Product and intended use
Define the configuration, people, information and tasks being assessed.
What is offered and to whom
Public claim only
Three published components, checked 2026-09-27. The home page labels them: an 'AI-guided tool' ('Tell us what happened and get suggestions for complaint bodies that may be able to help'), an 'AI writing tool' ('Already know where you want to complain? Get help drafting your complaint'), and a third marked 'No AI used' ('Look through database of complaint bodies, factsheets and support organisations yourself'). The terms describe the whole as 'an AI-assisted tool designed to help users identify complaint bodies, complaint pathways, support services and next steps that may be relevant to their situation'. There is no paid plan, tier or organisational licence.
Ask: Is any version of the platform offered to law firms, community legal centres or other organisations under an agreement, and on what terms?
Deployment and where it runs
Public claim only
Public web application only; no deployment option is offered. The published provider list in the terms cl 2 and privacy policy cl 4.1 names Microsoft Azure for infrastructure, Azure OpenAI for the model, Cosmos DB for storage, Pinecone as a vector store, Webflow for the website, Sentry for monitoring, Google Analytics and reCAPTCHA in the browser, and Bitbucket for deployment. Privacy policy cl 3 states personal information 'is stored in a protected cloud environment'.
Ask: Which Azure region, and which Azure OpenAI deployment region, serve the triage tool and the complaint writer?
What the tools do
Public claim only
Privacy policy cl 4.2 describes the outputs directly: 'The outputs generated through this automated processing include the identification of complaint bodies, complaint pathways, support services and suggested next steps that may be relevant to your situation, as well as draft complaint correspondence generated through the complaint writing tool.' The same clause states the processing 'is substantially automated' and uses 'artificial intelligence, including large language models provided by Third-Party Service Providers'. The triage tool takes free-text input; full conversations are logged with a date and session ID (cl 3).
Ask: What structured sources does the triage tool search to identify a complaint body, how often are they updated, and what does it do when no body in scope fits?
Jurisdiction and coverage
Public claim only
Coverage is stated as a limit, not a claim: 'The platform currently only provides information about New South Wales, Victoria and federal complaint pathways' (terms cl 1, repeated in the privacy policy cl 1 and in the site footer as 'Hear Me Out is available to users making New South Wales, Victorian or federal-based complaints'). Terms cl 8 applies the laws of New South Wales with non-exclusive NSW jurisdiction.
Ask: What does a user in Queensland, Western Australia, South Australia, Tasmania, the ACT or the Northern Territory see, and is out-of-scope jurisdiction detected before an answer is generated?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. None of the four pages read (home, what we do, terms and conditions, privacy policy) carries a heading or block addressed to AI models, assistants, crawlers or 'LLMs', or wording instructing how the platform should be described. A 60-URL site map of hearmeout.org.au run the same day returned no /llms.txt, /ai-info or /for-ai path; that map hit its 60-URL limit and most of its entries are directory pages for individual complaint bodies, so it does not exhaust the site. No comparative or superlative question about the platform appears in any published question-and-answer content read.
Ask: Does the platform publish, at any path or in page markup, content addressed to AI models or assistants about how Hear Me Out should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and the absence of a professional relationship
Public claim only
Terms cl 1: 'Your use of the Platform does not create a lawyer-client, solicitor-client, adviser-client, fiduciary, retainer or other professional relationship between you and NJP or any related person.' Clause 3 places the decisions on the user: 'You remain responsible for deciding whether to make a complaint, where to make it, and what further steps to take.' The operator is itself a law firm: the about page describes NJP as 'a non-profit human rights law firm', and the home page states 'Hear Me Out is designed and operated by the National Justice Project, a not-for-profit legal organisation.'
Ask: If a person uses the tool and then engages NJP or another service, how are the platform conflict and confidentiality positions managed given the operator is a law firm?
