Privacy Policy

AML Ready is operated by Modicum Atelier Pty Ltd, a company registered in New South Wales, Australia. When this policy refers to "we", "us", or "our", it means Modicum Atelier Pty Ltd.

We collect different types of information at different stages of your interaction with AML Ready.

When you visit the website, AML Ready does not run a global client analytics SDK. Our hosting provider may process short-lived request, security, and reliability logs under its data processing terms.

Checkout, verification and recovery endpoints apply short-lived abuse rate limits. Network addresses are transformed with a dedicated secret-keyed HMAC and purpose label before the resulting pseudonym is stored in the environment-specific Redis namespace. Raw addresses are not used as Redis keys; these counters expire after one minute or one hour depending on the endpoint.

When you complete the questionnaire, we collect the practice profile information you provide. This includes your practice name, ABN, business address, compliance officer name, profession type, practice size, services provided, client types, and related practice details. This information is used to assemble your AML/CTF program documents.

Before checkout, those answers (including the ABN, address and contact details) are held in this tab's sessionStorage. The application uses the fixed aml_ready_session key for resumable questionnaire state and an opaqueaml_ready_commercial_draft_v1:* key for the summary and checkout handoff. They become invalid after one hour and are removed on the next application access, by a best-effort active-tab timer, or after a verified paid completion. A browser that suspends the tab may retain expired bytes until that next access. Draft data is never placed in the page URL.

When you purchase, your payment is processed by Stripe. We do not receive, handle, or store your credit card number, expiry date, or CVV. Stripe provides us with a transaction reference, confirmation of payment, and the receipt email you use at Stripe Checkout. That receipt email may differ from the compliance officer email you approved in the questionnaire. Program delivery and recovery remain bound only to the approved questionnaire email; Stripe may use the Checkout email for its own receipt. Stripe's handling of your payment data is governed by its own privacy policy.

When we deliver your documents, we store a copy of your assembled document package and the practice profile used to produce it. This is so you can re-download your documents if needed.

We do not collect anything beyond what is described above.

Every piece of information we collect serves a specific function:

• ▪Practice profile and questionnaire responses — to assemble your AML/CTF program documents
• ▪Approved questionnaire email — to deliver your purchase confirmation and secure recovery link; an edited Stripe receipt email does not change this destination
• ▪Payment confirmation — to verify your purchase and enable re-download access

We do not collect information for profiling, behavioural advertising, or resale.

We use two separate storage systems, each with its own retention period:

• Documents (Vercel Blob) — Download access ends exactly 30 days after the confirmed payment. An hourly governed deletion job then removes due private Blobs in bounded batches and verifies absence. A provider failure or backlog can require more than one hourly cycle; commercial checkout remains blocked whenever any overdue object, malformed object or incomplete backlog exists. No expiry reminder is currently scheduled, so save a local copy promptly.
• Customer and email records (Upstash Redis via Vercel Marketplace) — Your email address, questionnaire profile and purchase reference use an immutable absolute expiry at 30 days after confirmed payment; retries do not extend it.

A checkout that is not completed keeps its immutable questionnaire/order record for no more than four days solely so a delayed signed Stripe webhook can be recovered. A signed Checkout-expired event removes the unpaid record sooner. It never grants output.

If Stripe or a delivery dependency fails before exact terminal reconciliation, the application may retain a keyed safety tombstone beyond those raw-record periods. It contains only non-identifying HMAC pseudonyms for the Session and order, release and configuration identifiers, and reconciliation timing/status. It contains no name, email, questionnaire answers, raw Stripe/payment identifier, recovery capability or document. The tombstone remains only until the exact provider Session is reconciled to expired-and-unpaid, fulfilled with terminal delivery evidence, or canonically revoked; it is then removed atomically. Elapsed time alone never authorises access or marks an unresolved payment as settled.

The application and private document storage are provided by Vercel. Purchase records are processed by Upstash through Vercel Marketplace. Payment data is held by Stripe. We do not have access to your card details at any point.

Your data is accessible to:

• Us — Modicum Atelier Pty Ltd, for the sole purpose of operating AML Ready and responding to support requests
• Stripe — for payment processing only, under their own privacy policy and PCI-DSS compliance
• Vercel — for application hosting and private document storage, under its data processing terms
• Upstash — for Redis purchase and entitlement records supplied through Vercel Marketplace
• Resend — to send the purchase confirmation and secure recovery email only; Resend states that email and log data is retained for 30 days and backups for a further 7 days under its processor controls

We do not share, sell, rent, or disclose your personal information to any other third party. We do not provide your data to marketing platforms, data brokers, advertisers, or analytics companies that track users across the web.

If we were ever legally compelled to disclose your data — for example, by a court order or regulatory requirement — we would comply only to the extent required by law.

AML Ready uses minimal cookies necessary for the site to function. We do not use advertising cookies, tracking pixels, or third-party marketing scripts.

After Checkout begins, AML Ready sets the essential aml_ready_redemptionHttpOnly cookie. It contains a random capability, while only its SHA-256 binding is stored server-side. Stripe payment identifiers are not placed in browser-facing paths or query strings. Cross-device email recovery arrives in the URL fragment (which is not sent in an HTTP request), is removed from the address bar before any network call, then is POST-redeemed into a deterministic session-scoped HttpOnly cookie. Its hash-mapped fragment capability remains reusable on another device only through the exact paid retention boundary; every use rechecks payment, refund/dispute, retention and stored-artefact integrity. Access remains subject to payment, refund/dispute and the immutable retention boundary; an abandoned-checkout credential expires sooner.

We do not run PostHog, advertising analytics, or global page-view tracking.

We will email you for the following reasons only:

• ▪Purchase confirmation and document download link
• ▪A response to a support request you have initiated

We do not send marketing emails, newsletters, or promotional content. If we ever choose to offer an update or new product to existing customers, we will ask for your explicit consent first.

You can contact us at any time to:

• ▪Request a copy of the personal information we hold about you
• ▪Ask us to correct any inaccurate information
• ▪Ask us to delete your data ahead of the 30-day automatic deletion

We will respond to any such request within a reasonable timeframe. Contact us at support@amlready.au.

We are a small business and are currently exempt from the formal requirements of the Privacy Act 1988 (Cth) due to our annual turnover. Despite this, we have chosen to handle your data in line with the Australian Privacy Principles because it is the right standard to hold ourselves to. If the small business exemption is removed in future, we expect to already be compliant.

AML Ready is a professional compliance tool designed for use by regulated businesses. It is not directed at individuals under 18 and we do not knowingly collect personal information from children.

If we change this policy, we will publish the updated version at amlready.au/privacy with a new effective date. If we make a material change to how we handle your data, we will notify existing customers by email.

If you have any questions about this policy or how we handle your data: