Privacy Policy

Platfirm AI Pty Ltd (Platfirm, we, us, our), ACN 679 859 744 / ABN 24 679 859 744, of Level 17 & 18, International Tower 3, 300 Barangaroo Avenue, Sydney NSW 2000, operates CabRank Legal (cabrank.legal). This Privacy Policy explains how we collect, use, share, retain, and disclose personal information, and what your rights are.

CabRank is a referral marketplace, AI intake and referral handoff platform. It is not a legal practice management system, case management system, conveyancing management system, billing system, trust accounting system, time recording system, document management system or system of record for legal matters. Where information is passed to a law firm’s own practice management system, calendar or document store, the firm controls that information from that point on.

Platfirm is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy is written in plain English. If you have questions, contact us at contact@platfirm.ai.

1. Who this policy applies to

This policy applies to personal information of:

• Members of the public who interact with our intake channels (web bookings at cabrank.legal/book, partner-site web forms, voice AI hotlines) and become legal enquiry referrals on the CabRank platform.
• Lawyers and law-firm administrators who sign up to receive referrals through the CabRank platform.
• Website visitors who browse cabrank.legal without signing up.

2. Personal information we collect

We collect different categories of personal information depending on how you interact with CabRank.

From members of the public seeking legal help:

• Name, phone number, email address.
• State or territory of residence; postcode.
• Area of law of the legal enquiry; a brief description of the enquiry or requested assistance.
• For paid bookings: billing information processed by Stripe (CabRank does not see or store card details).
• For voice intake calls: an audio recording and AI-generated transcript and summary of the call.

From lawyers and law-firm administrators:

• Name, work email, mobile number, firm name, ABN, position.
• Practising-certificate state(s), areas of law, preferences for receiving referrals.
• Connection credentials for handoff destinations the firm chooses: OAuth tokens for bring-your-own storage such as Google Drive, and, for firms connecting DeedBox directly, the connection key the firm issues from its own DeedBox (revocable by the firm at any time). We never see your third-party system password. For firms whose practice-management system (Clio, LEAP, Smokeball or Actionstep) connects through our Zapier integration, your practice-management login is entered by you directly with Zapier and is never visible to CabRank.
• Billing information for subscription payments processed by Stripe.

From website visitors:

• Standard server log information (IP address, browser, page requested, timestamp).
• Cookies necessary for the site to function. We do not use third-party advertising cookies.

3. How we use your personal information

We use personal information for the purpose for which it was collected, and for purposes that are reasonably necessary or directly related, including:

• Members of the public: to route your legal enquiry to a suitable Australian lawyer; to process bookings; to send confirmations and follow-ups; to operate our referral matching and AI redaction; to respond to enquiries; and to support our intake-channel partners where you came in through their channel.
• Lawyers and firms: to provide the CabRank platform; to match referrals to your practice profile; to pass confirmed intake information to your connected handoff destination or BYO storage where enabled; to bill your subscription; to provide support; and to send service notifications such as digests, account changes and security advisories.
• All users: to operate, secure, and improve the platform; to comply with legal obligations; to investigate complaints; to detect and respond to misuse.

We do not sell your personal information. We do not use your personal information to train AI models.

4. Who we share your personal information with

CabRank shares personal information with third parties only as described in this policy. The third parties fall into three categories.

Sub-processors are service providers we engage to operate the platform — hosting, payment processing, email delivery, AI summarisation, and so on. We disclose all sub-processors, including their hosting region and what data they handle, on our Security page. Sub-processor changes are notified to firm administrators by email at least 14 days before taking effect, unless otherwise agreed.

Australian lawyers receiving referrals. When a member of the public becomes a referral on the platform and an Australian lawyer claims the referral, we share the relevant referral and intake information — including your name, contact details, jurisdiction and enquiry summary — with that lawyer so they can assess the enquiry and decide whether to act. AI-redacted summaries are shown to lawyers before they claim a referral, so the commercial framing of any intake call is stripped before any lawyer sees it.

Connected systems chosen by the firm. Once a lawyer claims a referral and the firm chooses to proceed, confirmed intake information may be passed to the firm’s chosen handoff destination: the firm’s own DeedBox installation (connected directly), the firm’s practice-management system (Clio, LEAP, Smokeball or Actionstep, delivered via Zapier, our workflow sub-processor), or bring-your-own Google Drive. The firm is responsible for that information once it is in the firm’s own system. CabRank does not maintain the legal file of record.

Compliance and lawful requests. We may disclose personal information where required or permitted by law, including in response to a valid request from a court, regulator, or law-enforcement agency.

