Diract · Last updated: 19 October 2026
Diract (we, us) provides a configurable business and practice management platform used by organisations across a range of industries (the Service). This policy explains what personal information we collect through the Service, how we use it, who we share it with, and the choices and rights available to you. It applies to the organisations that hold an account with us (Customers), the individuals they authorise to use the Service (Users), and, where a Customer’s own client or counterparty data passes through the Service, those individuals (Client Data subjects). For Client Data, though, the Customer is generally the party responsible for that data, and we act as its service provider. See clause 7 for how that split works.
Name, work email address, phone number, role, and authentication details for each User; the Customer’s organisation details and billing and subscription information.
Records in whichever tables a Customer has configured, which may include matter, property, entity, customer and job records, together with documents, precedents, notes, tasks, calendar entries, financial and trust accounting records, and any other Content a Customer or User enters into or generates within the Service, which may include Client Data about a Customer’s own clients or counterparties.
Where a Customer or User connects a third-party account (Gmail, Microsoft Outlook/Teams, OneDrive/SharePoint, WhatsApp Business), we access the data needed to provide that Integration. For example, that includes email metadata and content for messages a User assigns to a matter, calendar events, messages sent through a connected WhatsApp Business number, and, where a Customer's administrator has linked a SharePoint document library, the files in it and, for supported file types, text extracted from them, limited in each case to what the Integration is described as doing at the time it is enabled.
If a Customer enables Face ID and a staff member chooses to enrol, a numeric description of their face generated from a device camera, not a photograph. See clause 3 for how this category is handled specifically.
If a Customer enables app-based check-in with Geo Lock, the device's precise (GPS-based) location at the moment a staff member checks in. See clause 4 for how this category is handled specifically.
Prompts, uploaded documents, and generated output when a User uses an AI Feature, together with metadata about that use (which feature, when, and by which User) for the purposes described in clause 6.
Log data, IP address, approximate location derived from IP address (used, among other things, to show you the most relevant part of this page and our Terms), browser and device type, and how you interact with the Service, collected automatically. This is separate from, and much less precise than, the GPS-based location described above.
Face ID is opt-in twice over: it is only available at all if a Customer's administrator turns it on for their organisation, and, even then, only if an individual staff member separately chooses to enrol. Enrolling captures a mathematical description of the person's face, not a photograph or video, which the Service compares against a newly generated description each time that person checks in, to recognise them; the underlying camera image is not itself retained.
We treat this as sensitive biometric information. We retain an enrolment until a staff member removes it themselves (available to them at any time from within the Service) or a Customer's administrator removes it on their behalf. Turning Face ID off at the company level stops it being offered to anyone new, but does not by itself delete an enrolment already on file; if a Customer wants existing enrolments deleted as well, its administrator can remove them, or ask us to. A Customer that enables Face ID is responsible for giving its own staff any notice, and obtaining any consent, that the workplace surveillance, privacy or biometric information laws applicable to it require. See clause 11 of our Terms of Service.
If a Customer enables both app-based check-in and Geo Lock, the Service asks the User's browser or device for their precise, GPS-based location at the moment they check in, and compares it against a location their Customer's administrator has configured, to confirm the check-in happened within an allowed distance. We store that location together with the check-in record. We do not collect a User's precise location at any other time, continuously, or in the background. This is a separate, much more precise data point than the approximate, IP-derived location mentioned in clause 2.
This location data is visible only to the Customer's own administrators, as part of their staff attendance records, and is never shared outside the Customer's own Account. A Customer that enables Geo Lock is responsible for giving its staff any notice that the employee-monitoring, surveillance or privacy laws applicable to it require. See clause 11 of our Terms of Service.
When a User uses an AI Feature (for example, precedent drafting assistance, document summarisation, or cross-reference checking), Diract sends the relevant Content to Together AI, the AI model provider the Service uses, to generate the requested output. A Customer can instead connect a model server it runs itself, and its Content then goes there rather than to Together AI.
When the assistant searches the web for a User, it sends the words of that search to Serper, a web search provider. We will update this policy before the Service sends Content to any other AI provider.
