Privacy notice

What we collect when you use this website or the demo portal, and why.

What we collect

• Your name and organisation, and your work email address if you gave it to us, recorded against the access code we issued to you.
• If you have an account (you sign in with a link we email you): your name, work email address and team, who added you and when, when you first and last signed in, and when you completed or skipped the welcome steps. Each sign-in link works once. We keep a one-way code of each link, never the link itself, so we can check it, and, if you asked for the link from a page of the portal, that page’s address, so we can take you back to it. Whenever anyone asks for a sign-in link, we also keep codes made from the email address they typed and from their IP address, for about a day, to limit how often links can be asked for and stop misuse. These codes are made with a secret key, are used only to count requests, and aren’t linked to your account.
• If you choose a password for your account: we store it only as a one-way hash, made with a secret key, which can’t be turned back into your password; and when you set it. Passwords expire after 90 days, when we ask you to choose a new one. To stop password guessing we count failed tries against your account, and against a one-way code of the IP address they come from, kept for about a day at most; after 10 failed tries in a row, password sign-in to your account pauses for 15 minutes (a sign-in link still works). When you set or change your password, we email you to say so, and keep a record that we sent it, never its text.
• If you sign in with Microsoft, Google or GitHub: from what the provider sends us, we use only your email address and an account id, and keep nothing else. We keep that account id and the email address it gave us when you linked it, with when it was linked and last used, while the sign-in stays linked to your account, and never the provider’s keys to your account. If you first sign in with one from the sign-in page, we email your account’s address a link to confirm; the link works for 15 minutes, and we keep the account id and email address with a one-way code of the link until it is used, or at most 7 days after it expires. (Linking one from your Account page, just after signing in, needs no such link.) Each time one is linked or unlinked, we email your account’s address and keep a record of that email (when, to whom and its subject), never its text, for six months. Our admin team sees which providers are linked to your account and when, never the account id or its email address, and can remove one.
• How your code is used: how many requests it makes each day, when it was last used, which pages of the portal it opens, when and for how long (for example the weekly briefing or an item page), and which kinds of file it downloads (for example a PDF of the weekly briefing). We record the kind of page or file only, never your search words, the items you tick or what a file contains, and we don’t keep the files you download. We don’t store your IP address with your details.
• People pages: our activity records note that your access code opened the People, Ministries or Committees page, a committee’s page or a person’s page, not which committee or person, and not what you searched for.
• Your dashboard layout and the sector you choose.
• If we set up a relevance profile for your organisation: the short description of its business that we write, which is used, in Australia, to rate items for it, and any sectors and topics we choose as its interest areas. Its weekly AI summary is written, also in Australia, from the items rated most relevant to it and those in its interest areas; only the codes we link to the profile can see it, in the portal and, if their briefing email follows the profile, in that email.
• Anonymous statistics on how the site is used, through Vercel Web Analytics: the pages viewed (the page address only, without your search words or filters), the site that linked you here, your approximate location (country, region and city), your type of device, operating system and browser, and the time. These statistics aren’t linked to your name, your access code or your IP address.
• The questions you ask the AI Advisor and its answers, so we can check their quality and keep to the daily limit. Please don’t include personal or confidential information in your questions.
