Ore LawOreLaw Privacy Policy
Effective date: 7 October 2026
1. Who we are
Solaris Systems Pty Ltd, trading as Solaris Software (ABN 22 687 040 213), operates OreLaw. In this policy, "we", "us" and "our" mean that company.
This policy covers the OreLaw website at https://platform.orelaw.ai, its public APIs, and its Model Context Protocol (MCP) service, including access through a ChatGPT plugin or another AI client. It explains how we handle personal information under applicable Australian privacy law, including the Privacy Act 1988 (Cth) where it applies.
Privacy contact: [email protected]
Postal contact: PO Box 1856, Malaga
2. Information we collect
We collect the following categories of information where relevant to your use of OreLaw:
- Request information: search terms, filters, record identifiers, MCP tool names and arguments, and other information you send to the service. Search terms can contain personal information, even where we do not ask for it.
- Technical and security information: IP addresses visible to our systems or service providers, request times, requested URLs, browser or client information, response status, performance information and error details. Logs may contain URL query parameters and information included in an error. For requests made through an AI client, the network address may identify that client's infrastructure rather than your device.
- Usage records: for each successful request, the time, the kind of action (for example, a tenement search or a decision view), whether it came through the website, the API, an integration or an AI client, a pseudonymous identifier, the country Cloudflare associates with the network address, and any AI-provider tokens and cost it used. The identifier is a keyed hash of a random website visitor ID, an integration's credential identifier, an anonymous user identifier supplied by ChatGPT, or otherwise the network address and browser or client information. Usage records do not contain search text, filters, record identifiers or network addresses.
- Correspondence: your name, email address and information you include when asking for support, reporting an error or making a privacy request.
- Integration administration: an application's name, credential identifier, hashed API key, and creation or revocation dates for separately authorised server-to-server integrations. The public MCP service does not require an OreLaw account or API key.
- Public-source records: information from Western Australian public registers, datasets, court listings and published decisions. This may include individual tenement holders' names, addresses where published in the source, parties' names, representatives and other personal information appearing in a public record.
- Legacy account information, if retained from an earlier version: names, email addresses, password hashes and account or session timestamps. Current public website and MCP access do not offer account registration or sign-in. Retention of any legacy information is addressed in section 7.
We obtain information directly from you, from the client you choose to use, from infrastructure that handles your requests, and from public-source publishers.
We do not ask you to provide confidential client files, legally privileged information, health information, payment card details, government identity documents, passwords or authentication secrets through MCP tools. Do not include these in your queries. A public record can still contain sensitive personal information; public availability does not remove applicable privacy obligations.
You may use the public service without providing your name or creating an account. We still need to process requests and limited technical information to deliver and protect the service. If you do not provide information needed for a particular request, we may be unable to fulfil it.
3. ChatGPT and other AI clients
When you use OreLaw through ChatGPT or another MCP client, that client sends selected tool arguments to our endpoint. Those arguments may include text taken from your conversation. We process what the client sends; the MCP service does not request or retrieve your full conversation history or your AI-provider account profile.
We return the requested records or results to the client so it can answer you. The client provider handles your conversations, tool calls and returned information under its own terms, privacy policy and account settings. Disconnecting OreLaw in that client stops future access through that connection; it does not automatically erase information already held by us or the client provider.
4. Why we use information
We use information to fulfil searches and return public records, measure how many people use OreLaw and which features they use, maintain the registry, troubleshoot faults, protect the service against misuse, administer authorised integrations, respond to enquiries and privacy requests, and meet legal obligations.
Hybrid decision search sends the search text to our configured embedding provider to produce a numerical representation used to find relevant decisions. Lexical search does not make that embedding-provider call. The information sent can include personal information if you put it in the search text. Where your AI client selects hybrid search, that transfer can occur as part of the tool call.
We also use external AI services to process published court decision text into search representations and research summaries. That source text may include personal information from the published decision.
We do not sell personal information or use MCP requests for targeted advertising or behavioural profiling. We do not use users' search text to train our own general-purpose AI models. External providers' handling of information depends on the relevant service, contract and settings, as described below.
5. Service providers and disclosures
We disclose information needed to provide the service to the following recipients:
| Recipient or service | Information and purpose |
|---|---|
| Cloudflare | Request and network information needed for delivery, security and abuse prevention. |
| Hosting and infrastructure administrators | Information needed to operate servers, databases, backups and support systems. |
| Our logging and monitoring systems | Operational and security information used to investigate faults and misuse. We use Coolify for deployment/container-log access and Grafana with Loki for central log access. These product names do not by themselves mean their vendors receive our logs. |
| AI processing providers | Search text for hybrid search; published court decision text for indexing and summaries. |
| Your chosen AI client provider, including OpenAI when you use ChatGPT | Tool responses and public-source information returned to fulfil your request. That provider also handles the tool arguments it sends. |
| Website resource providers | On relevant website pages, providers of maps, imagery and fonts receive browser requests, which can disclose IP address, browser information and requested resources. Current resources include OpenStreetMap, OpenFreeMap, Geoscience Australia, Fontshare and Google Fonts. This does not mean those providers receive MCP search arguments. |
| Professional advisers or public authorities | Information reasonably needed for legal advice, responding to lawful requests, protecting legal rights or meeting legal obligations. |
We limit disclosures to the relevant purpose. Where applicable law requires safeguards for a service-provider arrangement or overseas disclosure, we take the required steps.
