Question 1

Elf Works Pty Ltd - Terms and Conditions

Accepted Answer

Elf Works Pty Ltd - Terms and ConditionsLast Updated:1 August 2026These Terms and Conditions ("Terms") apply to your ("Customer" or "you") access to and use of the Elfworks.ai research platform and related services (collectively, the "Service") provided by Elf Works Pty Ltd (ABN 92 678 538 086) ("Elf Works", "we", "us", or "our").By clicking "I Agree" (or a similar button), creating an account, paying an invoice for the Service, or otherwise accessing or using the Service, you agree that these Terms become a legally binding agreement between you and Elf Works.If you are using the Service on behalf of an organisation or other legal entity (such as your accounting firm), you represent and warrant that you have the full right and authority to bind that entity to these Terms. In that case, "Customer" and "you" will refer to that entity.1. Definitions and Interpretation1.1. Definitions In this Agreement, the following terms have the meanings set out below:"ACL" means the Australian Consumer Law as set out in Schedule 2 of the Competition and Consumer Act 2010 (Cth)."AEST" means Australian Eastern Standard Time as observed in Queensland (UTC+10:00; no daylight saving)."Agreement" means these Terms and all documents and policies incorporated by reference as described in Clause 2.1."AI Product Terms" means the document at https://elfworks.ai/trustandlegal, which governs the specific use of AI-powered features."AUP" means the Acceptable Use Policy at ##Insert URL for Acceptable Use Policy (AUP)## , which details prohibited uses of the Service."Australian-hosted Provider" means a Provider that processes and stores Client Data solely on infrastructure located in Australia, as identified on the Vendor List."Authorised User" means a unique, named individual (such as an employee or partner of Customer) who is assigned a seat to use the Service."Availability Target" means monthly Service uptime of 99.5%, calculated as set out in clause 9.1."Business Day" means a day other than a Saturday, Sunday or public holiday in Queensland."Client Data" means Inputs and Outputs, including copies of, and data derived from, them."Confidential Information" means any non-public information disclosed by one party to the other, designated as confidential or which a reasonable person would understand to be confidential. It expressly includes Customer Inputs, but does not include information that: (a) is or becomes publicly known other than through a breach of this Agreement; (b) was already known to the recipient at the time of disclosure; (c) is independently developed by the recipient without reference to the discloser's Confidential Information; (d) is rightfully received from a third party without breach of any confidentiality obligation; or (e) is content the Customer or its Authorised Users intentionally make public, share with third parties."Customer" or "you" means the professional accounting firm, sole practitioner, or other legal entity agreeing to these Terms."De-identified Data" means data derived from Client Data from which information identifying, or reasonably capable of identifying, any individual or entity (including names, entity names, addresses, dates of birth, contact details, account identifiers, ABNs and TFN Information) has been removed by Elf Works within Australia."Effective Date" means the date this Agreement commences under clause 14.1."Government Related Identifiers" or "GRIs" means "government related identifiers" as defined in the Privacy Act 1988 (Cth), and includes Tax File Numbers, Medicare numbers, driver licence numbers, and passport numbers."Frontier Provider" means a Provider located outside Australia that receives only De-identified Data, as identified on the Vendor List."Inputs" means any data, documents, files, or prompts you or your Authorised Users upload or submit to the Service."Outputs" means the draft research, text, and other content generated by the Service in response to Inputs."Providers" means the third-party infrastructure and Large Language Model providers identified on the Vendor List."Security Incident" means any unauthorised access to, or unauthorised use, modification, loss or disclosure of, Client Data or personal information held by Elf Works."Sensitive Information" means sensitive information as defined in the Privacy Act 1988 (Cth)."Service" means the Elfworks.ai research platform and related services provided by Elf Works."Subscription Page" means the webpage at https://elfworks.ai/pricing, which details plans, features, and pricing."Subscription Term" means the duration of your paid subscription (e.g., monthly or annually), including any renewals."Terms" means these Terms and Conditions."TFN Information" means tax file number information as defined in the Privacy Act 1988 (Cth)."Trust and Security Page" means the informational page at https://elfworks.ai/trustandlegal describing current security practices."Vendor List" means the webpage at https://elfworks.ai/trustandlegal , which identifies our key third-party subprocessors.1.2. Interpretation In this Agreement: (a) Headings are for convenience only and do not affect interpretation. (b) The singular includes the plural and vice versa. (c) The word "including" or "includes" means "including, without limitation". (d) A reference to a party includes its successors and permitted assigns. (e) A reference to "$" or "dollars" is to Australian dollars (AUD).2. The Agreement and Incorporated DocumentsThese Terms, together with the documents and policies incorporated