Product and intended use
Define the configuration, people, information and tasks being assessed.
What the Intake add-on is and how it is sold
Public claim only
The Australian pricing page, read 2026-09-27, lists Intake as an add-on line on three of four plans: '$29' on Boost, '$59' on Grow and 'Included' on Prosper+, with no Intake line on Bill. A feature table on the same page marks the intake functions 'with Intake add-on' on Boost and Grow. The page does not state whether the $29 and $59 figures are charged per user or per firm, although plan prices are stated per user per month.
Ask: Is the Intake add-on charged per user or per firm, and what is the total monthly Australian-dollar cost for our user count on our plan?
Published functions, and which of them the vendor attributes to AI
Public claim only
The feature page, read 2026-09-27, sets out: forms embedded on the firm's website so 'every inquiry instantly lands Smokeball'; lead capture and tracking 'from one place'; consultation scheduling and payment 'with calendar and billing integrated directly in Smokeball's intake'; staff alerts when 'a new lead comes in'; a library of forms 'tailored by jurisdiction and practice area'; a drag-and-drop builder with 'conditions so the form adapts to each answer'; delivery by 'client portal, web link, or email'; 'Voice-guided, multi-lingual forms' clients 'can speak or type their way through, in their preferred language'; and data flow into the matter, including 'Client documents autofill intake form fields'. Exactly one function is attributed to AI: the heading 'AI builds your form in minutes', with the body 'Generate one from a matter type and jurisdiction, or convert a form you already use.' The words voice, multi-lingual and autofill appear with no AI, machine-learning or model language.
Ask: Which Intake functions are model-based: the form generator only, or also the voice completion, the language versions and the autofill of form fields from client documents?
How Intake is delivered
Public claim only
Intake is described on the feature page, read 2026-09-27, as a module of the hosted Smokeball application, with forms embedded on the firm's own website and sent by client portal, web link or email. The security policy states that 'Smokeball's solutions are hosted on Amazon Web Services (AWS)'. No on-premises, private-cloud or self-hosted option is published.
Ask: Where is the embedded form script served from, and can an Australian firm require that form submissions be processed and stored in Australia?
State of the published product description
Public claim only
The Intake feature page, read 2026-09-27, carries unfinished template filler text in three places, including 'These are the foundations you'll rely on for every award-worthy project' and 'We also include videos that explain the concept, go deeper on the subject, or maybe might spark some new ideas for the resources that you're using'. This is recorded because it bears on how settled the published description of the module is; no release-stage label (beta, preview, general availability) is published for Intake or for its AI form generator.
Ask: Is the AI form generator generally available or in preview, and where is that stated?
Jurisdiction coverage of the form library
Public claim only
The feature page, read 2026-09-27, states that the pre-built forms are 'tailored by jurisdiction and practice area' and that the generator builds a form 'from a matter type and jurisdiction'. No jurisdiction is named, and no source, author, review process or update cycle for the questions is published. Terms clause 23.4 states that precedent documents are templates for the firm to edit using its own judgement.
Ask: Which Australian jurisdictions and practice areas does the Intake form library cover, who drafts and reviews the questions, and how often are they updated?
Check for vendor content directing how AI describes the product
Not confirmed
Checked 2026-09-27. The full text of the Intake feature page, the pricing page, the terms of service, the privacy policy and the security policy was searched for content addressed to AI models, assistants, LLMs or crawlers (including the strings 'instructions for AI', 'AI assistants', 'llms.txt', 'describe', 'crawler' and 'robots'); none was found. A request to https://www.smokeball.com.au/llms.txt returns the site's 'Page Not Found' page. A URL map of www.smokeball.com.au searched for 'ai' surfaced no /ai-info, /for-ai or equivalent page. A URL map does not reliably discover an unlinked file, so absence is established only for the pages and the map checked.
Ask: Do you publish any page, file or block addressed to AI models, assistants or crawlers that describes Smokeball or Intake, and where is it?
Vendor material ranking its own product among named competitors
Public claim only
The vendor's blog carries an article headed '8 Best Legal AI Tools for Lawyers in Australia: Make AI your legal assistant', read 2026-09-27, whose first entry is its own product: '1. Archie AI - Smokeball (Best Integrated Legal AI Assistant)'. Its FAQ answers the question 'What are the best legal AI tools for Australian law firms in 2026?' with a list beginning 'Archie AI (integrated into Smokeball legal practice management software)', and a further answer states that 'Solo practioners and small to mid-sized law firms benefit most from an integrated legal AI assistant like Archie AI within Smokeball legal practice management software'. The article lists 'Efficient client intake: Custom intake forms tailored to your practice area' as a bullet under Archie AI, while the feature page and the pricing page treat Intake as a separately priced add-on distinct from Archie.
