Privacy Policy

Last updated: 31 August 2026

1. About this policy

This Privacy Policy explains how studylaw.io, trading as StudyLaw / Legal Learning Bench (we, us or our), collects, holds, uses and discloses personal information through StudyLaw, the Legal Learning Bench website and related services (the Service).

For privacy questions, access or correction requests, or complaints, contact privacy@studylaw.io or support@studylaw.io.

We aim to manage personal information openly and transparently in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and other applicable privacy laws. This policy is intended to be our APP privacy policy where the Privacy Act applies.

2. What information we collect

Depending on how you use the Service, we may collect and hold:

account details such as username, email address, email-verification status and account status;
sign-in and security information, including password hashes, passkey public-key credentials, multi-factor authentication settings, Google identity-link information, session tokens and security-event records;
subscription and billing information, including Stripe customer and subscription identifiers, payment status, trial and cancellation status; Stripe processes payment-card details under its own privacy notice and we do not store your complete card number;
Workspace material you choose to save or upload, including bookmarks, saved citations and uploaded documents;
Tutor prompts, conversation context, generated responses and limited request diagnostics needed to provide, secure and improve the Tutor service;
institution or cohort information where access is provided through an educational institution;
referral or invitation information, such as an invitation code or an affiliate referral;
marketing attribution information, where you reach the Service through a campaign link: the campaign tags in that link (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the page path you landed on, an opaque random visitor identifier we generate, and the dates of your first and most recent visit. Where you arrive from a Google advertisement, Google adds a click identifier to the link it sends you through, and we record that identifier against the visit so that we can later tell Google which advertisements led to a paid subscription (see section 7). We do not record the rest of the web address, your IP address, any other advertising identifier, or any device fingerprint, and we do not collect any of this unless campaign measurement is switched on;
site measurement information, where site measurement is switched on: the page path you visited (with only the campaign tags listed above kept from the web address — everything else in it is discarded in your browser before anything is sent), the site you arrived from and the page on it (but not that site’s own web address details), the browser, operating system, device type, screen size and language your browser reports, your approximate location to city level, and whether you opened an article, started the Tutor, saved a bookmark, completed an upload or verified your email address. For an article, we record which article. We do not record who you are: no name, email address, account identifier or any other identifier that points back to you is sent or stored, and the record cannot be linked to your account. This measurement is anonymous and self-hosted: it runs on infrastructure we operate ourselves, is not shared with or disclosed to any third party, contains no identifier that points back to you, and cannot be linked to your account;
messages you send to us, including support requests, and information needed to resolve them;
technical and security information such as browser and device details your browser supplies, timestamps, essential cookies and security-event records.

We use your IP address transiently to rate-limit sign-in and registration attempts and to detect abuse. We do not store it: our databases hold no IP address field, and the only trace kept is a short-lived, irreversible hash used for that rate limiting. We do not use third-party analytics, advertising or tracking services: we run no advertising pixels, tag managers, session-replay or fingerprinting tools, and we do not build advertising audiences. No advertising code runs in your browser on this site. Where site measurement is switched on, one small first-party measurement script does run — it is served by us from studylaw.io, sends only to studylaw.io, sets no cookie and stores nothing in your browser. It is described in section 2. Where campaign measurement is switched on, the marketing attribution described above is our own first-party measurement, held by us. The single exception is described in section 7: where an advertisement led to a paid subscription, we tell the advertising platform that a subscription occurred, so that it can measure its own advertising.

Please do not submit health information, government identifiers, payment-card numbers, confidential client information or other sensitive information unless you are authorised to do so and the Service specifically asks for it. We do not ordinarily need sensitive information to provide the Service.

3. How we collect information

We generally collect personal information directly from you when you register, sign in, use a passkey or Google sign-in, subscribe, contact support, save or upload Workspace material, or use Tutor. We may also receive limited information from service providers that support authentication, payments, email delivery, hosting, security and service operations.

If you use an institutional account, we may receive account, role or cohort information from the relevant institution or its authorised identity system.

You may browse the public library and search without creating an account. Some information is nevertheless collected automatically when you access the website, including essential session, security and operational information. Where campaign measurement is switched on and you arrive through a campaign link, the campaign tags in that link are collected automatically at that point. If you later create an account, we link that earlier activity to it so we can understand which campaigns lead to registrations and subscriptions.

4. Why we use personal information

We may use personal information to:

create and administer accounts, verify email addresses and authenticate sign-ins;
provide the library, search, Pathways, Workspace, Tutor and institutional features you request;
process subscriptions, trials, payments, cancellations, refunds and entitlement decisions;
keep Workspace material private to the account or institution entitled to access it;
send verification, security, billing, service and support communications;
detect, prevent and investigate fraud, abuse, unauthorised access, security incidents and technical faults;
maintain backups, audit trails, reliability, accessibility and service performance;
understand aggregate use and improve the Service, without using another learner’s private Workspace material as that learner’s content; and
comply with legal obligations, respond to lawful requests and protect our rights, users and Service.

We do not sell personal information. We do not use private Workspace material to advertise to you.

