Privacy Policy

GetPost Labs Pty Ltd operates Lex-AML, an AML/CTF workspace for Tranche-2 organisations regulated under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. Lex-AML is being developed to help lawyers, accountants, real estate professionals, conveyancers and dealers in precious metals and stones manage AML/CTF readiness, customer onboarding, customer due diligence, evidence collection, review workflows and audit-ready records.

• Name: Sumit Arora, Founder & Director
• Email: sumit@getpostlabs.io
• Address: 8 Clunies Ross Ct, Brisbane Technology Park, Brisbane QLD 4113
• Website: https://lex-aml.com.au

Lex-AML is designed with the following data principles, which govern how information is handled:

• Separated organisation workspaces — Lex-AML is designed to separate organisation workspaces and customer compliance records, so each organisation’s records are handled within organisation-specific data boundaries.
• Application-level protections — records are protected through access controls, authentication, audit logging and operational safeguards.
• Encryption — data is encrypted in transit (TLS 1.2+) and at rest. Internal services operate within a secured private network.
• Limited operational metadata — GetPost Labs may process limited operational metadata needed to operate, monitor, secure and support the platform (for example workspace identifiers, service status, integration status, usage counts, timestamps, error categories and support references).
• Restricted access — GetPost Labs does not use organisation or customer compliance records for unrelated marketing purposes. Access to organisation/customer records, where technically available, is restricted to authorised operational, security, support or legal purposes and is controlled and logged.
• Data portability — customers can request an export of their data.
• Future deployment options — Lex-AML may support stronger customer-controlled deployment options for organisations with specific data-governance requirements. Such options are described and applied only when agreed and implemented for the relevant customer.

GetPost Labs collects and retains only the personal information necessary to establish and manage the commercial relationship with reporting entities. This is limited to:

• Name and contact details of the authorised representative
• Organisation name, ABN/ACN, and registered address
• Billing and subscription information

This information is collected as part of the sales contract process and is stored in our internal billing platform. For the sales and billing relationship itself, we collect and retain nothing beyond what is listed above.

Learner records — name, email address, lesson progress, quiz results and certificates — are stored in Lex-AML's systems in Australia as training evidence for the learner's organisation. The organisation controls that record. GetPost Labs holds it as a service provider and does not analyse it, profile learners, or use it for any purpose other than operating the service. Staff access is limited to what is necessary for support, maintenance and security. Section 8 sets out in full what is recorded, why, who controls it and who can see it.

Platform configuration, user roles, activity logs, preferences, CDD data, compliance records and customer information entered into the platform are handled within organisation-specific data boundaries in the Lex-AML platform and protected through access controls, authentication and audit logging. GetPost Labs may process limited operational metadata needed to run, monitor, secure and support the service. Access to organisation/customer records, where technically available, is restricted to authorised operational, security, support or legal purposes and is controlled and logged.

We do not collect sensitive health or medical information. We do not collect personal information for marketing purposes without express consent.

The limited personal information we hold is collected directly from the authorised representative of the reporting entity during the sales and onboarding process — specifically through the execution of the sales contract.

Information entered into the platform by reporting entities and their staff is handled within organisation-specific data boundaries in the Lex-AML platform, with access restricted, controlled and logged as described in Section 2.

We collect sales contract information for the following purposes only:

• To establish and manage the commercial relationship with the reporting entity
• To process billing and subscription payments
• To communicate with the authorised representative regarding the service
• To comply with our own legal and regulatory obligations as a business

We use sales contract information only for the purposes described in Section 5. We do not use it for any other purpose.

We may disclose this information to:

• Our billing and payment processing providers, under strict data processing agreements
• Professional advisors such as lawyers and accountants, where necessary
• Government regulators where required by applicable Australian law

We do not sell, rent, or trade personal information to third parties for any purpose.

Organisation and customer compliance records processed through Lex-AML are handled within organisation-specific data boundaries. These records:

• Are handled within organisation-specific data boundaries in the Lex-AML platform
• Are protected through access controls, authentication, audit logging and operational safeguards
• Are encrypted in transit and at rest
• Remain the responsibility of the reporting entity as data controller — the organisation makes all customer due diligence decisions

The reporting entity remains responsible for its customer due diligence decisions and for handling customer information in accordance with its own legal and privacy obligations, including the Privacy Act 1988 (Cth) and its obligations under the AML/CTF Act 2006.

Where GetPost Labs accesses organisation or customer records — for example to operate, support, secure or maintain the service, or where required by law — such access is restricted to authorised purposes, controlled, and logged. We do not use these records for unrelated marketing purposes.