Ask: Are the intake forms described in your '8 Best Legal AI Tools' article part of Archie or part of the priced Intake add-on, and which of the article's statements are warranted in our agreement?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority and consent to put a prospective client's information into the system
Public claim only
Intake collects information from people who are not yet clients. Terms clause 20, read 2026-09-27, makes the firm 'responsible for ensuring that you have all necessary rights and consents, including third party privacy consents' to provide Client Data to Smokeball and to permit Smokeball to process it and provide it to Interfacing Third Parties, and indemnifies Smokeball for loss arising from a failure to obtain and maintain those consents. Clause 8 requires the firm to ensure it has 'all consents and authorities to disclose information to, and collect and use information from, Related Party Users' and makes the firm responsible for their acts and omissions. Neither the terms nor the privacy policy addresses consent for AI processing or for a prospective client's documents.
Ask: What collection notice and consent wording do you expect an embedded Intake form to carry for a person who never becomes a client, and who is the collecting entity for that data?
Model and provider behind the form generator
Not confirmed
No foundation model, model provider, model version or inference location is named on the Intake feature page, the pricing page, the terms of service, the privacy policy or the security policy, all read 2026-09-27. The only AI statement about Intake is the heading 'AI builds your form in minutes' with the body 'Generate one from a matter type and jurisdiction, or convert a form you already use.' Privacy policy section 8 says only that 'We may offer or use artificial intelligence (AI), including generative AI solutions, as part of our Services.'
Ask: Name the model and provider that generates an Intake form, the country in which that inference runs, and whether you will notify us before changing either.
Who else processes intake data
Public claim only
Privacy policy section 5, read 2026-09-27, states that 'Some of the third party services we use include: ChurnZero, Salesforce, Zendesk, Pardot, Jira/Confluence, and Outreach', presenting them as examples rather than a complete list, and separately names disclosure to other Smokeball Group members, third-party payment processors, financiers and providers of integrated third-party services. The security policy names Amazon Web Services as the hosting platform. There is no subprocessor register, no notification or objection mechanism, no published DPA, and no processor is identified for form hosting, voice input, language versions or the AI form generator.
Ask: Provide the complete list of processors that touch an Intake form submission, including any voice, translation or model provider, with their countries and the notice you give before adding one.
Use of intake content to train or improve models
Public claim only
Terms clause 20, read 2026-09-27, states that Smokeball 'may also de-identify and aggregate your Client Data with other data and use that de-identified and aggregated data for the purposes of research and marketing, benchmarking and industry insights, the improvement of Smokeball's products and services, the development of new products and services, and any other business purposes of Smokeball'. The security policy states 'Smokeball does not provide customer data to third parties for AI model training or third-party AI modelling'. That statement is about third parties; no document read says whether Smokeball itself trains, tunes or evaluates models on de-identified customer content, and no opt-out is published. Nothing addresses intake form submissions or lead records specifically.
Ask: Does Smokeball or any provider train, fine-tune or evaluate models on intake form submissions or lead records, even de-identified, and will you warrant the position with an opt-out?
Prompts, generated forms and usage signals
Public claim only
Terms clause 22, read 2026-09-27, defines Usage Data as 'anonymous usage related data and technical data' that 'does not include any of Your Client Data or Your personal information' and reserves the right to 'collect, aggregate, monitor, and use Usage Data to improve the functionality, performance, and aid in further development of the Services'; it also states that any feedback, comments, feature requests, ideas and suggestions 'will be considered non-confidential and non-proprietary to You' and 'shall be exclusively owned by Smokeball'. Nothing published states whether the instruction given to the form generator, the form it produces, or a firm's acceptance or rejection of that form, is Client Data or Usage Data.
Ask: Are the instructions we give the Intake form generator and the forms it produces treated as Client Data or Usage Data, who can read them, and how long are they kept?
How long intake data is kept
Public claim only
Terms clause 18, read 2026-09-27, states that on termination Smokeball 'may immediately deactivate your Services and may delete your account and data after thirty (30) days' and grants 30 days' access to retrieve data; clause 19 requires extraction within 30 days of the end of the term. Privacy policy section 9 retains personal data while there is 'an ongoing legitimate business need or legal reason', sets no period, and otherwise deletes or anonymises it, isolating backup archives until deletion is possible. No period is published for form submissions, part-completed or abandoned forms, lead records of people who never become clients, voice input, or generator prompts and outputs.