Together AI acts as our sub-processor and processes Content only to return a response to the request that sent it. Diract’s account with Together AI is set to keep no prompts or responses once the response is returned. Together AI does not use Content to train its models unless the account holder opts in, and Diract has not.
An AI Feature never makes a decision about a person on its own. Its output is a draft or an analysis, and a User reviews it before anybody relies on it. Clause 17 lists the decisions our programs do make or help to make. See also clause 5 of our Terms of Service.
Where Content includes Client Data about a Customer’s own clients or counterparties, the Customer determines what is collected and why (it is the controller, in EU/UK GDPR terms), and Diract processes it only as the Customer’s service provider (processor), on the Customer’s instructions as reflected in how it configures and uses the Service. If you are a client or counterparty of one of our Customers and have a question about your own data held in the Service, please contact that organisation directly rather than Diract, since we are not able to action a request from someone we cannot verify is authorised on the relevant account.
We do not sell personal information. We share information only:
Diract holds Content in two places. The database, and files such as email attachments and profile pictures, sit with Supabase in Tokyo, Japan. Client documents and job photos sit with Amazon Web Services in Sydney, Australia. The servers that run the Service are also in Tokyo.
The other providers on our Sub-processors page may process information in other countries, including the United States. Japan has an adequacy decision from both the EU and the UK, so information protected by GDPR or UK GDPR can be held there. Before we hold such information in a country without one, such as Australia, we put standard contractual clauses in place with the provider concerned.
We use technical and organisational measures appropriate to the sensitivity of the information involved, including the biometric and location information described in clauses 3 and 4. They include encryption in transit, access controls scoped per Customer, and authentication safeguards. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Maps and addresses go to a mapping provider. To search for an address, place a site, depot or office on a map, or work out the drive between jobs, the Service sends that address, or the map position of each stop, to Google (Google Maps Platform), Geoapify or OpenStreetMap's Nominatim service. A User's browser also loads map images directly from Google, Geoapify or OpenStreetMap, which see the User's IP address as any website they load from would. These providers may process that information outside your own country. Google handles it under the Google Privacy Policy.
We retain Content for as long as a Customer’s Account is active, and for a reasonable period after termination to allow export and to meet legal, accounting, or dispute-resolution requirements, after which it is deleted or de-identified. Account and billing records may be retained longer where required by tax, corporate, or professional record-keeping law. Biometric and precise location information have their own, generally shorter, retention approach: see clauses 3 and 4.
Diract deletes a conversation with the AI assistant, and every message in it, 90 days after it was last used.
You can delete your account from the Diract mobile app, under More, or by writing to privacy@diract.io. The app will not delete the account of a workspace’s owner, or of the only administrator of a workspace other people use, until somebody else takes that role. Deleting an account removes your profile and personal information, removes any biometric enrolment you have made, and revokes your access to every workspace you belong to.
Where you are a member of a Customer’s workspace, Content you created inside that workspace belongs to that Customer and is dealt with under clause 7 rather than removed by your own account deletion. This is so that one person leaving does not delete their employer’s records.
We use strictly necessary cookies to keep you signed in and to remember basic preferences, such as your chosen theme.
On our public website, and on the page that confirms a new sign up, we use the Google Ads tag. It tells us how many people who clicked one of our ads went on to sign up. The tag sets Google advertising cookies, which Google handles under its own Privacy Policy. It runs nowhere else in the Service, and never on a page a Customer shares with its own clients, such as an invoice, a quote or a published website.
We also count visits to our public website and to the Service ourselves. Your browser keeps a random identifier and any advertising tags in the link you followed, so we can see which campaign led to a sign up. If you sign up, we link that identifier to your account. We do not count visits to a page a Customer shares with its own clients.
To protect sign-in, account creation, password reset and our public forms from automated abuse, we use Cloudflare Turnstile. It runs in the background on those pages, in most cases with nothing shown on screen, and processes a small set of technical signals from your browser, such as your IP address, user agent, a TLS fingerprint of the connection, and the site key of the page you are on. Cloudflare states that it cannot directly identify an individual from those signals, and they are not used for advertising or cross-site tracking. Cloudflare acts as our service provider when it runs that check on our behalf, and as its own controller when it uses the same signals to improve its bot detection. For detail, see Cloudflare’s Turnstile Privacy Addendum, which supplements its Privacy Policy.