Foundation-model providers
Public claim only
Named in a binding document. Terms cl 2 defines Third-Party Service Providers as including 'Webflow, Microsoft Azure, Azure OpenAI, Cosmos DB, Pinecone, Google Analytics, Sentry, reCAPTCHA and Bitbucket', and privacy policy cl 4.2 states the platform 'uses artificial intelligence, including large language models provided by Third-Party Service Providers'. No model name, version or deployment region is published, and no notice commitment applies before a model changes; terms cl 7 reserves the right to change 'providers' among other things.
Ask: Which Azure OpenAI model and version serves each tool, in which region is it deployed, and is the deployment configured without abuse-monitoring human review?
Sub-processors
Public claim only
Nine providers are named in both the terms cl 2 and the privacy policy cl 4.1: Webflow, Microsoft Azure, Azure OpenAI, Cosmos DB, Pinecone, Google Analytics, Sentry, reCAPTCHA and Bitbucket, described as supporting 'the website, AI infrastructure, storage, analytics, monitoring, security, deployment and platform administration'. The list carries no per-provider data location and no version history, and the privacy policy adds that these providers 'may also have administrative or support access where reasonably required to maintain or support the platform'. Privacy policy cl 4.1 states NJP takes reasonable steps to ensure providers act 'under appropriate contractual, technical or organisational arrangements'.
Ask: For each named provider, in which country is data held, and is there a written data processing agreement in place with each?
Training on user content
Not confirmed
Nothing read states whether user input is used to train, fine-tune or improve a model. The purposes list in privacy policy cl 5 includes 'to improve automated responses generated with GenAI' and 'platform operation, troubleshooting, safety, quality assurance, evaluation and improvement', and terms cl 4 permits NJP to process information 'to the extent reasonably necessary to operate, maintain, secure, test, evaluate and improve the Platform'. Neither document distinguishes improving prompts and configuration from training a model, and neither records an arrangement with the model provider on the point.
Ask: Is any user input, in identified or de-identified form, used to train or fine-tune a model, and what does the Azure OpenAI configuration provide on training and retention?
Quality monitoring and secondary use
Public claim only
Privacy policy cl 5 lists among the purposes 'monitoring and reviewing online chats for quality assurance, training and compliance purposes' and 'de-identified reporting, research, advocacy and analysis of structural or systemic trends'. Clause 4 describes the de-identification method: 'Authorised users manually review triage logs and remove direct identifying details', with de-identified results recorded 'in internal spreadsheets, which are stored in NJP's SharePoint environment', and 'When de-identified spreadsheet information is created, any identifiable SharePoint version is deleted immediately.' The about page states the platform 'uses the information gathered to advocate for wider systemic change'.
Ask: In cl 5, does 'training' mean staff training or model training, and can a user ask that their conversation be excluded from de-identified research and advocacy use?
Retention of conversations
Public claim only
Privacy policy cl 3 states full triage chatbot conversations are logged automatically, with the chat text, the date of the log and the session ID, into the platform's administrative systems. Clause 3.3 sets no period: information is kept 'only for as long as it is reasonably necessary', triage admin logs 'only for as long as they are reasonably required', and NJP 'is continuing to develop and formalise retention and deletion processes for triage logs'. Complaint-writer interactions are stated not to be stored in that logging environment 'or retained in the AI environment', on the basis of 'our current understanding and configuration' of that tool.
Ask: What is the actual retention period for a triage log today, and what evidence supports the statement that complaint-writer interactions are not retained in the AI environment?
Deletion
Public claim only
Privacy policy cl 3.3: 'When personal information is no longer reasonably required for a purpose permitted under applicable privacy law, we will take reasonable steps to destroy it or de-identify it, unless we are required or authorised by law to retain it.' Clause 6 gives an access and correction right on request, subject to identity verification and the exceptions permitted by law. No user-initiated deletion right, no deletion timeframe and no certified-erasure process are published, and the triage log is keyed to a session ID rather than an account.
