Privacy Policy — YourCSM

Effective 23 September 2026 (supersedes 19 August 2026) · Operated by Yoursoftware Pty Ltd · Next review: 23 December 2026, and on any change to storage, provider default, or data flow

The short version: Your YourCSM account, and — for any business with more than one person, or once you back up or share a file — your client documents and the data extracted from them, are held on our servers (Microsoft Azure, Australia East). Until you back up, sync, or share a particular document, that document's file sits only in your own browser; Section 3 sets out exactly which is which. Document text is sent to an AI provider to be classified and extracted — by default that provider is Anthropic (Claude), and you can switch to Google (Gemini) or Groq in Settings. If you sign in with a Yoursoftware-issued internal account, your Claude requests are relayed through a Yoursoftware-operated endpoint rather than going to Anthropic direct. Section 3 and Section 4 set out exactly what goes where.

1. Who we are

YourCSM ("we", "us") is a browser-based document classification tool operated by Yoursoftware Pty Ltd. Contact: privacy@yoursoftware.com.au.

2. What this tool does

YourCSM helps mortgage brokers classify, rename, and organise client documents (PDFs, images) using AI. Classification happens in the broker's browser using AI provider APIs the broker themselves authorises.

3. What information is collected and where it goes

Data type	Where it's stored	Who can see it
Your account — email, password hash, 4-digit PIN hash, name, the business (organisation) you belong to, your role in it	Yoursoftware-operated backend (Microsoft Azure, Australia East). Always held here — from the moment you accept an invitation or create a sign-in. No document content is stored in this record.	You and Yoursoftware. Your business's administrators can see that you are a member and your role, not your password or PIN.
Access request details — name, email, phone, business name, ABN, team size, any notes — submitted via the public "Request access" form, before you have an account	Not stored in any YourCSM database. Emailed once, directly, to the Yoursoftware staff mailbox that reviews access requests.	Yoursoftware staff who review the request. Nobody else, and it is not retained anywhere else by us.
Invitation details — name, email, the business you are being invited into	Yoursoftware backend (Australia East), for up to 7 days or until you accept, whichever is sooner.	Yoursoftware and whoever issued the invitation (your admin, or Yoursoftware staff during onboarding).
Client document files (the PDF / image bytes)	Your browser — `IndexedDB` (database `ycsm_files_v1`), stored unencrypted (Section 8), until you back up/sync it or a colleague needs to see it — at which point a copy is also held in our Azure Blob Storage (container `documents`, Australia East), encrypted at rest by the storage platform. For a business with more than one person, this is the normal way of working, not an edge case.	Only you and anyone with access to your device, plus — once a server copy exists — an administrator at your own business, and Yoursoftware support staff for troubleshooting.
Extracted fields, applications, clients, settings, API keys	Your browser — `localStorage` (key `ycsm`), encrypted with AES-256-GCM only if you set an Access passphrase in Settings — until synced, at which point it is also held in our database (Microsoft Azure, Australia East), encrypted at the application layer (AES-256-GCM) regardless of your local passphrase setting.	Only you and anyone with access to your device, plus — once a server copy exists — your business's administrators and Yoursoftware support staff.
Document text sent to AI for classification and extraction	Transmitted to the AI provider configured in Settings — Anthropic (Claude) by default, or Google (Gemini) or Groq if you select them. See Section 4 for regions.	The AI provider, to generate the classification. We do not see it — except on an internal Yoursoftware account, where Claude traffic is relayed by us (Section 4).
Drive OAuth token (if used)	Your browser session only	Only you. Token is per-broker.
Files imported from Drive	Your browser only (after download)	Only you.
Files exported to Drive	Your own Drive account	You + anyone you share the Drive folder with.

