if provided), and contact address of the business you intend to write to.
  • Key facts — incident date, dispute amount, and a short description of what the business has refused.
  • Personal contact details (optional) — your name, street address, email, and phone, used to substitute the bracketed placeholders in the generated letter. These are optional; if omitted, the placeholders remain for you to fill in by hand after download.
  • Account details — if you choose to register, your email address and a password (handled by our authentication provider, never stored in plain text by us), or, if you choose to continue with Google, the name, email address and basic profile details Google shares with us.
  • Proof-of-purchase photos (optional) — if you upload one, we send it to our AI processor to read the retailer, date and amount so we can pre-fill the wizard. We don't store the image.
  • Newsletter sign-up — your email address, if you subscribe.
  • Contact-form messages — if you write to us via the contact form, the message and the email address you provide for our reply.
  • Chat assistant conversations — when the chat assistant is enabled and you use it: your messages, our assistant's responses, and the timestamps. Conversations are stored on our servers, whether or not you are signed in, so the assistant can work and so we can operate, secure and improve the Service (which can include review by our team). If you remove a conversation it is hidden from you, but we may keep it; you can ask us to delete your chat history (§9).

You don't have to give us any of this, and you can use parts of the Service as a guest. But we can't analyse your situation or draft a letter without a description of it, and some features (such as saved matters) need an account.

2.2 Information generated by the Service

  • Legal analysis output — the result returned by Stage 1 of our AI pipeline (which provisions of the ACL may apply to your situation, a case-strength assessment, suggested next steps).
  • The demand letter — the letter produced by Stage 2 of our AI pipeline.
  • Status notes — if you mark a saved matter as sent, replied to, or resolved, that status and any notes you attach.

2.3 Information collected automatically

  • Usage events — metadata about how you use the Service (for example, which wizard step you reached, how long an analysis took, whether a download was triggered). We don't intend these records to contain the contents of your story or letter.
  • Cookies and similar technologies — described in §8.
  • Server logs — such as IP address, user-agent string and timestamps, used for security, abuse prevention and troubleshooting.
  • Traffic analytics (Vercel) — we use Vercel Analytics, a cookieless page-view counter, to measure which pages are visited and how the site performs in real browsers. It records information such as the page path you visited, the referring URL, your browser type and an approximate location. This data is processed by Vercel Inc. in the United States.
  • Detailed traffic analytics (Google Analytics 4) — we also use Google Analytics 4 (GA4) to understand how visitors find and use the site, which helps us prioritise improvements. GA4 sets first-party cookies (named _ga and _ga_<id>) that persist for up to two years and assign your browser an anonymous identifier. The data collected includes: pages you view, the referring URL, your browser and device type, approximate location (derived from your IP address), and engagement events such as scroll depth and outbound link clicks. Data is processed by Google LLC in the United States. You can opt out by installing Google's opt-out browser add-on or by blocking the relevant cookies in your browser settings. If you opt out you can still use the Service normally.

2.4 What we deliberately do not collect

  • Bank account numbers or payment card details.
  • Government identifiers (TFN, Medicare number, passport number).
  • Health or biometric information.
  • Information about anyone other than you and the business you are writing to.

Please don't enter these in your story or the chat. Before transmitting your story to our AI processor, we attempt to strip obvious patterns matching email addresses, Australian phone numbers, card-shaped digit runs, and ID-shaped digit runs, but this can't catch everything.

3. How we use your information

  • To run the legal analysis and produce your demand letter.
  • To deliver the letter to you in your chosen format (on-screen, plain text for email, PDF, or Word).
  • To provide the chat assistant.
  • To save your matters to your account, including saving your progress automatically while you're signed in.
  • To send you the newsletter and tips about your matter, if you subscribe or save a matter. Every such email has an unsubscribe link.
  • To enforce account security and prevent abuse of the rate limits and free-tier resources.
  • To fix bugs, improve the Service, and answer your support enquiries.
  • To meet legal obligations (e.g. responding to a lawful subpoena).

We do not use your situation description, your generated letter, or any of your account information to train or fine-tune AI models. We do not sell your information.