Ask: Can a user ask for a specific triage conversation to be deleted, how would it be located from a session the user cannot identify, and within what period would it be deleted?
Who can read a conversation
Public claim only
Privacy policy cl 3 states administrative access 'is restricted to the Project Lead, and any other person granted permission by the Project Lead', and cl 4 that 'Triage logs may be accessed by authorised users where reasonably necessary for platform operation, troubleshooting, safety, quality assurance, evaluation and improvement' and that 'Authorised users manually review triage logs and remove direct identifying details'. The same clause states Third-Party Service Providers 'may also have administrative or support access where reasonably required'. Clause 4.2 adds that 'Authorised NJP personnel may review triage logs and AI-generated outputs'.
Ask: How many people hold administrative access today, and is a user told at the point of entry that a person may read the conversation?
Access control and logging
Public claim only
Privacy policy cl 3 lists the controls: 'administrative access is restricted to the Project Lead, and any other person granted permission by the Project Lead'; 'access requires authentication controls, including double factor authentication through a justice.org.au email account'; 'personal information is stored in a protected cloud environment'; and 'access to the personal information is logged and monitored'. There is no end-user account, so users have no credentials to protect. No single sign-on or provisioning detail beyond the above is published.
Ask: Who reviews the access logs and how often, and is administrative access removed automatically when a person leaves the project?
Encryption in transit and at rest
Not confirmed
Neither the terms nor the privacy policy read on 2026-09-27 states that data is encrypted in transit or at rest. The closest statement is that 'personal information is stored in a protected cloud environment' (privacy policy cl 3). No security page exists on the site map returned for hearmeout.org.au, and no encryption standard, algorithm or key management arrangement is published anywhere on the pages read. The absence is recorded as a finding.
Ask: Are triage logs and any complaint-writer content encrypted at rest and in transit, under whose key, and can that be stated in writing?
Independent security assurance
Not confirmed
No SOC 2, ISO/IEC 27001, ISO/IEC 42001, IRAP, penetration test or any other independent assurance is published on the four pages read or on the site map returned for hearmeout.org.au on 2026-09-27. The site has no security page and no trust centre. Privacy policy cl 3.3 states that 'NJP takes reasonable steps to detect, assess and respond to privacy and security incidents affecting the Platform.' The absence of any published assurance is recorded as the finding.
Ask: Has any independent security assessment or penetration test been carried out on the platform, and can the report or a summary be provided?
Contract, liability and governing law
Public claim only
Terms cl 1: the Platform is operated by The National Justice Project Ltd (ABN 23 609 620 028) and 'By accessing or using the Platform, you agree to be bound these Terms.' Clause 6 provides the Platform 'is provided on an “as is” and “as available” basis', excludes indirect and consequential loss, limits liability 'to the minimum extent permitted by law' where a statutory guarantee applies, preserves Australian Consumer Law guarantees that cannot be excluded, and states 'We expressly disclaim any liability for actions taken based on the use of the Platform.' Clause 8 applies the laws of New South Wales with non-exclusive NSW jurisdiction. There is no negotiated agreement, no data processing agreement and no fee.
Ask: Is any different agreement available to an organisation that wants to rely on the tool as part of its own service, given the terms disclaim liability for actions taken on the output?
Cross-border transfers and APP 8
Public claim only
Privacy policy cl 4.1 states the position and its limit: 'This Platform is configured so that personal information handled through the platform is intended to be stored and processed in Australia. We rely on information provided by our relevant service providers about their Australian hosting and processing arrangements. However, some Third-Party Service Providers, or their products, infrastructure, subprocessors or support services, may involve access to or processing of personal information outside Australia in some circumstances, including for maintenance, support or incident response. For that reason, we cannot guarantee that overseas disclosure or overseas access will never occur.' Where that happens, NJP takes reasonable steps to ensure the recipient handles the information consistently with applicable privacy obligations. No country list and no per-provider location are published.