by reference, form the entire Agreement between Customer and Elf Works.2.1. Incorporated Documents. The Agreement includes the following, all of which are incorporated by reference: a) These Terms; b) The AI Product Terms; c) The AUP; d) The Subscription Page; and e) The Vendor List. Each incorporated document applies as published on the Effective Date. Updated versions take effect only under clause 13.2. The Privacy Policy is a notice describing how we handle personal information and is not an incorporated contractual document; the commitments in clauses 6.3, 6.4 and 10 operate as contractual terms.2.2. Order of Precedence. To the extent of any direct conflict: (a) these Terms; (b) the AI Product Terms (for AI-specific features only); (c) the AUP; (d) the Subscription Page; (e) the Vendor List.2.3. Unfair Terms. Where the Australian Consumer Law unfair contract terms regime applies, nothing in these Terms is intended to, or will, operate as an unfair term. These Terms are to be read to avoid any unfairness.3. Eligibility and Account Management3.1. Professional Business Use Only. The Service is a business-to-business platform. You represent and warrant that you are a professional accounting firm or sole practitioner in public practice, and that you will use the Service solely for your internal business purposes and not for any personal, consumer, or household purpose.3.2. No Minors. The Service is not intended for and must not be used by any person under the age of 18.3.3. Account Registration. You must provide accurate, current, and complete information when registering an account and must keep this information up-to-date.3.4. Account Security. You are responsible for safeguarding the confidentiality of all account credentials (such as passwords) for your account and for any and all activity that occurs under it. You must notify Elf Works immediately at legal@elfworks.ai of any unauthorised use of your account.3.5. Seats and Authorised Users. Subscriptions are granted on a per-user, or "seat," basis. Each seat must be assigned to a unique, named Authorised User. Account sharing by or between individuals is strictly prohibited, except that you may temporarily reassign a seat for: (a) brief training of a new Authorised User (not to exceed 5 Business Days); (b) handover between an outgoing and incoming Authorised User (not to exceed 10 Business Days); or (c) coverage during an Authorised User's leave, provided you notify us in advance. Seats may be permanently reassigned to new Authorised Users who replace former Authorised Users who no longer require access.3.6. Customer Responsibility for Users. You are responsible for ensuring all your Authorised Users comply with this Agreement (including the AUP and AI Product Terms). Any breach of this Agreement by an Authorised User will be deemed a breach by you.4. Licence Grant and Restrictions4.1. Licence to Use the Service. Subject to your ongoing compliance with this Agreement and payment of all applicable fees, Elf Works grants you a limited, non-exclusive, non-transferable (except for seat reassignment as permitted in Section 3.5), and revocable for cause under clause 14 licence for your Authorised Users to access and use the Service during the Subscription Term, solely for your internal business purposes as permitted by this Agreement.4.2. Restrictions on Use. You shall not, and shall ensure your Authorised Users do not, directly or indirectly: a) Permit any third party (other than Authorised Users) to access or use the Service; b) Sell, resell, rent, lease, sublicense, distribute, or otherwise make the Service available to any third party; c) Decompile, reverse engineer, scrape, disassemble, or attempt to discover the source code, proprietary prompts, orchestration logic, or technical architecture of the Service; d) Use the Service to store or transmit any virus, worm, or other malicious code; e) Circumvent or attempt to circumvent any security controls, rate limits, or usage restrictions; f) Use the Service for public benchmarking or publication of performance results without our prior written consent; g) Remove or obscure any proprietary notices or labels from the Service; or h) Use the Service in a manner that violates the AUP or Australian law in connection with your use of the Service, including the Tax Agent Services Act 2009 (Cth), Privacy Act 1988 (Cth) and Copyright Act 1968 (Cth); i) Include any Government Related Identifiers (GRIs), including TFN Information, in Inputs except where: (A) it is reasonably necessary for the specific tax-related task being performed; (B) you lawfully hold that information; and (C) you are permitted by law to disclose it to us for that task. You warrant that each Input containing GRIs meets these conditions.5. PROFESSIONAL USE AND SERVICE QUALITY5.1. Nature of Service — Research Tools, Not Professional Advice (a) The Service is a professional research tool that uses artificial intelligence to analyse Australian tax legislation, Australian Taxation Office materials and related sources to generate draft research and analysis (Outputs). (b) Outputs are draft materials requiring your independent professional review, verification and adaptation to your client’s circumstances before use. (c) The Service does not provide tax, legal, financial or accounting advice. You remain solely responsible for any advice you provide to clients. (d) You must not provide Outputs directly to clients without professional verification and adaptation.5.2. Verification Obligations You must independently verify that: (i) legislative and