Privacy Policy

Last updated: 12 August 2026

About this policy

Lead Comply (ABN 57 883 606 493, "we", "us") respects your privacy and is committed to handling personal information responsibly. This policy explains what personal information we collect through the Lead Comply ISO 9001 compliance portal at iso9001.leadcomply.com.au (the "Portal") and our related website, how we use and disclose it, and how you can access, correct, or make a complaint about it.

This policy is written to align with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth). We have chosen to comply with the Australian Privacy Principles as a matter of good practice, and this policy applies to all personal information we handle.

Who we are

Lead Comply
ABN: 57 883 606 493
Address: 1/457–459 Elizabeth Street, Surry Hills NSW 2010
Email: info@leadcomply.com.au

What personal information we collect

The personal information we collect depends on how you use the Portal.

If you create a Lead Comply account:

• Name, email address, job title, password, and — optionally — phone number
• Your organisation's details (business name, industry, state)
• Your ABN and business registration details, where you choose to verify your business, including information matched against the Australian Business Register
• Business profile details you provide, such as your approximate employee count, main products or services, and notes about how your team currently operates — used to personalise AI-generated documents to your business
• Answers you provide during your onboarding gap analysis, describing how your business currently operates
• Information about team members you invite, including their name, email address, role, and department
• The content you create or upload within the Portal, including generated documents, non-conformance and corrective action (NCR/CAPA) records, internal audit findings, checklists, and roadmap data. Some of this content may incidentally include personal information about your staff, for example a note describing a specific individual's involvement in an issue
• Your conversation history with the "Ask Lead Comply" AI assistant, stored so you can return to earlier conversations. This history is private to you personally and is not visible to other members of your organisation

If you visit our website without creating an account:

• Your email address, if you subscribe to our blog or contact us through the Portal
• The name, email address, phone number (if provided), and message content you submit through our contact form or an advisory consultation enquiry, along with any topic or scheduling preferences you select
• Standard website usage data collected through analytics

If you use the free ISO 9001:2026 crash course:

Your progress and quiz answers through this course are stored only in your own browser and are never sent to or stored on our servers. We have no visibility of this information at all.

How we collect personal information

We generally collect personal information directly from you, when you create an account, use a feature of the Portal, subscribe to our blog, or contact us. Where a colleague or employer invites you to join their organisation on the Portal, we collect your name, email, and role details from them at the time of invitation. Where you choose to verify your business, we search the Australian Business Register using the business name or ABN you provide, to confirm and retrieve your business's registered details.

Why we collect, use, and disclose your information

We collect and use personal information to provide and improve the Portal, specifically to:

• Create and manage your account and your organisation's access to the Portal
• Operate the core features of the Portal, including the readiness assessment and gap analysis, certification roadmap, document generation and version control, internal audit scheduling and execution, and the non-conformance and corrective action (NCR/CAPA) workflow
• Verify your business's identity and legitimacy against the Australian Business Register
• Personalise AI-generated documents and responses to reflect your specific business, using the business profile details you provide
• Send notifications relevant to your account and your organisation's activity, such as document review requests, NCR assignments, audit sign-off requests, and reminders, by email and through in-app notifications
• Contact you by phone or email, where you have provided a phone number and asked us to, including to follow up on a business verification that could not be completed automatically or an advisory consultation request
• Send you the newsletter or blog updates you have subscribed to, or respond to a message you have sent through our contact or advisory enquiry forms
• Maintain the security, integrity, and proper functioning of the Portal
• Comply with our legal obligations

We do not sell your personal information to third parties, and we do not use it for purposes unrelated to providing and improving the Portal without your consent.

Artificial intelligence

The Portal uses artificial intelligence, provided by Anthropic, in two ways:

Document generation. When you generate a draft quality management document or audit checklist question, relevant business context is sent to Anthropic's AI models to produce a draft. This context may include your industry, the ISO clause being addressed, a description of the topic, and — where you have provided it — your business profile details (employee count, products/services, and team structure notes), used to make the draft more specific to your actual business.

"Ask Lead Comply" chat. When you use the chat assistant, your questions, our data about your organisation's readiness and open findings, and your conversation history are sent to Anthropic to generate a response. Your chat history with this assistant is stored in our database and is private to you as an individual — other members of your organisation, including administrators, cannot see your conversations.