Learners who use the Lex-AML Training Academy, including the Lex-AML Training Academy mobile app (au.com.lexaml.training, iOS and Android), have their name, email address, lesson progress, quiz results and certificates recorded. This is the training evidence the AML/CTF Rules ask their organisation to keep, and the organisation controls that record. A compliance contact within the same organisation can see their colleagues' progress. The app contains no analytics, advertising or tracking, stores no lesson content on the device, and keeps the sign-in token in the device's secure keychain.

What is recorded about a learner

• Learner name, email address, and the organisation the learner belongs to.
• Lesson-by-lesson progress, including how much of a lesson video has been watched. While a lesson is playing, the app reports watch progress roughly every ten seconds, so a learner can resume where they left off and the record reflects what was actually completed.
• Quiz attempts and scores, and section checkpoint results.
• Certificates and training records issued on completion.

Why it is recorded, and who controls it

This information is the training evidence the AML/CTF Rules ask the learner's organisation to keep. The organisation controls that record. GetPost Labs holds it as a service provider on the organisation's behalf and does not use it for any other purpose.

Who can see a learner's progress

A read-only “my team” view lets an organisation's compliance contact see other learners' names, roles and progress. This is limited to learners within their own organisation. No learner's record is visible to another organisation.

How long training records are kept

Training records, quiz results and certificates are kept for seven years from the date the training was completed, and are then deleted. Keeping them is deliberate, not neglect: a training record is compliance evidence, and its whole value is that it can still be produced years later to show that a named person was trained. Seven years matches the record-keeping period the AML/CTF regime works to. Because the organisation controls the record, it may direct earlier deletion where its own obligations allow.

Access, correction and deletion

Because the organisation controls the training record, a learner should ask their organisation's compliance contact in the first instance to access, correct or delete it. A learner may also write to us at sumit@getpostlabs.io and we will respond within 30 days. Where the request concerns a record the organisation controls, we will act on the organisation's instruction and tell the learner we have done so. A request to delete a training record may be declined or deferred where the organisation is required to retain it as compliance evidence.

What the app stores on the device

• The access token is held in memory only. It is never written to disk.
• The refresh token is stored in the iOS Keychain or the Android Keystore, and is marked device-only — so it cannot move to another phone through an encrypted backup.
• Face ID or fingerprint unlock is optional and is handled entirely by the device. No biometric data reaches GetPost Labs.
• Lesson content is streamed. No lesson content is stored on the device, and there are no offline copies.
• Screen-capture prevention is active on the lesson player.
• There are no purchases in the app. Licences are arranged separately.

No analytics, advertising or tracking in the app

The Lex-AML Training Academy mobile app contains no analytics, no crash reporting, no advertising, no tracking, and no third-party SDKs of any kind. The Google Analytics described in Section 13 applies to the https://lex-aml.com.au website only. It is not present in the app, and no app activity is analysed through it.

Where learner data is held

All learner data is held in Australia. Our servers and media storage run in Amazon Web Services' Sydney region (ap-southeast-2), sign-in is handled by Amazon Cognito in the same region, and our database is hosted by MongoDB Atlas, also in Sydney. See Sections 9 and 10.

Lex-AML may use configured third-party providers to support DVS identity verification and Australian PEP checks. These services are used only where enabled for the relevant organisation and subject to provider setup, credentials and agreed configuration.

The providers that handle data on our behalf are:

• Amazon Web Services — hosting and media storage — Sydney (ap-southeast-2).
• Amazon Cognito — authentication and sign-in — Sydney (ap-southeast-2).
• MongoDB Atlas — database hosting for learner accounts, progress, results, certificates and training records — Sydney (ap-southeast-2). MongoDB, Inc. is a United States company; it administers the database service, and the data itself is held in Australia.
• Stripe — card payment processing and payment records — United States. Stripe receives your name, email address and card details; we never receive or store your full card number.
• DVS and PEP check providers — identity verification and politically exposed person screening, where enabled for the organisation.
• Google Analytics — the lex-aml.com.au website only. It is not used in the Lex-AML Training Academy mobile app, and no app or learner activity is analysed through it. See Section 13.

GetPost Labs thoroughly reviews the privacy policies of all third-party service providers before integration. Where those providers handle personal information on behalf of our customers, their privacy practices are governed by their own published privacy policies. We reference relevant third-party privacy policies within our platform documentation and update these references as providers change or as new integrations are added.