regulatory references are current and correctly cited; (ii) analysis is consistent with current ATO guidance and any binding rulings; (iii) the content is appropriate for the specific facts; and (iv) your professional judgment supports any reliance.5.3. Service Quality Warranties Elf Works warrants that it will provide the Service with due care and skill, keep source materials reasonably current on a commercially reasonable update cycle, and operate the Service substantially in accordance with published specifications. Elf Works does not warrant that any particular Output will be error-free or suitable for a particular client matter without your verification.5.4. Statutory Guarantees (Australian Consumer Law) Nothing in these Terms excludes, restricts or modifies any non-excludable rights you have under the Australian Consumer Law (ACL), including guarantees that services will be supplied with due care and skill, be fit for a disclosed purpose, and supplied within a reasonable time. Where permitted by the ACL, our liability for a failure to comply with a guarantee is limited to resupplying the services or paying the cost of resupply.5.5. Your Professional Advice To the maximum extent permitted by law, Elf Works is not liable for your professional advice to clients or your failure to verify Outputs.6. Customer Content and Data6.1. Ownership of Inputs. As between you and Elf Works, you retain all right, title, and interest in and to all Inputs.6.2. Ownership of Outputs. As between you and Elf Works, you own the Outputs generated by your use of the Service, subject to any pre-existing intellectual property rights in the underlying data sources (e.g., public domain legislation, ATO publications) or the rights of third parties.6.3. Licence to Elf Works. We process Inputs and Outputs solely as necessary to provide, secure and support the Service, in accordance with our Privacy Policy. Client Data is processed and stored on infrastructure located in Australia (including backups and logs), except that De-identified Data may be transmitted to and processed by Frontier Providers as described in the AI Product Terms. Personal information in Inputs may be disclosed to Australian-hosted Providers to deliver the Service. Frontier Providers receive only De-identified Data; we do not transmit Client Data in identified form outside Australia. The AI Product Terms describe this processing in further detail.6.4. No Training by Default. We will not use your Inputs or Outputs to train or improve our AI models or those of our Providers, except with your express, opt-in consent, and we will contractually require Providers used for inference or hosting of your data to comply with this same restriction.6.5. Filtering. We implement automated systems to detect GRIs and other identifying information in Inputs, including as part of the de-identification process described in the AI Product Terms, and we may block or redact content submitted in breach of this Agreement. You acknowledge that such filters are a secondary control and do not absolve you of your obligations in Clause 4.2(i). We may reject or delete any Input that violates these Terms.7. Third-Party Services and Providers7.1. Use of Providers. The Service integrates with and relies on third-party Providers to function. Our current Providers, their roles, and their data processing locations are identified on the Vendor List. The Vendor List states, for each Provider, whether it is an Australian-hosted Provider (which may receive Client Data) or a Frontier Provider (which receives only De-identified Data).7.2. Changes to Providers. We will provide at least 30 days’ prior notice (by email or in-product) if a change to our Providers materially increases the types of personal information shared, introduces a new processing country for your data, or materially reduces your privacy protections. If you reasonably object to such a change, you may terminate the affected subscription before the change takes effect and receive a pro-rata refund of any prepaid, unused fees for that subscription.8. Subscriptions, Fees, and Payment8.1. Subscription Plans. The Service is provided on a subscription basis. Your specific plan, features, and fees are set out on the Subscription Page or in a separate ordering document.8.2. Free Trial. We may offer a 14-day free trial. If you do not cancel before the trial period ends, your subscription will automatically convert to a paid monthly plan, and you authorise us to charge your payment method.8.3. Billing and Payment. You agree to pay all fees in Australian Dollars (AUD). Fees are exclusive of GST unless stated otherwise; you must pay applicable GST. You authorise us to charge your nominated payment method (e.g., credit card) for all fees as they become due.8.4. Auto-Renewal. Subscriptions automatically renew for a new Subscription Term equal to the preceding term (e.g., monthly or annually) unless you cancel your subscription in your account settings before the renewal date.8.5. Price Changes. We reserve the right to change our pricing. We will provide you with at least 30 days’ notice (by email or in-product) before any price change takes effect. New pricing applies at your next renewal. If you do not agree, you may cancel before renewal; any prepaid amounts for periods after the change will be refunded pro-rata.8.6. Late Payment. If we are unable to charge your payment method, we will notify you. If fees remain unpaid for 10 Business Days after the due date, we may suspend your access to the Service until payment is made.8.7. Refunds. All fees are