Depending on where you are, you have certain rights over your personal information. Select your region below. This doesn’t change which rights you have, only which section is shown first.
If you are a California resident, the CCPA/CPRA and similar state privacy laws (where applicable) give you the right to know what personal information we have collected about you, to request its deletion, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined in applicable law. Several US states also give you specific rights over biometric information (clause 3); we do not collect it unless your employer has enabled Face ID and you have separately chosen to enrol. You will not be discriminated against for exercising these rights.
To exercise any of these rights, contact privacy@diract.io. You can also remove your own Face ID enrolment directly from within the Service at any time, without needing to contact us. We may need to verify your identity, and your authority on the relevant Account, before actioning any other request.
The Service is intended for use by business professionals and is not directed at children. We do not knowingly collect personal information from children.
Diract’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Gmail data accessed via the Service is used only to provide and improve the specific Gmail-related features a Customer has enabled, is not used for advertising, and is not transferred to third parties except as necessary to provide those features, to comply with the law, or as part of a business transfer as described in clause 8, and never to train general-purpose AI/ML models.
Where a Customer's own Microsoft 365 administrator connects OneDrive/SharePoint, they grant Diract's own registered Microsoft application organisation-wide permission to read and write files. A Customer never shares a password or its own credentials with us to do this, and its administrator can revoke this consent at any time from its own Microsoft 365 admin centre. We access only the specific document library that Customer's administrator has linked, use it only to provide the file-browsing, drafting and AI-search features the Customer has enabled, and do not use it to train general-purpose AI/ML models.
We may update this policy from time to time. Where a change is material, we will give reasonable notice before it takes effect (for example, by email or an in-app notice).
Australian Privacy Principle 1.7 applies when an organisation "has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision" that "could reasonably be expected to significantly affect the rights or interests of an individual". A computer program here means any software, including a fixed set of rules, and not only AI. This clause lists the kinds of personal information our programs use, the decisions they make on their own, and the decisions they help a person make.
Access to a workspace when it is not paid for. Our billing program reads a Customer's subscription status, its trial end date, any unpaid invoice and which Users hold a seat. It decides, without a person reviewing it, when the Service stops accepting changes. A workspace becomes read only when its trial ends or its subscription is cancelled. A User with no seat cannot make changes. When a payment is overdue, the Service stops new matters being created, and after 14 more days the whole workspace becomes read only. Paying, subscribing or giving the User a seat lifts the restriction, and every record stays readable throughout.
Bot checks on sign in and public forms. When somebody signs in, creates an account, resets a password or sends one of our public forms, Cloudflare Turnstile checks signals from their browser, including their IP address and browser details (see clause 11). The Service refuses the attempt if that check fails, or if too many attempts arrive in a short time.
AI Features draft time entries, documents, summaries and proposed changes to a record. A draft can use a client's name and details, the emails filed to their matter and the work a staff member recorded. A User decides whether to keep, change or discard each draft, and a draft affects nobody until a User acts on it.
Some features decide something about a Customer's own staff or clients. The Customer chooses to turn each one on, so the Customer has arranged for that program, and its own privacy policy should describe it (see clause 7). We describe them here so a staff member or client knows what the Service does.
Check in with Geo Lock compares the device's location at the moment of check in with the office or the job's site. It refuses a check in further away than the distance the Customer set (see clause 4).
Face ID compares the face description taken at a kiosk with the descriptions of enrolled staff. When no match is close enough, it does not recognise the person, who can use their PIN instead (see clause 3).
Payroll works out tax withheld, superannuation, leave accrued and long service leave owed when somebody leaves. It uses the employee's tax file number declaration, pay details, hours worked and service dates. A person reviews each pay run before it is finalised.
Pay compliance compares a staff member's pay with the minimum for their award classification and shows whether it passes. A person decides what to pay.
When a Customer turns on Refuse a job that clashes, the calendar refuses to book a person for a job that overlaps their other jobs or shifts. The drive between jobs counts as busy time.
For privacy-related enquiries, contact privacy@diract.io.