5. Cross-border disclosure (APP 8)

CabRank’s primary infrastructure is hosted in Sydney, Australia. However, several of our sub-processors are based overseas, principally in the United States. Examples include Anthropic (AI summarisation), Stripe (payments), Vercel (web hosting edge), Resend (email), Twilio (SMS), and Zapier (practice-management delivery).

When we share personal information with these overseas sub-processors, we take reasonable steps to ensure they handle that information in a way consistent with the Australian Privacy Principles. The contractual safeguards under which we share data with our sub-processors are equivalent to those required by APP 8.

A complete list of our sub-processors and their hosting regions is on our Security page.

6. How long we keep your personal information

We keep personal information only for as long as necessary for the purposes for which it was collected, or as required by law.

• Pre-claim referral and intake information: retained on the platform for up to 90 days from creation, after which it is deleted or anonymised unless still active.
• Claimed referral metadata: limited operational metadata such as referral ID, area of law, state, claim event and paid status — with no client-identifying detail — is retained for audit and analytics. The legal file of record lives in the firm’s chosen system, not on CabRank’s servers.
• Lawyer / firm-administrator profiles: retained for the lifetime of the account, plus a reasonable archival period after account closure to comply with tax, audit, and legal obligations.
• OAuth tokens: deleted immediately when a firm disconnects the relevant integration, or 30 days after account closure if not earlier disconnected.
• Call recordings and transcripts from voice intake: redacted summaries may be retained as part of the referral and intake record; raw recordings are retained only as long as needed for AI processing and quality assurance, typically less than 90 days.
• Server logs and analytics: retained for up to 12 months.

7. Your rights — access, correction, and deletion

Under the Australian Privacy Principles, you have rights to:

• Access the personal information we hold about you.
• Correct any inaccuracy in your personal information.
• Request deletion of your personal information, subject to any legal obligation we have to retain it.

To exercise any of these rights, contact support@platfirm.ai. We will:

• Acknowledge your request within 5 business days.
• Verify your identity before acting on the request.
• Complete a verified deletion request within 30 days.
• If we are unable to comply with all or part of your request, explain why in writing.

Where personal information has been passed to a firm’s own system or storage as part of a claimed referral, that information is under the firm’s control, not CabRank’s. We will help you contact the firm to make a separate request to them.

8. How we protect your personal information

CabRank’s data hosting, encryption, access controls, incident-response procedure, vulnerability-disclosure path, and patching SLAs are documented on our Security page. In summary:

• Primary hosting in Sydney, Australia (Supabase ap-southeast-2).
• HTTPS-only connections, TLS 1.2 or higher.
• Encryption at rest (AES-256), encryption in transit, bcrypt password hashing.
• Row-level security at the database layer; named, least-privilege administrative access with strong authentication on the hosting, code and deployment platforms.
• Material security incidents affecting customer data are notified to affected firms within 72 hours of CabRank becoming aware, consistent with the notifiable-data-breach scheme under the Privacy Act 1988 (Cth).

9. Cookies and analytics

cabrank.legal uses cookies necessary for the site to function (such as session cookies for signed-in users). We do not use third-party advertising cookies and we do not run cross-site tracking. Server-side analytics is limited to anonymised page-view metrics required to operate and improve the platform.

10. Children

CabRank’s services are not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child’s personal information has been provided to us, contact support@platfirm.ai and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. The version number and last-updated date at the top of this page indicate the current version. Material changes will be notified to firm administrators by email at least 14 days before taking effect. Continued use of the platform after a change takes effect constitutes acceptance of the updated policy.

12. Document framework

This Privacy Policy operates alongside the contractual documents applicable to your tier:

• Network members: sections 10 (Client information and permitted use) and 11 (Privacy compliance) of the CabRank Network Membership Agreement set out additional obligations on Network members in respect of personal information they receive through the platform.
• Priority and AI Partner customers: the Master Subscription Agreement, and (for AI Partner) the Privacy & Data Processing Schedule, set out the framework for how Platfirm processes Customer Data on behalf of the firm.

13. Complaints

If you think we have mishandled your personal information, please contact us first at contact@platfirm.ai. We will acknowledge your complaint within 5 business days and provide a substantive response within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

14. Contact

Privacy questions and access / correction / deletion requests: support@platfirm.ai. General contact: contact@platfirm.ai. Postal: Platfirm AI Pty Ltd, Level 17 & 18, International Tower 3, 300 Barangaroo Avenue, Sydney NSW 2000, Australia.