non-refundable except: a) As required by the ACL (see Section 5.4); or b) Where expressly stated in this Agreement (e.g., Sections 8.5, 14.3(b), or 14.6).8.8. Plan Changes. Upgrades take effect immediately and will be pro-rated for the remainder of the current term. Downgrades take effect at the beginning of the next renewal term.9. Service Levels and Support9.1. Availability. We will use commercially reasonable efforts to ensure the Service has a monthly uptime of 99.5% ("Availability Target"). This excludes downtime from: (a) scheduled maintenance, (b) emergency maintenance, (c) failures of your equipment or internet connection, (d) failures of our third-party Providers, or (e) force majeure events.9.2. Maintenance. We will provide at least 24 hours’ notice for scheduled maintenance and will endeavour to conduct it during off-peak (Australia/Brisbane) hours.9.3. Support. Standard support is available via web or email during 9:00–17:00 AEST, Monday to Friday, excluding Queensland public holidays. We will use commercially reasonable efforts to meet the response targets specified on our Subscription Page.9.4. Service Level Remedy. If we fail to meet the Availability Target in a month, we will use commercially reasonable efforts to correct the issue and prevent recurrence. This clause does not limit any non-excludable rights or remedies at law.10. Confidentiality and Security10.1. Protection Obligation. The receiving party (the "Recipient") will protect the disclosing party's (the "Discloser") Confidential Information using at least reasonable care. The Recipient will not use or disclose Confidential Information except as expressly permitted in this Agreement.10.2. Permitted Use and Disclosure. We will use and process your Confidential Information (including Inputs and Outputs) solely as necessary to provide, secure, and support the Service. We may disclose your Confidential Information: (a) To our employees, directors, and contractors who have a need to know and are bound by confidentiality obligations at least as protective as these Terms. (b) To our Providers (as listed on the Vendor List) solely to deliver or support the Service, in identified form only to Australian-hosted Providers and only as De-identified Data to Frontier Providers, provided we have a contract with them that includes no-less-protective confidentiality duties. We remain responsible for our contractual obligations in respect of such disclosure.10.3. Compelled Disclosure. If the Recipient is required by law, court order, or governmental authority to disclose Confidential Information, it will (if legally permitted) provide the Discloser with prompt written notice and reasonable assistance to contest or limit the disclosure.10.4. Term and Deletion. These confidentiality obligations apply during the Term and survive for three (3) years after termination. Obligations concerning Confidential Information that constitutes a trade secret will survive as long as it remains a trade secret under applicable law. Upon your written request following termination, we will delete your Confidential Information, subject to our standard data retention policies (e.g., for backups) and any legal or regulatory retention requirements.10.5. Security. We implement and maintain technical and organisational security measures designed to protect your Inputs and personal information from unauthorised access, use, or disclosure. You can find more information on our Trust and Security Page (##Insert URL for Trust and Security Page##). The Trust and Security Page is informational only and not a contractual commitment unless expressly stated in these Terms.10.6. Security Incident. If we become aware of a confirmed Security Incident affecting your account or your Client Data, we will notify you without undue delay. We will provide information reasonably necessary for you to meet your legal compliance obligations. Any additional cooperation or assistance you request beyond our legal obligations will be at your reasonable cost, except to the extent the Security Incident was caused by Elf Works or its Providers.11. Limitation of Liability and Exclusions11.1. Liability Cap. To the maximum extent permitted by law and subject to Section 11.3 (ACL Preservation), our aggregate liability for all claims arising out of or related to this Agreement (whether in contract, tort, negligence, or otherwise) is capped at the fees you paid to us for the Service in the six (6) months before the event giving rise to liability.11.2. Exclusion of Indirect Loss. To the maximum extent permitted by law, in no event will Elf Works, its affiliates, or its Providers be liable for any indirect, consequential, special, incidental, exemplary, or punitive loss, or for any loss of profits, loss of data, loss of business, business interruption, or loss of goodwill, arising out of or in connection with your use of or inability to use the Service, even if advised of the possibility of such loss.11.3. ACL Preservation. Nothing in this Agreement (including this Clause 11) is intended to exclude, restrict, or modify any non-excludable right or remedy you have under the ACL.11.4. Carve-Outs. The limitations and exclusions in Clause 11.1 do not apply to: (a) your liability under Clause 12 (Indemnification by Customer); (b) liability arising from your breach of Clause 4.2 (Restrictions on Use), other than an unintentional breach of Clause 4.2(i); (c) Liability that cannot be excluded or limited by law; (d) death or personal injury caused by our negligence; or (e) fraud or wilful misconduct.11.5. Disclaimer of