We do not knowingly send sensitive personal information (such as information about an individual's health, criminal history, or similar) to the AI provider through these features, and they are intended for generating business process documentation and answering questions about your organisation's own compliance data, not for processing personal records. All AI-generated document content is provided as a draft only and is reviewed and approved by a human user within your organisation before it becomes part of your official records.

We do not use AI to make or significantly influence decisions about individuals that affect their legal rights, finances, or access to services or opportunities. Our AI features are limited to generating draft business documents for your own organisation's use, and answering questions about your own organisation's compliance data — both reviewed and controlled by a human user in your organisation.

Cookies and analytics

Our website uses Google Analytics to help us understand how visitors use our site, so we can improve it. Google Analytics may use cookies and similar technologies to collect information such as pages visited, time spent on the site, and general location. This information is generally not used to personally identify you.

You can control or disable cookies through your browser settings, and you can opt out of Google Analytics tracking using Google's own browser add-on, available from Google's website. For more information about how Google handles this data, see Google's own privacy policy.

Who we share your information with

We disclose personal information to the following third parties, each of whom processes it on our behalf to help us operate the Portal:

• Supabase — provides our database, user authentication, and file storage. Our Supabase infrastructure is hosted in the Sydney, Australia region.
• Resend — sends transactional and marketing emails on our behalf, including account notifications, document and audit alerts, and blog subscription emails.
• Anthropic — provides the AI models used to generate draft documents, checklist content, and chat responses.
• DigitalOcean — hosts our web application infrastructure, in the Sydney, Australia region.
• Australian Business Register (ABR), operated by the Australian Taxation Office — we query the ABR's public ABN Lookup service to verify a business name or ABN you provide. We do not send the ABR any personal information beyond the search term you enter.

Overseas disclosure. Resend and Anthropic are based overseas (primarily the United States) and personal information sent to them for the purposes described above may be processed on servers located outside Australia. We take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles, including reviewing their own privacy and security practices. We do not otherwise disclose your personal information overseas.

We may also disclose personal information where required by law, for example in response to a valid legal request from a government or law enforcement body.

Direct marketing

If you subscribe to our blog, we will only send you emails about new articles or updates you have opted in to receive. Every marketing email we send includes a clear, working unsubscribe link. You can unsubscribe at any time, and we will action your request promptly. We do not send marketing emails to people who have not subscribed, and we comply with the Spam Act 2003 (Cth) in all commercial electronic messages we send.

Payment information

The Portal does not currently collect any billing or payment card information. If we introduce paid subscriptions in future, this policy will be updated to name the payment processor used and explain how payment information is handled before that feature becomes available.

Data security

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification, or disclosure. This includes access controls that restrict data to only the organisation it belongs to, encrypted connections between your browser and our servers, and role-based permissions within the Portal that limit what different types of users can see and do. Your chat history with the "Ask Lead Comply" assistant is additionally restricted so that only you can access it, not other members of your organisation. No method of storage or transmission over the internet is completely secure, and we cannot guarantee absolute security.

Data retention

We retain personal information for as long as your account remains active, and for a reasonable period afterwards to allow you to reactivate your account or export your records. If you close your account or ask us to delete your data, we will delete or de-identify your personal information within 30 days, except where we are required to retain certain records for longer to meet a legal obligation, such as financial or tax record-keeping requirements.

Accessing and correcting your information

You can access and update most of your account and organisation information directly within the Portal at any time. If you would like to request a copy of the personal information we hold about you, or ask us to correct information that is inaccurate or out of date, please contact us using the details below. We will respond to your request within a reasonable timeframe, generally within 30 days.

Children's privacy

The Portal is a business tool intended for use by adults in a workplace context. We do not knowingly collect personal information from children, and the Portal is not directed at or intended for use by children.

How to contact us or make a complaint

If you have a question about this policy, want to access or correct your personal information, or wish to make a complaint about how we have handled your personal information, please contact us:

Email: info@leadcomply.com.au
Post: 1/457–459 Elizabeth Street, Surry Hills NSW 2010

We will investigate any complaint and aim to respond within a reasonable timeframe. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

We may update this policy from time to time to reflect changes to the Portal or our legal obligations. The "last updated" date at the top of this page shows when it was last revised. We encourage you to review this policy periodically.