Important: Your account, and for most businesses your team's documents too, are held on our servers — not only in your browser. The one thing that is genuinely browser-only, unless and until you back it up, sync it, or share it, is an individual document file and the fields extracted from it (see the table above). If a specific document has never been synced, we hold no copy of it and cannot act on it (Section 7). The moment it is synced, backed up, or shared with a colleague, we do hold a copy, and it stays held — there is currently no self-service way to delete a server-held copy; purging a client from Settings clears your own browser only. To have a server-held copy deleted, contact us (Section 7 and Section 11). Section 6 covers retention in full, and Section 8 covers security. Where a document is held only on your device, protecting that device is part of your APP 11 obligation, not ours; where we also hold a copy, APP 11 obligations for that copy are ours.

4. Sub-processors

When you classify a document, the document text is transmitted to whichever AI provider is configured in Settings. The default provider is Anthropic (Claude, model claude-sonnet-4-6). If you have not changed the provider in Settings, your client document text is sent to Anthropic. These are the supported providers and the recipients involved:

Recipient	Used for	Where they process it	Privacy policy
Anthropic (Claude) — default provider	AI document classification + field extraction. Receives your client document text.	Overseas (United States)	anthropic.com/privacy
Google (Gemini)	AI document classification + field extraction, where you select it. Receives your client document text.	Overseas (United States, and other Google regions)	policies.google.com/privacy
Groq	AI document classification, where you select it. Receives your client document text.	Overseas (United States)	groq.com/privacy-policy
Yoursoftware Pty Ltd (our own infrastructure, hosted on Microsoft Azure)	Account sign-in and storage for all users (Section 3). Document files, extracted fields and client details you back up, sync, or share with a colleague are held in our database and Blob Storage. Sends transactional email — invitations, access-request notifications, confirmations, password resets — via Azure Communication Services. Additionally, for users signed in on an internal Yoursoftware account, Claude requests are relayed through our endpoint (`/api/ai`) so the organisation's API key stays server-side — meaning your document text passes through our infrastructure in transit before reaching Anthropic. The relay does not apply to brokers using their own API key.	Australia East (Azure), then onward to Anthropic (United States) for the AI relay only	This policy
Google (Drive)	Optional Drive import / export, using your own Google account	Your own Drive tenancy	policies.google.com/privacy
Australian Business Register (ABR)	ABN lookups against the public register only — no client personal information is sent	Australia	abr.business.gov.au

You can switch AI providers at any time via Settings. Except for the internal-account Claude relay and the transactional email described above, we do not proxy or relay provider traffic — your browser talks to the AI provider directly, and we do not store the document text ourselves in either case.

Cross-border disclosure (APP 8): every AI provider above is an overseas recipient. Sending a client's document text to them is a cross-border disclosure of that client's personal information. Under APP 5 you must tell your clients that this happens and, where practicable, which countries are involved — see Section 5.

Sub-processor detail, including regions and DPA status, is maintained at /sub-processors.html.

5. Disclosure to clients

If you are a broker using YourCSM to process documents your clients have provided, you have your own privacy obligations under the Privacy Act 1988 (Cth). At a minimum, your client engagement letter should disclose that:

You use AI tools to classify, organise and extract data from their documents
The document text is transmitted to an AI provider for processing, and that provider is located overseas — by default Anthropic (Claude); Google (Gemini) or Groq if you have selected them. This is a cross-border disclosure under APP 8, and APP 5.2(i) requires you to notify the client of it and, where practicable, of the countries involved.
A document file starts out held only in your browser (Section 8), unencrypted, so your device security is what protects it — until you back it up, sync it, or share it, at which point a copy is also held on Yoursoftware's servers, encrypted at rest, as set out in Section 3. For a business with more than one person, server storage is the normal case, not the exception.
How long you retain the working copy, and where the durable record is held

This section is general information about your own obligations, not legal advice. Your licensee's privacy and AI-use policies prevail; obtain your own advice if you are unsure.

6. How long is data kept?

While you are working a file, YourCSM data lives in your browser and — for anything you have backed up, synced, or shared — also on our servers. In both places it is a working copy, not your durable record. Your durable 7-year record for AML/CTF and NCCP record-keeping is the copy you push to MyCRM (your system of record); set and hold your retention policy there.