Responsibility. Subject to clauses 5.3, 5.4 and 11.3, Elf Works is not responsible for, and assumes no liability for, the contents of Customer Inputs or Outputs.12. Indemnification by CustomerTo the extent permitted by law, you agree to defend, indemnify, and hold harmless Elf Works, its affiliates, officers, directors, employees, agents, and Providers from and against any and all third-party claims, demands, proceedings, costs, damages, losses, liabilities, and expenses (including reasonable legal fees and costs) arising out of or related to:(a) Professional Use. To the extent permitted by law, you indemnify us to the extent loss is caused by (i) your failure to verify Outputs before client use; or (ii) your breach of professional standards. This indemnity is subject to any proportionate-liability law that applies and does not exclude apportionment required by that law. (b) Breach of Use. Your (or your Authorised Users') breach of the AUP, breach of the restrictions in Clause 4.2, or violation of any applicable law. (c) Customer Inputs. Any claim that your Inputs infringe or misappropriate the intellectual property or privacy rights of a third party. (d) Government Identifiers. Any claim, penalty, or regulatory action arising from your (or your Authorised Users') breach of Clause 4.2(i), including uploading TFN Information that you do not lawfully hold or that is not reasonably necessary for the task. This indemnity does not apply to the extent that a claim, penalty or action arises from Elf Works’ failure to handle TFN Information in accordance with the Privacy (Tax File Number) Rule 2015.This clause 12 does not apply to the extent that a claim, penalty, loss or expense arises from Elf Works’ breach of this Agreement, Elf Works’ negligence, or Elf Works’ failure to comply with privacy law (including the Privacy (Tax File Number) Rule 2015). We will give you prompt written notice of any claim for which we seek indemnity. You may control the defence and settlement of that claim, provided any settlement fully releases Elf Works and includes no admission by Elf Works without its consent, and we will provide reasonable cooperation at your cost.13. Changes to Service and Terms13.1. Changes to Service. We may enhance, modify, or deprecate features of the Service from time to time. We will not make changes during a Subscription Term that materially reduce the core functionality of your plan. If a change inadvertently has that effect, you may terminate the affected subscription and we will refund any prepaid, unused fees pro-rata.13.2. Changes to Terms. We may modify these Terms. For changes that, in our reasonable opinion, materially reduce your rights or increase your obligations, we will provide at least 30 days’ prior notice by email or in-product. If you do not agree to the changes, you may terminate your subscription before the effective date and receive a pro-rata refund of any prepaid, unused fees. Changes to any incorporated document (including the AI Product Terms, AUP, Subscription Page or Vendor List) are treated as changes to these Terms and notified under this clause.13.3. Immediate Changes. We may make changes required for security, legal, or regulatory compliance reasons with immediate effect, and we will notify you as soon as practicable. Your continued use of the Service after any change constitutes your acceptance. If an urgent change materially reduces the core functionality of your plan or materially diminishes your rights under this Agreement, you may terminate the affected subscription within 30 days of our notice and we will refund any prepaid, unused fees pro-rata.14. Term, Termination, and Suspension14.1. Term. This Agreement commences when you first accept it and continues until your Subscription Term expires or is terminated (the "Term").14.2. Termination for Convenience. You may terminate your subscription at any time by cancelling in your account settings. Termination will take effect at the end of your current paid Subscription Term. You will not be entitled to any refund or credit for fees already paid, and any outstanding fees for the current Subscription Term remain due.14.3. Termination for Cause. (a) Either party may terminate this Agreement for cause if the other party commits a material breach and fails to cure that breach within 30 Business Days of receiving written notice (or within 10 Business Days for a breach of your payment obligations). (b) If this Agreement is terminated by you for our uncured material breach, we will provide a pro-rata refund of any prepaid, unused fees for the period remaining in your Subscription Term. (c) If this Agreement is terminated by us for your uncured material breach, you will not receive any refund, and all outstanding fees for the remainder of your Subscription Term will become immediately due and payable.14.4. Suspension. (a) We may suspend access immediately, with notice, where we reasonably determine that your (or an Authorised User’s) use of the Service: (i) is unlawful, fraudulent or presents a material security risk to the Service or other users; (ii) materially breaches the AUP or the restrictions in cl 4.2; or (iii) is 10 Business Days overdue under cl 8.6. (b) For breaches under 14.4(a)(ii) that do not present an immediate security or legal risk, we will first give written notice and 5 Business Days to cure before suspension. (c) We will use commercially reasonable efforts to restore access promptly once the issue is remedied. If a suspension is made in error or persists more than 5 consecutive Business Days after you remedy the