4. How we share your information

We share information with the third-party service providers that run components of the Service for us, for the purposes in §3:

  • Anthropic, PBC — provides the AI model that performs the legal analysis (Stage 1), drafts the letter (Stage 2) and powers the chat assistant. Your PII-stripped story, any proof-of-purchase photo you upload, your chat messages and the structured inputs are transmitted to Anthropic over an encrypted connection. Anthropic processes the data in the United States. Per Anthropic's published policies at the time of writing, content sent to the API is not used to train Anthropic's models.
  • Supabase (data residency: Sydney, Australia) — provides our database, authentication, and file storage.
  • Vercel Inc. — hosts and serves the Service; may process some request metadata in the course of routing and security. We also use Vercel Analytics (described in §2.3). Vercel is headquartered in the United States; analytics events are processed there.
  • Google LLC — provides Google Analytics 4 (described in §2.3). Google processes this data in the United States. We also offer "Continue with Google" sign-in; if you use it, Google shares your name, email address and basic profile details with us. We do not use Google Ads or AdSense.
  • Resend — sends transactional, contact-form and newsletter email on our behalf, holds our subscriber list, and may process it outside Australia, including in the United States.

We may also disclose information where the law requires or authorises it. We may change these providers over time, and will update this policy when we do.

5. Where your information is stored

Your account record, your saved matters, your in-progress wizard state and your chat conversations are stored in our Supabase project hosted in the Sydney (ap-southeast-2) region.

Cross-border disclosures occur in normal operation:

  • When we run the Stage 1 and Stage 2 AI calls, and when you use the chat assistant or upload a proof-of-purchase photo, the relevant inputs are transmitted to Anthropic's infrastructure in the United States for processing.
  • Anonymous page-view and performance events from your browser are sent to Vercel Inc. in the United States for the analytics described in §2.3.
  • Detailed traffic and engagement events from your browser are sent to Google LLC in the United States for the Google Analytics 4 service described in §2.3.
  • Email we send you, and contact-form messages, pass through Resend, which may process them outside Australia, including in the United States.

By using the Service you consent to these transfers. You can opt out of the Google Analytics transfer by following the steps in §2.3 without affecting your ability to use the Service.

6. How long we keep your information

We keep personal information only for as long as we need it for the purposes described in this policy, including to meet legal obligations and resolve disputes. When we no longer need it, we take reasonable steps to delete it or de-identify it. Backups may retain a copy for a limited period after that.

  • Saved matters — kept while your account exists. You can delete an individual saved matter from its page.
  • Your account and other information — you can ask us to delete your account and the information associated with it at any time (§9). We will act on the request within a reasonable time, except for anything we must keep by law.
  • Contact-form messages — kept for as long as needed to respond and to satisfy our record-keeping obligations.

7. Security

We take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include:

  • HTTPS (TLS) for all traffic.
  • Encryption of sensitive information, including additional application-level encryption of some stored content.
  • Access controls designed so that one account cannot read another account's data.
  • Passwords handled by our authentication provider, which stores them hashed rather than in plain text.
  • Rate limiting to help prevent abuse.

No system is completely secure. If we become aware of an unauthorised access or disclosure of your information that is reasonably likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and the affected individuals as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

8. Cookies and similar technologies

We use cookies and similar technologies (such as your browser's local storage) that the Service needs to work — for example to keep you signed in, to remember an in-progress wizard or chat conversation, and to remember preferences such as light or dark mode — plus the Google Analytics cookies (_ga and _ga_<measurement-id>) described in §2.3, which you can opt out of following the steps there. Our other analytics provider (Vercel Analytics) is cookieless by design. We do not use third-party advertising cookies.

9. Your rights

Under the APPs and Australian privacy law generally, you can ask us to:

  • Access the personal information we hold about you.
  • Correct any information that is inaccurate, out of date, incomplete, irrelevant or misleading.
  • Delete your account and the personal information associated with it, including your chat history.
  • Withdraw consent to optional uses of your information (where consent is the basis for that use).

To make any of these requests, write to us via the contact form. We will respond within a reasonable period. We may need to verify your identity before acting on a request, and if we refuse a request we will tell you why (unless the law says we needn't) and how to complain.

Complaints. If you think we have mishandled your information, contact us first via the contact form and we will look into it and respond within a reasonable period. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Children

fairgo is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time to reflect changes in the Service, our processors, or the law. The “Last updated” date at the top of the page tells you when the current version was published. We will give reasonable notice of material changes. Your continued use of the Service after a change constitutes acceptance of the updated policy.

12. Contact

If you have any questions about this policy, want to make a request described above, or want to lodge a privacy complaint, write to us via our contact form.

This policy is offered as a good-faith summary of how fairgo handles your information. It does not create rights or obligations beyond those imposed by Australian law. Where this policy and the law differ, the law prevails.