• If you attach files to an AI Advisor question: each file’s name, type and size, recorded with the question. The files themselves are processed in Australia to answer the question, are not stored, and are not used to train AI models. From the question where you first attach files, and for the rest of that conversation, we record your questions, which of our items the answers cited, the search filters they used from our own lists (places, levels, topics, sectors and our item numbers), and how each went (the kind of any check that failed, the time taken and the tokens used). We don’t record the answers themselves, the words or dates they searched for, or the details of our checks.
• If you agree to receive our weekly or daily briefing by email: the address we send it to, when and how you agreed, how often you asked for it and for which sector (or your organisation’s relevance profile), when either changed, the emails we send you, and when you unsubscribe. We don’t track whether you open the emails or click their links. If whoever reads that address has unsubscribed and someone using an access code asks us to turn the emails back on, we email that address one confirmation link (the address, what was asked for, and when), at most once a week; if they choose “Don’t ask me again”, we keep only a coded fingerprint of the address, never the address itself.
• If you ask for a briefing covering more sectors: the sectors you ticked, your note, and when you asked.
• If you set up alerts: the words and filters of each search you save, including people you follow, the items you follow, each alert’s name and email setting, and which new items matched them, all recorded against your access code. We use them only to show you new matches and, if you chose email for an alert, to email them to you at your briefing email address. Our admin pages show only how many alerts each code has, never their words or items. For each alert email we keep a record of when it was sent and which items it listed, never its text.
• If you add the deadlines to your calendar: a one-way code made from your private calendar link (never the link itself), the sector and the sitting-day choice you made for it, when you made it and when you reset it or turned it off, and when and how often your calendar app fetched it. Keep the link private: anyone with it can see the dates and titles in your calendar, though nothing else about you or your code.
• If you link WhatsApp for your alerts: your WhatsApp phone number, which we get from the message you send us to link it (you never type it in here), when and how you agreed, when and how WhatsApp alerts stopped, a log of these changes with your number’s last 3 digits (and the other access code or account, if your number moves between them), and a record of each WhatsApp message we send you (when it was sent, which items it listed, whether it was delivered and read, or failed and WhatsApp’s reason (numbers removed), and a one-way code of its WhatsApp id), never its text. The messages list titles and a link to Saved Searches only.
• If you message our WhatsApp number, whether or not you have linked it: one-way codes made from your number and from the message’s WhatsApp id (never your number itself or what you wrote), and what kind of message it was (to link, to stop, or anything else). If we reply, a record of our reply: when we sent it, which reply it was, whether it was delivered and read, or failed and WhatsApp’s reason (numbers removed), a one-way code of its WhatsApp id, the last 3 digits of your number and, if your number is or was linked, which access code or account.
• If you ask a We adviser a question: your question, the email address and phone number you give us for the reply, and which of our items you attached (from an AI Advisor answer, only the items it cited, never the answer or your files). It is stored in our database in Sydney and emailed to our advisers’ inbox, so that We Communications’ advisers can answer it; we keep it for 180 days.
• If your organisation has a paid subscription: the billing record we keep about it, which is mainly about the organisation: its team, plan, number of seats, markets and term dates, whether and when it was paid, the invoice or payment reference and any notes we recorded (which might name a contact at your organisation), and which We staff member recorded each change and when. We never record card or bank details in this portal.
• If you ask for a demo on our website: your name, work email address and organisation, and your role, sector and message if you give them. To stop misuse of the form, we also keep a one-way code made from your IP address and one made from your email address, for one day; the codes can’t be turned back into either.