6. Overseas handling
Third-party service providers and AI clients may process or store personal information outside Australia. We do not currently have a confirmed list of the countries where each provider processes or stores that information.
An Australian origin server does not mean every request, log, AI-processing operation or backup stays in Australia. Your chosen AI client may have additional overseas practices described in its privacy policy.
7. Storage, security and retention
We use reasonable safeguards appropriate to the information, including encrypted public connections, restricted administrative access and hashed storage of integration API keys. No online service can guarantee absolute security. If a breach triggers a legal notification obligation, we will notify the relevant people and authorities as required.
Our retention approach is:
| Information | Retention |
|---|---|
| MCP arguments and ordinary search requests | Processed to fulfil the request rather than maintained as an application conversation archive. Any copies in logs, support records or provider systems follow the relevant rows below. |
| Usage records | Retained while needed to understand use of the service over time, including comparing returning use across months. |
| Hybrid-search text and embeddings in the in-memory cache | Cached results become ineligible for reuse after 10 minutes. Entries may remain in memory until accessed and removed, capacity eviction or process restart. The cache is not a persistent search-history database. |
| Application, database, proxy, security and monitoring logs, including Coolify-accessible logs and Loki copies | Retained while needed to troubleshoot faults, protect the service, investigate misuse or meet legal obligations. |
| Support correspondence and privacy-request records | Retained while needed to handle enquiries, requests and complaints, and meet related legal obligations. |
| Integration administration records | Retained while needed to administer integration access, maintain revocation records, investigate misuse or meet legal obligations. |
| Legacy account/session information, if present | Any retained legacy records are subject to the general retention and deletion approach below. |
| Public-source records and derived research material | Maintained while needed to provide the research registry, subject to applicable law, source restrictions, corrections and periodic review. We assess correction or removal requests individually. |
| Backups | Copies may remain in protected backups until those backups expire. Restored information remains subject to this policy. |
| Information held by external AI and infrastructure providers | Subject to the provider's applicable terms and retention settings, which may differ from ours. |
We delete or de-identify personal information no longer needed for a permitted purpose, subject to applicable legal obligations. We may retain relevant records longer where reasonably necessary for a legal claim, investigation or legal retention requirement. We restrict use of those retained records to that purpose. Deleted information may remain in protected backups until those backups expire.
8. Browser storage and your choices
The website stores display preferences, including theme and sidebar settings, and a random visitor ID in your browser's local storage. The website sends the visitor ID with its requests so usage records can distinguish new from returning visitors; it is not linked to your name or used for advertising. You can remove these using your browser settings, after which the website creates a new visitor ID. Delivery or security providers may use essential cookies or similar technology to deliver and protect the service.
You can avoid sending confidential or identifying information in queries, select lexical rather than hybrid search where available, disconnect the plugin in your AI client, and request access, correction or deletion as described below. Where a client cannot offer a search-mode choice, use the website's lexical-search option or do not submit that query through the client.
These controls do not disable technical processing necessary to deliver and secure a request. Third-party resources load on relevant website pages; you can avoid those pages or block third-party requests in your browser, although some features may stop working.
9. Access, correction, deletion and complaints
Contact [email protected] to ask what personal information we hold about you, request access or correction, request deletion, or make a complaint. Identify the relevant record or approximate request time where possible. Do not send unnecessary identity documents or secrets. We may ask for proportionate information to verify that you are entitled to the requested information.
We aim to acknowledge requests within 7 business days and respond within 30 days. If more time is needed, we will explain why. Applicable statutory time limits take priority. Where we cannot grant a request, we will explain the reason and available review or complaint options, unless the law prevents us from doing so.
Deletion is subject to applicable law and legitimate retention needs. Anonymous requests may be difficult to locate. Disconnecting a plugin does not itself submit a deletion request to us. Requests concerning copies held by OpenAI or another independent provider should also be directed to that provider.
For public records, we can assess our copy and derived material but cannot amend the originating government or court record. A correction, suppression order or other legal restriction should be brought to our attention promptly. We may refer you to the original publisher as well as assessing what action we must take ourselves.
If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au or on 1300 363 992. The OAIC's jurisdiction depends on the circumstances and applicable law.
10. Changes
We will publish updates here with a revised effective date. For material changes to how we handle personal information, we will provide an appropriate notice and obtain consent where required. An update does not authorise an otherwise unlawful use of information already collected.