Ask: Which of the nine named providers hold or can access data outside Australia, and what does each provider's written arrangement say about Australian hosting?
Incident notification
Not confirmed
Privacy policy cl 3.3 states only that 'NJP takes reasonable steps to detect, assess and respond to privacy and security incidents affecting the Platform.' No notification commitment, no timeframe, and no reference to the Notifiable Data Breaches scheme appears in either document read, although cl 7 publishes an OAIC complaint route. No incident history is published.
Ask: If a triage log containing sensitive information were exposed, how and within what period would affected users be notified, given users are identified only by a session ID?
Change notice for the platform, providers and terms
Public claim only
Terms cl 7: 'We may add, remove, suspend, update or change any part of the Platform from time to time, including its features, content, providers, coverage areas and technical settings', and for a material change to the Terms 'we will take reasonable steps to bring the updated Terms to your attention before they take effect', with continued use taken as acceptance. Privacy policy cl 9 publishes the current version with its effective date. Two different dates appear in the one privacy policy read on 2026-09-27: the heading states 'Updated March 2026' and the closing line states 'This privacy policy was last updated June 2026'. No notice is promised before a model or provider changes.
Ask: Which of the two dates in the privacy policy is the effective date of the version now published, and will provider or model changes be published as they occur?
Export and exit
Not confirmed
Nothing read publishes a way for a user to obtain a copy of a triage conversation or a generated complaint draft after the session, beyond the access request right in privacy policy cl 6. The home page and terms do not describe saving, emailing or downloading an output, and no account exists to return to. There is no organisational data to export.
Ask: Can a user download or email the complaint draft the tool produces, and can they obtain their triage conversation afterwards without an access request?
Connectors and browser-side services
Public claim only
The published provider list includes services that run in the user's browser: Google Analytics for analytics and reCAPTCHA for bot protection, alongside Webflow for the website and Sentry for error monitoring. Privacy policy cl 3 records that usage information is collected automatically, including 'timestamps, pages visited, browser or device information, IP address, error logs, security logs and analytics information'. There are no firm-side or organisation-side connectors.
Ask: Is analytics or bot-protection loaded on the chat pages themselves, and is any part of a user's free-text input exposed to those services?
Open-web retrieval
Not confirmed
Nothing read states whether either tool queries the open web. Terms cl 6 describes the platform as using 'AI and structured information sources to generate guidance', and Pinecone is named as a provider, which is consistent with retrieval over the operator's own material, but no document read says whether an external search is performed or can be disabled.
Ask: Do the triage tool or the complaint writer query the open web or any source outside your own database of complaint bodies and factsheets?
What the tools do and do not do on a user's behalf
Public claim only
Privacy policy cl 4.2: 'The Platform does not make binding decisions or determinations that affect your legal rights or obligations. You retain full autonomy over what action, if any, you take based on the information provided by the Platform.' Nothing read states that the platform lodges a complaint with any body, notifies anyone, or sends correspondence; the complaint writer is described as producing 'draft complaint correspondence'. Terms cl 3 leaves lodgement with the user.
Ask: Does any output leave the platform automatically, for example to a complaint body, a support service or NJP intake, and if so on what trigger?
Human review before a user sees an output
Not confirmed
Review is after the fact, not before. Privacy policy cl 4.2 states 'This processing is substantially automated' and that 'Authorised NJP personnel may review triage logs and AI-generated outputs', which is a review of logs rather than a check before the user is answered. The published disclaimers do the work at the point of use: outputs 'may be incomplete, inaccurate, out of date, overly broad, or unsuitable' (terms cl 6), and the footer states 'Always verify information with official sources or seek professional legal counsel.' No lawyer sign-off on an output is described anywhere read.
Ask: Is any AI output reviewed by a lawyer before the user sees it, and if not, what monitoring detects a wrong complaint body or a missed limitation period?