We use one essential cookie to keep you signed in (with an account, for 30 days after you last use the portal and 90 days at most; with an access code, for 12 hours), and one to remember your light or dark setting if you choose one. Signing in can also set short-lived essential cookies, used only for that step and holding only one-time security codes: one for up to 10 minutes when we ask you to choose a new password after yours has expired, and, when you sign in with Microsoft, Google or GitHub, one for up to 10 minutes while you do and, if we email you a link to confirm, one for that link’s 15 minutes. We don’t use advertising or tracking cookies. Vercel Web Analytics doesn’t use third-party cookies: it tells visits apart with a code made from each request, which is discarded after 24 hours. Our marketing website, www.wepolicyadvisor.com, sets no non-essential cookies: the cookies above are set only by the portal.

People in our lists

We show public office-holders’ names, roles and official office details from official sources.

Why we collect it

To give you access to the demo, keep it secure, stop misuse (each code has a daily limit), and understand which features are useful so we can improve them. If you have an account, we use your email address to send you sign-in links and, if we added you, an invitation; and your sign-in times to keep your account secure and see that it is used. If you asked for it, we use your email address to send you the briefing, weekly or daily as you chose, and for nothing else. If you add the deadlines to your calendar, we use your link’s record to send your calendar app the dates you chose, to stop misuse (each link has a daily limit) and to show you when your calendar last read it. If you ask for a demo, we use your details to reply to you and arrange it; we won’t add you to a mailing list unless you ask us to. If you link WhatsApp, we use your number only to send you the alerts you chose for WhatsApp, and to confirm when you link it or stop. If you message our WhatsApp number, we use the one-way codes only to ignore repeated messages and to limit how often we reply.

Where it is held

Our database is in Australia (Sydney). The AI models that summarise policy documents and answer your questions run in Australia (Sydney and Melbourne). The website is hosted by Vercel, with its server functions in Sydney. Vercel processes the usage statistics and may do so outside Australia, including in the United States. The briefing emails are sent from Sydney by Amazon Web Services; your own email provider then delivers them. A demo request reaches our team’s inbox as an email, sent from Sydney by Amazon Web Services; it isn’t stored in the portal’s database. If you add the deadlines to your calendar, your calendar app (for example Outlook, Google Calendar or Apple Calendar) fetches them from our website and keeps its own copy of the dates and titles, under its provider’s terms. If you link WhatsApp, our WhatsApp messages are sent from Sydney by Amazon Web Services. WhatsApp is run by Meta, which processes the messages (your number, and the titles and link in each one) outside Australia.

Who sees it

Only the We Communications team running this demo. If you have an account, our admin team sees your name, email address, team and when you last signed in. Demo requests are seen only by the We Communications team that answers them. Our admin pages show only whether a code’s calendar link is on and when it was last read. For WhatsApp, they show only each code’s WhatsApp status (linked, waiting for its message, stopped or not linked) and how many messages it was sent in the last 7 days, never the number. We don’t sell or share your information, and we don’t use it to train AI models.

Three service providers run parts of the service for us: Supabase (the database), Amazon Web Services (the AI models, the briefing emails, WhatsApp messages and demo requests) and Vercel (the website and its usage statistics). If you link WhatsApp, Meta also handles the messages we send you, as the operator of WhatsApp. The AI summaries are made from public policy documents, not from your information.

How long we keep it

• Questions to the AI Advisor and its answers: 90 days.
• The names, types and sizes of files attached to AI Advisor questions: 90 days, with the question. The files themselves aren’t kept.
• Which pages your code opened, for how long, and which kinds of file it downloaded: 90 days.
• Your name, organisation, email address and usage: until 12 months after your access code expires, unless you ask us to delete them sooner.
• If you have an account: your name, email address, team and sign-in times, until 12 months after your account is closed, unless you ask us to delete them sooner. A linked Microsoft, Google or GitHub sign-in: until you unlink it or your account is deleted. The one-way code of each sign-in link, and the page address kept with it: 7 days after the link is used or expires. The codes kept against too many sign-in requests: about a day. Your password’s hash, kept with your account details: until you change it, or until 12 months after your account is closed; the codes kept against password guessing: about a day.
• If you get the briefing by email: the address and your agreement are kept with your other details, until 12 months after your access code expires, even after you unsubscribe, so we can show you agreed. The emails we sent you: six months. A confirmation request: 30 days after we send it. The coded fingerprint of an address that chose “Don’t ask me again”: 12 months. Unsubscribing stops the emails straight away.
• Requests for more sectors: kept with your other details, until 12 months after your access code expires.
• Alerts: until you delete them, or 90 days after your access code expires or is withdrawn. The record of which items matched an alert: 90 days. The records of alert emails (when each was sent and which items it listed, never its text): six months.
• Your calendar link’s record: while the link works, then 90 days after you reset it or turn it off, or after your access code expires or is withdrawn. The link stops working straight away when you reset it or turn it off.
• WhatsApp: your number while it is linked, then for 90 days after WhatsApp alerts stop (you message STOP or unlink, we turn them off, or your access code or account ends), when it is deleted. Your agreement, when and how WhatsApp alerts stopped, and the log of these changes (with your number’s last 3 digits and, if your number moved, the other access code or account): until 12 months after your access code or account ends (including when access codes are replaced by email sign-in), so we can show you agreed. The records of WhatsApp messages we send, including our replies to anyone who messages our number (when each was sent, which items it listed, whether it was delivered and read, or failed and WhatsApp’s reason (numbers removed), a one-way code of its WhatsApp id and the last 3 digits of the number, never its text): six months. The one-way codes of messages sent to our number: 7 days.
• Questions to a We adviser, with the reply details you gave: 180 days.
• Billing records (your organisation’s plan, term, invoice references and payment dates, and the history of changes to them): for as long as tax law requires us to keep business records, which is generally five years. If a subscription ends, your people are signed out and their briefing emails, alerts, WhatsApp messages and calendar feed stop; nothing is deleted straight away. Their details are kept as described above, and the billing record stays.
• Demo requests: until 12 months after our last contact with you, unless you ask us to delete them sooner. The one-way codes kept against misuse of the form: one day.
• Anonymous usage statistics: Vercel keeps them for at least 12 months, and may keep them longer.