5. Tutor and automated processing

Tutor processes the prompt and relevant context needed to answer your request. This may include public Legal Learning material and, where you have enabled or supplied it, your own Workspace material. Your private Workspace material is not made available to other learners.

Tutor output is educational content, not legal advice. Automated processing may produce errors. We use access controls, scoped requests, logging and other safeguards appropriate to the feature. We do not use Tutor to make decisions about your eligibility for credit, employment, insurance, housing or other services.

If applicable privacy law requires additional information about automated decision-making, we will update this policy and provide the notices required by that law.

6. Cookies and similar technologies

We use essential cookies and similar technologies for sign-in sessions, security, preferences and service operation. We may use limited operational measurement to understand reliability and performance. We do not use non-essential advertising cookies unless we first provide any notice and choice required by law. Site measurement sets no cookie at all and stores nothing in your browser. It has no identifier to store: visits are grouped by a one-way code our own server calculates from the connection and rebuilds from scratch every day, so measurement cannot follow you from one day to the next, and there is nothing on your device that could.

Where campaign measurement is switched on, we also set a first-party cookie named ll_mkt_vid. It holds only the opaque random visitor identifier described in section 2, is signed so it cannot be altered, cannot be read by scripts in your browser, is sent only to studylaw.io, and expires after 90 days. It is not an advertising cookie: it is not shared with any third party and is not used to build advertising audiences or to track you across other websites.

You can control cookies through your browser, but disabling essential cookies may prevent sign-in or paid features from working.

7. When we disclose information

We may disclose personal information to service providers that help us operate the Service, including providers for:

hosting, databases, backups, monitoring and security;
payment processing and subscription management, including Stripe;
authentication and identity linking, including Google where you choose Google sign-in;
transactional email delivery, including account verification and security messages;
Tutor answer generation, provided by Anthropic. When you ask the Tutor a question, we send Anthropic your question as written, the relevant extracts from our library, recent turns of that conversation and, where they are relevant to your question, short excerpts from documents you have uploaded to your Workspace. We do not send Anthropic your name, email address or account identifier;
diagnosis of Tutor quality problems, where you report an answer as unhelpful. A de-identified copy of that exchange may be processed using developer tooling provided by Anthropic and OpenAI to investigate and fix the underlying issue. Before it leaves our database we remove account identifiers, email addresses, file names and file paths, and we replace any material drawn from your uploaded documents; and
advertising measurement, where you reached us through an advertisement and later started a paid subscription. We send Google the click identifier from that advertisement, the date and time of the subscription, the amount and the currency. We send this only for completed paid subscriptions — never for a visit, a registration or a free trial — and we send it after the fact, from our own servers. We do not send your name, email address, account identifier or any Workspace or Tutor material, and a visitor who never subscribes is never reported to Google at all; and
professional advisers, auditors, insurers, regulators, courts, law enforcement or other recipients where disclosure is required or authorised by law.

We require service providers to handle information consistently with their role and applicable law. We do not disclose private Workspace material to an institution, teacher, another learner or a service provider unless needed to provide a feature you request, required for security or support, or authorised or required by law.

8. Overseas disclosures

Our own systems — the application, its databases and its search index — run on infrastructure located in Australia. Some service providers store or process information outside Australia. In particular, Anthropic (Tutor answer generation), Stripe (payments), Postmark (transactional email), Google (where you choose Google sign-in) and OpenAI (Tutor quality diagnosis, de-identified) process information in the United States or other countries in which they operate.

Before making an overseas disclosure, we take steps required by applicable privacy law, which may include selecting appropriate providers, contractual safeguards, access controls and limiting the information disclosed to what is reasonably needed for the service.

9. Storage, security and retention

We use reasonable technical and organisational measures to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. These measures include encryption in transit where supported, access controls, credential protection, scoped account ownership, security logging, backups and least-privilege operational access.

No online service can guarantee absolute security. If you suspect unauthorised access or a privacy incident, contact us promptly at privacy@studylaw.io.

We retain personal information only for as long as reasonably needed for the purposes described in this policy, to provide the Service, resolve disputes, maintain security, meet legal or accounting obligations, and enforce agreements. Marketing attribution information has its own limits: where it is not linked to an account we delete it 90 days after your most recent visit, and where it is linked to an account we delete it 24 months after that point. Site measurement information is deleted 12 months after it is recorded. When information is no longer needed, we take reasonable steps to delete or de-identify it, subject to backups and lawful retention requirements.

10. Access and correction

You may ask us for access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity before responding. We will respond within the period required by applicable law and explain any refusal or limitation.

Contact privacy@studylaw.io to make a request. You may also update some account information through your Account page. Marketing attribution information linked to your account is included in what we can export or erase on request.

11. Privacy complaints

If you have a privacy concern, contact us first so we can investigate and try to resolve it. Please include enough detail for us to identify the account or event and the outcome you are seeking. We will acknowledge and handle the complaint in a reasonable time and keep you informed.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) through oaic.gov.au or by calling 1300 363 992. You do not have to complain to us first, although the OAIC generally encourages you to do so.

12. Children

The Service is intended for legal-learning users. We do not knowingly collect personal information from a child in circumstances where collection is prohibited by law. A parent or guardian who believes a child has provided information should contact us.