issue, we will issue a pro-rata credit for the suspended period. (d) Fees will not accrue during any period of suspension that is (i) due to our error or (ii) exceeds 5 consecutive Business Days after you have cured the underlying issue.14.5. Data Exit. Following termination or expiration, you will have a 30-day window to export your Inputs and Outputs using the Service's features. After this 30-day window, we will delete your data from active systems within [30] days, and your data will be deleted or overwritten in backups and logs in the ordinary course within [90] days after deletion from active systems, subject to any legal or regulatory retention requirements.14.6. Discontinuation of Service. We reserve the right to discontinue the Service (or any material part of it) by providing you with at least 30 days' prior written notice. In such an event, we will provide you with a pro-rata refund of any prepaid, unused fees for the period remaining in your Subscription Term.15. Dispute Resolution15.1. Before court or arbitration proceedings other than for urgent interlocutory relief may be commenced, the following steps must be taken to attempt to resolve any dispute that arises out of or in connection with this contract (including any dispute as to the validity, breach or termination of the contract, or as to any claim in tort, in equity or pursuant to any statute).15.2. Notice (the notice of dispute) must be given in writing by the party claiming that a dispute has arisen to the other party (or parties) to this contract specifying the nature of the dispute.15.3. Upon receipt of the notice of dispute, the parties must attempt to agree upon an appropriate procedure for resolving the dispute.15.4. If within 10 business days of receipt of the notice of dispute the dispute is not resolved or an appropriate alternative dispute resolution process is not agreed, then the parties shall refer the dispute to Resolution Institute, for facilitation of a mediation in accordance with Resolution Institute's Mediation Rules.15.5. The parties must co-operate with Resolution Institute as facilitator.15.6. If within 10 business days after referral of the dispute to Resolution Institute the parties have not agreed upon the mediator or other relevant particular the mediator and any other relevant particular will be determined in accordance with Resolution Institute’s Mediation Rules.15.7. This clause will remain operative after the contract has been performed and notwithstanding its termination.16. General Provisions16.1. Governing Law and Venue. This Agreement is governed by the laws of Queensland, Australia. The parties irrevocably submit to the exclusive jurisdiction of the courts of Queensland and any courts which may hear appeals from those courts.16.2. Notices. We will send notices to you by email to your account's registered email address or via in-product notifications. You must send all legal notices to us in writing to the addresses stated in clause 16.11.16.3. Assignment. You may not assign this Agreement without our prior written consent. We may assign this Agreement to an affiliate or in connection with a merger, acquisition, or sale of all or substantially all of our assets, provided we give you written notice.16.4. Entire Agreement. This Agreement (including all incorporated documents) constitutes the entire agreement between the parties regarding its subject matter and supersedes all prior communications, representations, or agreements.16.5. Severability. If any provision of this Agreement is found to be void, invalid, or unenforceable, it will be severed to the minimum extent necessary, and the remaining provisions will remain in full force and effect.16.6. Waiver. A failure by either party to enforce a provision is not a waiver of its right to do so later.16.7. Force Majeure. Neither party will be liable for any delay or failure to perform its obligations under this Agreement (other than payment obligations) if the delay or failure is due to an event beyond its reasonable control. The affected party must notify the other promptly and use reasonable efforts to mitigate the event's impact.16.8. Subcontracting. We may use subcontractors (including Providers) to perform the Service. We remain responsible for the performance of our contractual obligations under this Agreement that are performed by our subcontractors.16.9. No Set-off. All fees are payable in full without any set-off, counterclaim, or deduction, except as required by law.16.10. Survival. Clauses 5 (Professional Use), 6 (Content/Data), 10 (Confidentiality), 11 (Liability), 12 (Indemnification), 14.5 (Data Exit), 15 (Dispute Resolution), and 16 (General) will survive any termination or expiration of this Agreement.16.11. Contact Information.Legal Notices: legal@elfworks.aiPrivacy Requests: privacy@elfworks.aiRegistered Address: Elf Works Pty Ltd 268 Long Road Tamborine Mountain QLD 4272 Australia

Question 2

Elf Works Pty Ltd - AI Product Terms

Accepted Answer

