Privacy Policy
Last updated: 12 October 2026
SafetyLM at chat.safetylm.ai (and any other address we serve it from) and its website at safetylm.ai (together, “the Service”) are operated by Arrley Pty Ltd (ABN 87 701 846 148), trading as SafetyLM (“we”, “us”). This Policy says what personal information we collect when you use the Service or visit the website, why, who processes it for us, where it goes, how long we keep it, and how to exercise your rights.
We handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for members in New Zealand, the information privacy principles in the Privacy Act 2020 (NZ). We apply the Australian Privacy Principles to everything we hold about you, whether or not the Privacy Act requires it of a business our size.
1. What we collect, and why
| What | Where it comes from | Why we hold it |
|---|---|---|
| Your email address, and the password you set (held only as a one-way hash by our authentication provider) | Accepting an invitation; signing in | To give you an account and keep it yours |
| Your display name, and, if you add them, your industry and your role title | Accepting an invitation; Settings › Personalisation | To address you, and to shape answers to your role and industry: your industry, and the one of four reader roles your title maps to (Advisor, Manager, Executive or Auditor), are included in the instructions the model receives with each question |
| Who invited you, and the email addresses of the people you invite | The invitation system | Membership is by invitation; each member may invite three people. Your display name and email address are shown to the people you invite, in their invitation and on their account record, so they know who invited them |
| Sign-in records: the time, the IP address and the browser of each session, and a log of sign-ins and password changes | Signing in | Kept by our authentication provider as part of your account, to keep it secure |
| Your chats: the questions you ask, the answers you receive, the jurisdiction and model you chose, the time, and the record of what the Service did to answer (the passages it retrieved, the searches it ran, the checks it made) | Using the Service | So your history follows you to any device you sign in on, and so each turn of a conversation is answered in the light of the turns before it |
| When you attach a document for review: its name and length only. The document’s text is sent to the model for that turn and is not stored | Attaching a document | So your history shows that a document was reviewed, without keeping it |
| The time zone your device reports when you start your Preview | Starting your Preview | So your daily question count resets at your own midnight |
| The date and version of the Terms of Use you accepted | Creating your account | To keep a record of the agreement |
| Billing records: our payment provider’s references for your customer and subscription, your plan, its interval and status, the dates your Preview and current period end, whether you have cancelled or scheduled a change of plan, whether a card is saved and its last four digits, any discount or preview code applied, the date of your first payment, whether a founder marked you as a student and when, the number of invited members who have paid, and, if you are on a team, the team’s name, who administers it and who gave you your seat | Starting your Preview; our payment provider’s notifications | To run your plan, enforce its limits, apply your discounts and show you where you stand |
| Your daily question count | Using the Service | To enforce your plan’s daily limit |
| If you joined the waiting list: your email, name, industry, role title, whether you said you would pay, and your place in the queue | The waiting-list form, on safetylm.ai or in the Service | To decide and manage invitations in order |
| If you visit safetylm.ai and accept analytics: the address of each page you view, the page you came from, your browser and type of device, your country, and how long pages take to load, counted by Cloudflare Web Analytics with no cookie and no identifier for you | Your visit, and only after you choose Accept | To see which pages are read and to keep them fast |
| If you visit safetylm.ai and accept analytics, also through PostHog: the full address of each page you view (including any campaign tags in it) and the page you came from; the links and buttons you click and the words on them; where on a page you click, where you move the pointer and how far you scroll; how long you stay on each page and how long it takes to load; your browser and its language, your operating system, device model and screen size, and your time zone; your approximate location (country, region, city and postcode), worked out from your IP address, which PostHog then discards; and, if you join the waiting list, that you joined and the industry and role you chose. PostHog links these to a random identifier it keeps in your browser, so it can tell a returning visit from a new one. Apart from that, it does not record what you type or select in a form, and it does not record your screen | Your visit, and only after you choose Accept | To learn which pages help people and where they get stuck, so we can improve the site |
| Emails you send us at hello@arrley.com, and our replies | You | To help you |
Card details never reach us. You enter them into a form served by Stripe inside our page; they go to Stripe and we receive only the last four digits and the fact that a card is saved.
What we do not collect. We set no advertising or tracking cookies, and we run no analytics or tracking in the SafetyLM app at chat.safetylm.ai. On the website, visits are counted only if you accept analytics (section 6). We do not collect your precise location or your contacts. Apart from what the website analytics above records if you accept it, we collect nothing about your device beyond what a web browser sends with every request.
2. How the Service uses your questions
When you ask a question, the Service sends your question, the chat so far, your role and industry if you set them, the passages it retrieved from its knowledge base, and any document you attached for that turn, to a large language model. Which model is the one named in the question box: the default, or another you pick from the list. The default model also reads each regular answer with its passages to check it before you see it, and reads each question to decide whether it needs a web search. A Think deeper answer is checked by the model that wrote it.