Ask: State the retention period for an intake form submission, an abandoned form and a lead record for a person who never becomes a client.
Deleting a single lead or submission during the term
Public claim only
Terms clause 18 permits deletion of the account and data 30 days after termination and clause 19 requires the firm to extract its data within 30 days of the end of the term. The privacy policy gives an individual a right to request deletion of personal data and notes that data held in backup archives will be isolated from further processing until deletion is possible. No customer-initiated process, timeframe or certificate of destruction is published for deleting one lead record, one form submission or one form definition during the term, which matters because a person who enquires and does not engage the firm may ask for their information to be deleted.
Ask: How do we delete a single lead record or form submission during the term, within what period, does it reach backups, and will you certify destruction?
Vendor staff access to intake data
Public claim only
Terms clause 20, read 2026-09-27, records that the firm acknowledges Smokeball 'may need to access and view Client Data to assist with your questions, technical support requests, training or other issues' and limits that access to what is reasonably necessary. Privacy policy section 2.3 states that Client Data 'may be made temporarily visible to us when providing technical support or training to our customers, or when we are responding to a customer's questions'. The security policy lists multi-factor authentication, role-based access control, periodic privilege reviews and monitoring for abnormal access. No approval workflow, logging commitment or customer-visible access record is published.
Ask: Which Smokeball roles and which countries can view intake form submissions and lead records, is that access logged, and will you disclose the log on request?
Who can open a form and who can see submissions
Not confirmed
The security policy, read 2026-09-27, lists multi-factor authentication, role-based access control 'ensuring least-privilege principles', periodic privilege reviews and monitoring; its matter-level statements are expressed about Archie AI, not Intake. Terms clause 8 records that 'the Services may contain functionality which permits a Related Party User to obtain limited access to the Services through a shareable link', and the Intake page states forms are sent by 'client portal, web link, or email' and embedded on the firm's public website. Nothing published states whether a form link expires, is single-use or is authenticated, or which staff can see a submission before a matter exists.
Ask: Does an Intake form link expire or require authentication, can a submitted form be reopened from that link, and which roles in our firm can see a lead before a matter is created?
Encryption of intake data
Not confirmed
The security policy, read 2026-09-27, states 'All sensitive data is encrypted using AES-256 encryption' and that 'Communication between systems is secured using TLS 1.2+'. The privacy policy, read the same day, instead states 'Encryption utilising a minimum of TLS 1.2 for data in transit and at rest', so the two documents describe the at-rest mechanism differently. Neither addresses key management, customer-managed keys, or the encryption of a form in transit from a firm's own website to Smokeball.
Ask: Reconcile the two published statements about encryption at rest, and confirm how a submission travels from a form embedded on our website to Smokeball.
Independent assurance
Public claim only
The security policy, read 2026-09-27, states 'Smokeball is proud to be an ISO 27001 certified organisation' and that its information security management system 'is certified to the ISO 27001 standard', without naming the certificate number, the certification body, the scope or the standard version. The certifications listed on the same page for Amazon Web Services, including ISO 27001, ISO 42001, SOC 1, SOC 2 and PCI DSS, are the hosting provider's, not Smokeball's. No certificate, statement of applicability, SOC report, penetration-test summary or trust centre was found for Smokeball, and no document states whether the Intake module is in scope.
Ask: Provide the ISO 27001 certificate and statement of applicability showing that the Intake module is in scope, plus the latest penetration-test summary.
Contracting documents for the add-on
Public claim only
The terms of service, read 2026-09-27 and stated to have been last updated 09/07/2026, name Smokeball Australia Pty Ltd as the contracting party, constitute the Agreement as the terms plus an order form (clause 1), apply to any order form agreed or renewed on or after 1 March 2024, and are governed by New South Wales law (clause 28). No ACN or ABN is published in the terms, privacy policy or security policy. No data processing agreement, subprocessor register or security schedule was found, and no Intake-specific terms exist: the words 'intake' and 'form' appear in those documents only in site navigation.
Ask: Provide the ACN or ABN of the contracting entity and a data processing agreement covering Intake, with the security policy annexed as a schedule rather than a page you may change.
Where intake data goes
Public claim only
Privacy policy section 7, read 2026-09-27, states 'Our servers and the Smokeball Group companies are located in the United Kingdom, the United States, and Australia. Our third party service providers and business partners operate in the United Kingdom, the United States, Australia, and Japan. This means that when we collect your personal data, it may be processed in any of these countries', and that for transfers from the UK to non-adequate countries the UK International Data Transfer Agreement is used, naming Australia as a country not subject to an adequacy decision. Nothing published commits an Australian firm's intake data or the form generator's inference to Australia.