Elf Works Pty Ltd – AI Product Terms Last Updated: 10 August 2026Contracting Entity: Elf Works Pty Ltd (ABN 92 678 538 086) 1. Scope and relationship to other terms These AI Product Terms (AI Terms) apply to your use of AI-powered features in the Elfworks.ai platform (AI Features). They supplement the Elf Works Terms and Conditions (T&Cs). The Privacy Policy separately describes how we handle personal information. Capitalised terms used but not defined here have the meaning given in the T&Cs or Privacy Policy. If there is any direct conflict regarding AI Features, apply the order of precedence in the T&Cs. 2. AI-specific definitionsInput: data, prompts, instructions, files or other content you or your Authorised Users submit to AI Features.Output: results returned by AI Features in response to an Input (e.g., text, analysis, transformations).Providers: third-party infrastructure, model or tooling vendors we use to deliver AI Features (as identified in our vendor/sub-processor disclosures).Feedback means suggestions, comments, bug reports or ideas you provide about AI Features or the Service’s performance or user experience, excluding Inputs, Outputs and Personal Information. 3. Ownership and licence to operate the Service As between you and Elf Works, you retain ownership of Inputs and Outputs to the extent permitted by law. You grant Elf Works a non-exclusive licence to host, process, transmit, cache and display Inputs and Outputs solely to provide, secure and support the Service, apply safety/abuse detection, and comply with law, consistent with the T&Cs and Privacy Policy. 4. No-training-by-default Elf Works does not use your Inputs or Outputs to train or improve Elf Works’ models or our Providers’ models unless you separately opt in. Opt-in is not a condition of using the Service. We contractually require Providers engaged for AI Features not to use your Inputs/Outputs for model training, except to the extent expressly authorised by an opt-in permitted under this clause. Any opt-in extends only to data from which personal information and TFN Information have been removed, unless the individuals concerned have given the consents the Privacy Act requires. An opt-in never authorises use of TFN Information for training. 5. Sovereign processing and cross-border handling (APP 8) (a) Client Data (Inputs and Outputs, including any personal information they contain) is processed and stored on infrastructure located in Australia, including backups and logs, except that De-identified Data may be transmitted to Frontier Providers under paragraph (c).(b) Routine tasks are processed end-to-end on models hosted in Australia. No Client Data relating to those tasks is transmitted outside Australia.(c) Where a task requires additional reasoning capability, we first detect and remove identifying information (including names, entity names, addresses, dates of birth, contact details, account identifiers, ABNs and TFN Information) within Australia, transmit only the resulting De-identified Data to a Frontier Provider, and re-insert the identifying details within Australia on return. We do not transmit Client Data in identified form to any Frontier Provider. Our de-identification systems are designed, tested and monitored to remove identifying information before transmission.(d) The Vendor List identifies each Provider, its role, its processing location, and whether it receives Client Data (Australian-hosted Providers) or only De-identified Data (Frontier Providers).(e) We will give notice consistent with the T&Cs and Privacy Policy before materially changing Providers or processing locations; your termination and export rights remain as set out in those documents.(f) Capitalised terms in this clause have the meanings given in the T&Cs. 6. Professional use; human-in-the-loop Outputs can be incomplete, incorrect or out-of-date. They are decision-support, not advice. You must apply professional judgment and verify Outputs before any reliance in accounting, tax, legal, financial or compliance contexts. You are responsible for how you and your Authorised Users use Outputs. 7. Sensitive information and government identifiers (APP 9) Do not include Sensitive Information or government-related identifiers (including TFN Information) in Inputs unless reasonably necessary for the specific tax-related task, lawfully held by you, and lawfully permitted to be disclosed to us (see clause 4.2(i) of the T&Cs). We handle TFN Information in accordance with the Privacy (Tax File Number) Rule 2015, including removing tax file numbers within Australia before any transmission to a Frontier Provider. Elf Works does not adopt or use government-related identifiers as its own except as permitted by law. See the Privacy Policy for details. 8. Your responsibilities You represent and warrant that you have all rights and consents to submit Inputs (including any third-party Personal Information) and to receive/process Outputs, and that your use of AI Features will comply with law, the Privacy Policy and the Acceptable Use Policy (AUP). You must obtain each client’s permission before entering that client’s information into the Service, as required by the Tax Practitioners Board’s guidance on the use of artificial intelligence (TPB(GS) 55/2026), and you are responsible for giving any collection notices to your clients that APP 5 of the Privacy Act requires in respect of information you submit. 9. Prohibited uses (AI-specific) In addition to the AUP, you must not use AI Features to:a) mislead others that AI-generated content is wholly human-generated;b) create or disseminate malware, exploits, spam or deceptive content (including deepfakes) or content that infringes others’ rights;c) engage in unlawful discrimination, harassment or threats;d) rely on Outputs to create legally binding obligations or to provide medical, legal or financial advice without appropriate human review; ore) deploy fully automated decisions that produce legal or similarly significant effects on individuals without required human review and notices. 