Every model in the list runs on Cloudflare’s Workers AI service except two, Sonnet 5.5 and Opus 5.5, which Anthropic runs. Until 8 November 2026 Think deeper starts on Opus 5.5 unless you choose GLM 5.3, so a Think deeper question goes to Anthropic unless you change the model; Sonnet 5.5 only when you pick it. On either, your question, the passages retrieved for it, the chat so far, your role and industry, the text of a document you attached, and any web page or knowledge document the model reads leave Cloudflare for Anthropic through Cloudflare’s AI Gateway, and the answer comes back the same way. Those two models are offered until 8 November 2026 and leave the list that day.
Web search. For each question the Service decides whether a truthful answer depends on what is current: whether a law or code is in force, a regulator’s present guidance, a recent change. When it does, the Service searches the web before it answers. The search is run by an Anthropic model, reached through Cloudflare’s AI Gateway, which returns what official pages say.
What is sent for a search is a query the Service’s model writes for the purpose, the jurisdiction you chose and the country it implies. The query is written from your question and, for a follow-up, from the question before it; if the model searches again while it drafts, it can also draw on the rest of the chat and on a document you attached. The model is instructed to write the query about the law or the topic only, and to leave out the names of people, organisations, sites and workplaces, addresses, the details of a particular person or incident, and words copied from a document. That instruction is a safeguard, not a guarantee: a query can repeat words you used. Do not put personal information about anyone into a question that you would not want a search provider to receive. Your name, your email address and your member identifier are never sent. The Service’s own search before an answer never seeks a penalty figure; in a jurisdiction whose figure the Service holds, the model may look up the current penalty provision while it answers.
Reading a page. When you paste a web address into a question, or a search finds a page worth reading (which can be a page of a legislation register), the Service fetches the page so the answer can quote it. It tells the site what it is, follows the site’s robots.txt, and does not read a site that refuses it. A page that comes back nearly empty because a script fills it in may then be loaded in Cloudflare’s browser service. The site sees a request from the Service, not from you.
No training. We do not use your questions, documents or chats to train any model. Cloudflare states that it does not use customer content to train the models on Workers AI (Cloudflare’s Workers AI privacy page, dated 21 April 2026). Anthropic’s commercial terms state that it may not train models on customer content submitted through its services (effective 17 June 2025).
3. Operational records
To run and improve the Service we keep a technical record of each question: the mode, the jurisdiction, the model, your plan and your count for the day, a one-way hash of your member identifier (not your email or name), which knowledge-base passages were retrieved and how they scored, the length of any attached document, the computing cost, and timings. These records never contain the text of your question, the answer or an attached document. Cloudflare keeps them for seven days on our plan and we read them only to diagnose faults and measure quality. The gateway that carries a web search or a Claude answer is set to keep no log of it.
4. Who processes your information for us
| Provider | What it does for us | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the Service and the website, runs the models on Workers AI, carries web searches and Claude answers through AI Gateway, fetches web pages, keeps the operational records of section 3, and, if you accept analytics on safetylm.ai, counts your visit with Cloudflare Web Analytics | Cloudflare’s global network |
| Supabase Pte. Ltd. | The database that holds your account, chats, billing records and the waiting list; sign-in | Sydney, Australia |
| Stripe Payments Australia Pty Ltd | Payments: saves your card, charges your plan, issues tax invoices and receipts, retries a failed charge | Stripe’s systems; Stripe’s privacy policy is at stripe.com/au/privacy |
| Anthropic, PBC | Runs the web search for a question that depends on what is current, receiving the query, the jurisdiction and the country. Until 8 November 2026 also answers a Think deeper question (which starts on Opus 5.5 unless you choose GLM 5.3) and a question you put to Sonnet 5.5, receiving the question, the passages retrieved for it, the chat so far, your role and industry, and an attached document’s text. Never your name, email or member identifier | Anthropic has not published a processing location for its API; assume the United States, where Anthropic is based |
| PostHog, Inc. | If you accept analytics on safetylm.ai, records how the website is used, as section 1 describes. We do not send it your name or email, and it is not used in the app at chat.safetylm.ai | The United States |
| Microsoft (Microsoft 365) | Sends the Service’s emails (invitations, password resets, password-change notices) from no-reply@safetylm.ai, and holds our hello@arrley.com mailbox | Australia: Microsoft stores a tenant’s mailbox content at rest in the country the tenant was set up in, and ours is Australia |
Each provider processes your information under its own agreement with us and, where it publishes one, a data processing addendum. We also disclose personal information to our professional advisers where they need it, and to a regulator, court or law-enforcement body where the law requires. If our business is sold or merged, your information passes to the successor under this Policy.
We do not sell personal information, and we do not share it with anyone else.