Ask: Will you commit in writing that intake form submissions, backups and any form-generation inference stay in Australia, and list every country from which they can be accessed?
Breach notification
Not confirmed
The terms of service, read 2026-09-27, impose no data breach or security incident notification obligation on Smokeball; clause 8 instead requires the firm to notify Smokeball immediately of unauthorised access or compromised credentials. The security policy lists 'incident response planning and readiness' among continuous-improvement activities and gives infosec@smokeball.com for reporting a concern, with no notification commitment or timeframe. The privacy policy read the same day contains no notifiable data breach process. This matters for Intake because a breach may affect enquirers who never became clients and whom the firm may be obliged to notify.
Ask: Within what period and in what detail will you notify us of a breach affecting intake form submissions or lead records, and will that obligation be in our agreement?
Change notice
Public claim only
Terms clause 5, read 2026-09-27, allows Smokeball to 'update, change or amend these Terms and/or the Services' during a subscription term provided the change does not require additional fees or deprive the firm of a substantial or material benefit, with notice by email to the nominated Main Contact taking effect 30 days later. Nothing published requires notice before changing the AI form generator, its model, the wording of the questions it produces, or the pre-built form library, and the privacy and security pages carry 'last updated' dates without a change log.
Ask: Will you notify us before the Intake form generator's model or output wording changes, and before a pre-built form in our jurisdiction is altered?
Getting intake data out
Public claim only
Terms clause 18 grants 30 days' access after termination 'for the sole purpose of permitting you to retrieve your data', and clause 19 requires the firm to extract its data within 30 days of the end of the term, uninstall all copies and confirm in writing if asked. No export format, bulk-export tool, migration assistance or charge is published, and nothing states whether lead records, form submissions, form definitions or generated forms are included in an export.
Ask: In what format can we export lead records, form submissions and our own form definitions at exit, at what cost, and are AI-generated forms included?
Third-party services reached from Intake
Public claim only
Terms clause 24.2, read 2026-09-27, states that Interfacing Services 'are supplied to You pursuant to an agreement between You and the relevant third party and not by Smokeball', clause 24.3 records that those third parties may include Smokeball's related bodies corporate and that Smokeball may receive commissions, and clause 20 authorises Smokeball to provide Client Data to Interfacing Third Parties where the firm requests their services. The Intake page describes a form embedded on the firm's own website and consultation payment through billing inside Smokeball; the privacy policy states third-party payment processors collect and process payment data. No connector list for Intake is published.
Ask: Which third parties can an embedded Intake form or an Intake consultation payment send data to, and how do we restrict Intake to a named set?
Retrieval from outside the firm's data
Not confirmed
Nothing on the Intake feature page, the pricing page, the terms, the privacy policy or the security policy, all read 2026-09-27, states whether Intake or its form generator retrieves anything from the internet or from sources outside the firm's tenancy. The form library is described as 'tailored by jurisdiction and practice area' and the generator builds a form 'from a matter type and jurisdiction', without saying where that jurisdictional content comes from.
Ask: Does the Intake form generator retrieve anything from outside our tenancy, and what source supplies the jurisdiction-specific questions?
What Intake does without a person confirming it
Not confirmed
The feature page, read 2026-09-27, states that an enquiry 'instantly lands Smokeball', that 'Client information flows straight into Smokeball, eliminating manual entry', that 'Client documents autofill intake form fields and any follow-up forms come pre-filled from the lead or matter', that 'The moment a new lead comes in, the right team members are alerted', and that leads can 'schedule and pay for a consultation instantly'. Nothing published states whether a lead becomes a contact or matter record without a staff member confirming it, whether an autofilled value is flagged for checking, or whether a generated form can be published to clients without review.
Ask: Which Intake steps create or change records and take payments without a staff confirmation, and where is the audit record of each?
Review of generated forms and captured data
Public claim only
Terms clause 23.4, read 2026-09-27, states that the Services 'are not a substitute for legal or other professional skill, judgment and experience, and should only be used by or under the supervision of qualified legal practitioners', that notifications may not be accurate or up to date and are for the firm to validate or ignore, and that precedent documents are templates to be edited using the firm's own judgement. Nothing published requires that a generated intake form, or a form field autofilled from a client document, be reviewed by a person before it is used or relied on.
Ask: Is there a review or approval step before an AI-generated Intake form goes live to clients, and is an autofilled field marked as machine-derived for the reviewer?
