Legal
Privacy Collection Notice
Last updated: March 2026
This notice is provided in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It explains what personal information Claims Passport collects at registration and how that information is used.
For the full policy, see our Privacy Policy.
Plain-English summary
We collect a preferred name and one contact method (mobile or email). Your contact details are encrypted inside the vault. Participating sites and law firms receive only your Passport ID and eligibility summary — never your raw contact.
The one rule we follow
If a piece of personal contact information is needed to identify, message, or reach a user — it belongs in the vault and nowhere else. Contact details must never appear in any API response, log, webhook payload, admin view, or error message.
Who is collecting your information
Claims Passport is operated by XS AU Pty Ltd (ABN 77 672 009 764). References to "we", "us", or "our" refer to this entity.
What we collect at registration
- Preferred name — first name or display name only (no surname in Stage 1)
- One contact method — either a mobile number or email address
- Intent — claimant (progress a claim) or interested (keep me updated)
- Intake answers — your responses to matter-specific eligibility questions
We do not collect surname, date of birth, postal address, government ID, tax file number, bank details, or payment card information at this stage.
Why we collect it
- To issue and maintain your unique Passport ID (CP-XXXXXXXXXXXXXXXX)
- To verify your contact method via magic link (Twilio Verify)
- To deduplicate registrations — ensuring one Passport per person across all participating sites
- To screen your eligibility using AI (Anthropic Claude) — operating on anonymised intake answers only
- To route your registration to the appropriate law firm partner — sending only Passport ID, matter ID, eligibility result, and summary
- To deliver matter updates and notices through your Passport Inbox
How we store and protect it
- Vault isolation: Your contact details are stored only in the Claims Passport vault — never on participating sites or in partner systems
- Envelope encryption: Each contact record is encrypted with its own AES-256-GCM key, wrapped by GCP KMS (Sydney region). The plaintext key is zeroed out after use.
- Contact fingerprint: An HMAC-SHA256 hash of your contact is used only for deduplication and cannot be reversed to your actual contact details
Who we share your information with
The routing payload sent to partner law firms contains:
- Passport ID, matter ID, source tag, intent, registered_at
- Eligibility result (strong / possible / unlikely)
- Plain-English summary
The payload never contains: name, mobile number, email address, or contact fingerprint.
Service providers who may process data on our behalf include:
- Twilio — magic link delivery (SMS and email)
- Anthropic — AI eligibility screening (anonymised intake answers only)
- Google Cloud Platform — infrastructure, KMS encryption
Overseas disclosure
Twilio and Anthropic are US-based providers. They process limited data (magic link delivery and anonymised screening respectively). Encryption keys and contact records remain in the Sydney (ap-southeast-2) GCP region.
Your rights
- Access: Request a copy of the personal information held about you
- Update: Change your contact method at any time from your Passport Dashboard
- Pause: Temporarily stop all forwarded notifications
- Deactivate or delete: Permanently delete your Passport and all linked data
- Complaints: If you believe your personal information has been handled incorrectly, contact us first. If unsatisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
What happens if you choose not to provide your information
If you choose not to provide a preferred name or contact method, we cannot issue a Passport ID or register you for any matter. You may still browse participating sites without registering.
More information
For the full privacy policy, see our Privacy Policy. For questions about how your data is handled, contact us via the contact page or email privacy@claims.au.