We do not integrate with any third-party service whose privacy practices we consider inconsistent with the Australian Privacy Principles or the standards we apply to our own operations.

Learner and platform data is held in Australia. Lex-AML, the Lex-AML Training Academy and the Training Academy mobile app run in Amazon Web Services' Sydney region (ap-southeast-2), with sign-in handled by Amazon Cognito in the same region. Our database is hosted by MongoDB Atlas, also in Sydney (ap-southeast-2). All learner data — names, email addresses, lesson progress, quiz results, certificates and training records — is stored and processed in Australia. MongoDB, Inc., which administers the database service, is a United States company and may access it for support and operational purposes.

Card payments are processed in the United States. We use Stripe, Inc. for every card payment. When you purchase a licence, Stripe receives your name, email address and card details in the United States and holds the record of that payment. We never receive or store your full card number. Stripe is certified under recognised international data protection frameworks, and we take reasonable steps to ensure it handles personal information consistently with the Australian Privacy Principles.

Sales contract information is stored within Australia on our internal billing platform.

Where the Lex-AML platform or its service providers process data outside Australia, GetPost Labs takes reasonable steps to ensure that data is handled consistently with the Australian Privacy Principles. We do not use organisation or customer compliance records for unrelated purposes.

The limited sales contract information held by GetPost Labs is stored securely on our internal billing platform with the following protections:

• Data is encrypted in transit between client devices and Lex-AML servers
• Production data storage is configured to use provider-managed encryption at rest
• Platform environments are protected through access controls, logging and operational safeguards
• Customer and compliance records are handled within organisation-specific data boundaries and protected through access controls, authentication, audit logging and operational safeguards
• Where GetPost Labs has technical access for operational, support, security or legal purposes, access is restricted, controlled and logged
• Regular security assessments and monitoring
• System and application logs do not contain personally identifiable information — logs capture operational metadata only such as actions performed, timestamps, and system events, for debugging and platform reliability purposes

Sales contract information is retained for the duration of the commercial relationship and for as long as required by applicable legal and tax obligations, after which it is securely deleted.

Training records are kept for seven years. Learner training records — lesson progress, quiz results, certificates and the name and email address they are attributed to — are retained for seven years from the date the training was completed, and are then deleted. This retention is deliberate, not neglect: the record exists to be produced years later as evidence that a named person was trained, which is what the AML/CTF Rules ask the learner's organisation to be able to show. Because the organisation controls the record, it may direct earlier deletion where its own obligations allow. See Section 8.

In the event of a data breach involving personal information held by GetPost Labs, we will promptly assess the situation in accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). If a breach is likely to result in serious harm, we will:

• Notify affected individuals as soon as practicable
• Notify the Office of the Australian Information Commissioner (OAIC) as required
• Take immediate steps to contain the breach

Where a data incident involves organisation or customer records handled within the Lex-AML platform, GetPost Labs and the reporting entity will work together to assess and respond in line with the service agreement and each party's obligations under the NDB scheme. Reporting entities remain responsible for their own obligations as data controller.

When you visit https://lex-aml.com.au, we may collect technical information including your IP address, browser type, and pages visited, solely to improve our website experience. We use cookies (including Google Analytics) for this purpose. You may adjust your browser settings to manage or disable cookies. We do not use cookies to collect personally identifiable information for marketing purposes.

This section describes the public https://lex-aml.com.au website only. Google Analytics is not used in the Lex-AML Training Academy mobile app, which contains no analytics, crash reporting, advertising, tracking or third-party SDKs of any kind. See Section 8.

You have the right to request access to the sales contract information we hold about you, and to request corrections if it is inaccurate or out of date. To make a request, contact us at sumit@getpostlabs.io. We will respond within 30 days at no charge.

For personal information held within the Lex-AML platform, your organisation can access and manage its data through the platform, and may request access to or export of its organisation data in accordance with the service agreement and applicable law.

Training Academy learners should read Section 8, which explains how to ask for access to, correction of, or deletion of a training record.

If you have a concern about how GetPost Labs has handled your personal information, please contact us in the first instance:

• Email: sumit@getpostlabs.io
• Post: GetPost Labs Pty Ltd, 8 Clunies Ross Ct, Brisbane Technology Park, Brisbane QLD 4113

We will acknowledge your complaint within 5 business days and provide a full response within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

This is a living document. As Lex-AML evolves and our information handling practices develop, this policy is reviewed and updated regularly to reflect those changes. Updates will be published at lex-aml.com.au/privacy with an updated effective date. Where changes are material, we will notify existing customers directly.