Legal
Privacy Policy
Last updated 16 October 2026
Janusoft Pty Ltd ("Janusoft", "we", "us") provides eAML, a customer due diligence and AML/CTF program platform for AUSTRAC Tranche 2 reporting entities. This policy explains how we collect, use, disclose and protect personal information, in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).
We handle two distinct kinds of personal information: information about you, as a person with an eAML account acting for your organisation; and information about your clients — vendors, buyers and their beneficial owners — that your organisation submits to eAML so it can run the customer due diligence your AML/CTF program requires. Sections 2–5 below describe both; where they're handled differently, this policy says so.
1. Our role
For your own account information, Janusoft is the entity responsible for that information under the Privacy Act. For your clients' information — the CDD data your organisation submits about the people and entities it conducts due diligence on — your organisation is the entity that collects it and remains responsible for its own obligations to those individuals (including giving them an APP 5 collection notice); Janusoft processes it as a service provider, on your organisation's instructions, solely to provide the Service.
2. Information we collect
| Category | Examples |
|---|---|
| Account & organisation | Name, work email, phone, role, organisation details, ABN, login credentials |
| Billing | Billing address, invoice history, and payment details held by Stripe (we don't store full card numbers) |
| Client CDD data (submitted by your organisation) | Vendors' and buyers' names, dates of birth, addresses, identity documents, source-of-funds information, beneficial ownership and trust/company structure details, and the results of identity, business, sanctions and PEP screening checks run through the Service |
| Usage | Login activity, audit logs of actions taken in the Service, device and browser information |
3. How we collect it
Directly from you when you register, use the Service, or contact us; from your organisation's staff when they enter client CDD data or upload documents; directly from a vendor or buyer where they use a self-service link your organisation sends them (to complete a CDD form, upload identity documents, or declare beneficial ownership); from the identity, company register and screening providers described in section 5 below, who return verification results back into the Service; and, where your organisation connects its accounting software (Xero or MYOB), from that software, which provides your organisation's client and transaction records.
4. Why we use it
- to provide, maintain and secure the Service, including running the checks your organisation configures;
- to bill your organisation and process payments;
- to communicate with you about your account, service changes, or a check that needs attention;
- to meet our own legal obligations, including responding to lawful requests from regulators or law enforcement; and
- to improve the Service, including diagnosing faults and understanding how it's used in aggregate.
We don't sell personal information, and we don't use client CDD data for marketing.
5. Who we disclose it to
We disclose personal information to the following categories of third party, and no others outside what this policy or the AML/CTF Act itself requires:
- Didit — identity verification, and company register checks (company details, officers, shareholders and ultimate beneficial owners), when your organisation runs a verification or company check;
- Dilisense — sanctions, PEP and adverse media screening, when your organisation runs a screening check (NameScan provides the same screening as a backup);
- ABN Lookup (the Australian Business Register) — Australian Business Number checks;
- Xero and MYOB — only where your organisation connects its accounting software: the connection itself, and reading your organisation's client and transaction records from it;
- Anthropic — drafting investigation summaries, only where your organisation turns AI summaries on. The facts of the investigation are sent, including the names of counterparties to the transactions; the client's own name is not;
- Google — "Sign in with Google", where you choose to use it;
- Resend — sending the Service's emails (for example verification links and questions to your organisation's clients);
- Stripe — payment processing for your organisation's billing; and
- a professional adviser, insurer, regulator or law enforcement body, where required or authorised by law — including AUSTRAC, in connection with your organisation's own AML/CTF reporting.
Overseas disclosure (APP 8): some of these providers may process or store personal information outside Australia as part of delivering their service to us. Where that happens, we require the provider to protect the information consistently with the APPs, to the extent the Privacy Act requires.
6. Security
We use reasonable technical and organisational measures to protect personal information against misuse, interference, loss, and unauthorised access or disclosure — including encryption in transit, access controls scoped to your organisation's own data, and audit logging of actions taken on client records. No system is completely secure; if we become aware of a data breach likely to result in serious harm, we'll act in accordance with the Notifiable Data Breaches scheme, including notifying affected individuals and the OAIC where required.
7. Retention
We retain client CDD data and check results for as long as your organisation's account is active, and afterwards for the periods AUSTRAC's own recordkeeping obligations require (currently at least seven years from the end of a customer relationship, under the AML/CTF Act), or as otherwise required by law. Account and billing information is retained for as long as reasonably needed for the purposes described above and to meet our own legal and accounting obligations.
8. Access and correction
You can access and update most of your own account information directly in the Service. For anything else — including a request to access or correct client CDD data, which should generally go through your organisation as the entity responsible for it — contact us using the details in section 10. We'll respond within a reasonable time and won't charge for a straightforward request.
9. Cookies and similar technology
We use strictly necessary cookies and local storage to keep you signed in and remember basic preferences. We don't use third-party advertising or tracking cookies.
10. Complaints and contact
If you have a concern about how personal information has been handled, contact us first at [email protected], or through your organisation's compliance administrator. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
11. Changes to this policy
We may update this policy from time to time. We'll post the updated version here with a new "last updated" date; for a material change, we'll make reasonable efforts to notify account holders directly.