In YourCSM, periodically purge clients you no longer need via Settings once they have been handed off to MyCRM. This clears your own browser only. There is currently no self-service way to remove a server-held copy — if one exists for a client (because the file was synced, backed up, or shared), it remains held on our servers until you ask us to delete it (Section 7 and Section 11).

7. Your rights under Australian privacy law

Where a client's document or extracted data has never been synced to our servers — it exists only in your browser — requests from that client to access, correct, or delete their personal information must be actioned by you (the broker) using your local copy. We cannot fulfil those requests on your behalf because we do not hold that data.

Where a document or extracted data has been synced, backed up, or shared with a colleague, we do hold a copy, and we can act on an access, correction or deletion request for it — ask your broker to raise it with you, or contact us directly at privacy@yoursoftware.com.au and we will confirm with your broker before acting, since it is their client relationship. We may not always be able to tell from our own records alone whether a given piece of data was ever synced — if in doubt, ask, and we will check.

For your own YourCSM account record (email, password hash, PIN hash, name, the business you belong to, and your role) — which we always hold, regardless of any document sync — you may request access, correction or deletion at privacy@yoursoftware.com.au.

8. Security measures

Read this before you rely on encryption-at-rest. YourCSM's optional encryption protects the state blob (extracted fields, applications, clients, settings, API keys) held in localStorage. It does not protect the original document files, which are held unencrypted in your browser's IndexedDB store. Anyone with access to your device, your operating-system account, or your browser profile can read those files. This is a known limitation and we are stating it plainly rather than leaving you to assume otherwise. Compensating control: use full-disk encryption (BitLocker / FileVault), a locked OS account, and purge clients from YourCSM once they are handed off to your system of record.

Your account is always server-held (Section 3) — a normal, centrally-managed store, not a residual risk.
Document files: server-held once shared or synced. They are held in Azure Blob Storage, encrypted at rest by the storage platform; extracted fields and client names are additionally encrypted at the application layer (AES-256-GCM) before being written to our database, and access is restricted to your own business's administrators. Until that point, a document exists only on your device, which avoids a central store for it entirely but puts the residual risk on your device instead — see Section 3 for exactly when a server copy is created.
Optional local encryption-at-rest — scope-limited: Setting an Access passphrase in Settings generates a random 256-bit data key, encrypts the localStorage state blob with AES-256-GCM, and wraps that data key under two independently derived keys (your passphrase and a recovery key) using PBKDF2-SHA-256 at 150,000 iterations. Neither the passphrase nor the recovery key is stored. Scope: your local state blob only. Document files in IndexedDB are not encrypted by this control, and it has no effect on the separate, always-on encryption applied to a server copy described above.
Content Security Policy: A restrictive policy is served with the application, limiting which origins scripts may load from and which endpoints the application may connect to. It is delivered as a document-level policy, so it does not cover framing controls that require an HTTP response header.
Subresource Integrity on pinned libraries: The document-parsing libraries loaded from the CDN are pinned with SHA-384 integrity hashes, so a tampered or substituted file will not execute. (Not every third-party script can carry an integrity hash — dynamically imported modules cannot — so this is a partial, not a blanket, control.)
HTTPS only: All transport between your browser and any provider is TLS-encrypted.
No tracking, no analytics, no cookies. The only outbound traffic is what this policy already describes — to your configured AI provider, and to our own backend for the account, document-sync and email functions in Section 3 and Section 4. None of it is behavioural tracking.

9. Children's data

YourCSM is a B2B tool for mortgage brokers. We do not knowingly collect information from children under 18. If a broker uploads a document containing a minor's information (e.g. parent applying for a loan with a dependant listed), the same storage rules set out in Section 3 apply.

10. Changes to this policy

We will publish updated versions at this URL with a revised "Effective" date. Substantial changes will be announced in-app via the Help modal.

11. Contact & complaints

Email: privacy@yoursoftware.com.au.
We will acknowledge a privacy complaint within 5 business days and respond substantively within 30 days. If your complaint concerns documents held by your broker rather than by us, we will tell you and direct you to them.