Keeping it secure

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure, as Australian Privacy Principle 11 requires. Sign-in links work once and expire after 15 minutes (invitations after 7 days), and we never store a link itself. When we no longer need your information, we delete it or make it anonymous.

If a data breach involving your information is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Your choices

You can ask us what we hold about you, ask us to correct it, or ask us to delete it and close your code or account. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

You can stop the briefing email at any time with the Unsubscribe link at the foot of every email, without signing in, by replying to it, or under Email Alerts (you sign in first). Each email covers one sector; to ask for more, use the request form (you sign in first).

You can reset or turn off your calendar link at any time on the Deadlines page (you sign in first); the old address stops working straight away.

You can stop WhatsApp alerts at any time by messaging STOP to our WhatsApp number (in Malaysia, STOP or BERHENTI), or with Unlink under Saved Searches (you sign in first). They stop straight away.

If your access code is for Malaysia, or you ask us for a demo from our Malaysia page

Notis ini dalam Bahasa Malaysia: Notis Privasi (draf).

We also follow Malaysia’s Personal Data Protection Act 2010, as amended in 2024. We collect the same details as above, for the same purposes, and keep them for the same time.

This section also applies to a demo request from our Malaysia page (www.wepolicyadvisor.com/malaysia). It reaches our team’s inbox as an email sent from Sydney by Amazon Web Services, so it too is transferred outside Malaysia.

Your details are held in our database in Australia (Sydney), and the AI models that answer your questions run in Australia, so your personal data is transferred outside Malaysia. It is protected there as this notice describes.

We get your details from you, or from the person at your organisation or at We Communications who arranged your access.

We need your name and organisation to issue an access code; without them we can’t give you access. On the demo form, your name, work email address and organisation are needed so we can reply; your role, sector and message are optional. Giving us details for the briefing email, alerts, the calendar link or WhatsApp is your choice; without them you just don’t get that feature.

We may pass a demo request from our Malaysia page to We Advisors, our policy advisory team in Kuala Lumpur, so that they can reply.

You can ask us for access to your personal data, ask us to correct it, or ask us to limit how we use it, through the contacts below. You can also complain to Malaysia’s Personal Data Protection Commissioner (pdp.gov.my).

Contact

Your We Communications contact, who issued your access code, or We’s privacy team at Privacy@we-worldwide.com. For a demo request, you can also write to AIAdvisors@wecommunications.com.

Last updated 13 October 2026. Made under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and for Malaysian access codes, Malaysia’s Personal Data Protection Act 2010.