5. Overseas disclosure
Your account, chats and billing records are stored in Sydney. Four of our providers process information outside Australia:
- Cloudflare runs the Service and the models on its global network; a request is handled at the Cloudflare location nearest to you, which may be outside Australia or New Zealand.
- Anthropic receives a web search’s query and, until 8 November 2026, a Think deeper question and a question you put to Sonnet 5.5, as section 2 says. While those two models are offered, Anthropic answers on an account in our name and keeps what it received for up to 30 days before deleting it, longer only where its automated systems flag a usage-policy violation (Anthropic’s privacy centre, dated 1 July 2026). Once they are withdrawn, the search runs through Cloudflare on endpoints that Cloudflare describes as retaining neither prompts nor responses (Cloudflare’s AI Gateway documentation, dated 30 September 2026).
- Stripe processes payments on its own systems and under its own privacy policy.
- PostHog keeps the website analytics of section 1, if you accept it, on its servers in the United States.
Where information goes overseas we take the steps the law requires to see that it is handled in a way consistent with the Australian Privacy Principles, including through our agreements with each provider.
6. Cookies and browser storage
The Service sets no cookies of its own. It keeps a few things in your browser’s storage so the Service works as you left it: that you accepted the first-use notice; your theme, text size, default jurisdiction, sidebar choice and a few other display preferences; the models you switched off in Settings › Models; a count of the questions you asked today on this device; your sign-in session token; and, if you were signed out part-way through a question, that question until you sign in again. None of these is sent to us except the session token, which identifies you to the Service. Stripe’s card form, which runs inside the page from Stripe’s servers, may set cookies of its own to prevent fraud; Stripe’s privacy policy describes them.
The website at safetylm.ai sets no cookies of its own either. It keeps two things in your browser’s storage: whether you chose Accept or Decline for analytics, and, for the home page, which background videos you have seen during this visit, so they don’t repeat (cleared when you close the tab). Neither is sent to us. Until you choose Accept, nothing is loaded from another company. If you accept, Cloudflare Web Analytics counts your visits; it sets no cookie and uses no identifier for you. PostHog, if you accept, keeps its own record in your browser’s storage (not a cookie): the random identifier of section 1, the visit in progress, and the page and referrer of your first visit. If you later choose Decline, the site removes that record and keeps only a note that you said no, which PostHog reads so it stays off. You can change your choice at any time on the Cookie Settings page. Accept takes effect at once; Decline stops PostHog at once and Cloudflare Web Analytics from the next page you open.
7. Security
Sign-in is by email and password through our authentication provider, and your session is kept in your browser until you sign out. Every table in the database is protected by row-level security, so a member’s own credentials reach only that member’s rows (founders also see members’ profiles, invitations and the waiting list, to run membership), and no request can write into another member’s chat. Secrets are never written into the Service’s code. Card details are handled by Stripe and never touch our systems.
8. How long we keep it
| What | How long |
|---|---|
| Your chats | Until you delete them, one at a time from a chat’s menu or all at once from Settings › Data and privacy, or until you delete your account |
| Your account and profile | Until you delete it from Settings › Account. Deleting it removes your profile, your chats, your messages, your billing record and every invitation you sent; the people you invited keep their accounts, and the record of who invited them is cleared |
| Billing records and invoices | Invoices and payment records are kept by Stripe and by us for as long as tax and corporate law require, up to seven years, after which they are deleted |
| Waiting-list entries | Until the request is granted or declined, and for twelve months after, so a repeat request can be recognised |
| Operational records | Seven days, at Cloudflare |
| Website visit counts, if you accepted analytics | Held by Cloudflare as totals, with nothing that identifies you |
| Website analytics in PostHog, if you accepted it | One year, the period PostHog keeps it on our plan |
| Emails to and from hello@arrley.com | For as long as they are needed to help you, and up to two years |
9. Your rights
You may ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. Email hello@arrley.com. We answer within 30 days, and sooner where we can. You can see and change most of what we hold yourself: your profile in Settings › Account and Settings › Personalisation, your chats in the Service, your plan in Settings › Plan and usage.
If you are not satisfied with our answer, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or, in New Zealand, to the Office of the Privacy Commissioner at privacy.org.nz.
10. Data breaches
If personal information we hold is lost or accessed without authorisation and the breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, or the New Zealand Privacy Commissioner, as the law requires, and tell you what we are doing about it.
11. Children
The Service is for working professionals and is not directed at anyone under 18. We do not knowingly collect personal information from a person under 18.
12. Changes to this Policy
The current version is always at safetylm.ai/privacy with its date. When the Service changes in a way that changes what this Policy says, we update the Policy first. For a change that matters to you, we email members before it takes effect.
13. Contact
Arrley Pty Ltd (ABN 87 701 846 148), trading as SafetyLM. hello@arrley.com