10. Safety, moderation and usage limits We may apply rate limits, quotas, model caps and safety filters. We may restrict or suspend AI Features if we reasonably believe there is a breach of these AI Terms, the AUP, the T&Cs or law, or to protect users, third parties or the Service. Suspension/termination follow the T&Cs. 11. Attribution Where reasonably practicable or required by law or policy, disclose that content is AI-assisted when publishing externally. You are solely responsible for any published content. 12. Accuracy, non-reliance and disclaimers AI Features and Outputs are provided “as is” and may contain errors. Elf Works does not guarantee the accuracy, completeness or fitness of any Output. Obtain independent professional advice before relying on Outputs. Nothing excludes non-excludable consumer guarantees. 13. Feedback By providing Feedback, you grant Elf Works a non-exclusive, worldwide, perpetual, irrevocable, transferable and sub-licensable, royalty-free licence to use, reproduce and create derivative works of the Feedback solely to operate, analyse, support and improve the Service and AI Features. This licence does not authorise the use of your Inputs or Outputs for model training except as permitted under clause 4 (opt-in). 14. Changes, suspension and termination Changes to these AI Terms, and any suspension/termination rights and post-termination data handling, are governed by the T&Cs and Privacy Policy (including any export windows). 15. Liability and indemnities The liability exclusions, limitations, caps and indemnities in the Terms and Conditions apply to your use of the AI Features and any Outputs. For clarity, references to “the Service” in those clauses include the AI Features and Outputs. Nothing in these AI Terms limits any non-excludable rights under the Australian Consumer Law.

Question 3

Elf Work Pty Ltd - Privacy Policy

Accepted Answer

Elf Works Pty Ltd Privacy PolicyLast Updated: 1 November 2025IntroductionWelcome to Elf Works. This Privacy Policy outlines how Elf Works Pty Ltd (ABN 92 678 538 086) ("Elf Works", "we", "us", or "our") collects, uses, discloses, and protects Personal Information.This policy applies to "Customers" (the entity agreeing to our Terms) and their "Authorised Users" (collectively, "you") who access or use the Elfworks.ai research platform and related services (the "Service"). This policy also describes how we handle personal information about other individuals, including our Customers’ clients whose information is contained in Inputs or Outputs. Where the context permits, the rights and processes in this policy are available to any individual whose personal information we hold.This Privacy Policy explains how we handle personal information. It is not part of our Terms and Conditions ("Terms"). By using the Service, you agree to the processing of your Personal Information as described in this policy.We also use or reference other documents from our Terms, including the AI Product Terms, Acceptable Use Policy (AUP), Subscription Page, and Vendor List.Summary: This is our Privacy Policy. It explains what information we collect, how we use and share it, and your rights as a user. By using our Service, you agree to this policy.1. What Personal Information We Collect"Personal Information" has the same meaning as in the Privacy Act: information or an opinion about an identified individual, or an individual who is reasonably identifiable.We collect Personal Information in the following ways:(a) Information You Provide Directly When you register for an account, update your profile, or communicate with us (e.g., for billing or support), you provide us with Personal Information, which may include:Account Information: Your name, email address, and professional details (such as your accounting firm's name).Billing Information: Payment details, which are processed by our third-party payment vendor.Communications: Any information you provide when you contact us for support or legal enquiries.(b) Information You Provide via the Service (Inputs) Our Service is designed to process information you and your Authorised Users submit to it ("Inputs"). These Inputs (such as prompts or uploaded documents) may contain Personal Information about you, your clients, or other third parties. Outputs generated from your Inputs may also contain Personal Information, including AI-generated content about an identifiable individual; we handle Personal Information in Outputs in the same way as Personal Information in Inputs. Because client information reaches us indirectly through your firm’s uploads, your firm is responsible for giving its clients any notice that APP 5 requires, and for obtaining any permission required by Tax Practitioners Board guidance, before submitting their information.We process this Personal Information solely to provide the Service to you (e.g., to generate "Outputs").You are responsible for ensuring you have the necessary rights and consents to provide any Personal Information contained within your Inputs.(c) Information We Collect Automatically (Usage Data) When you use the Service, we automatically collect technical and usage data to ensure the Service is functioning securely and correctly. This may include:Log Data: Your Internet Protocol (IP) address, browser type, and settings.Usage Analytics: Information about how you interact with the Service, such as features used, clicks, and session times. This information is typically collected in an aggregated and anonymised form.Cookies: We use essential cookies to maintain your session, secure your account, and remember your preferences. We do not use cookies for cross-contextual advertising.(d) Anonymity and Pseudonymity (APP 2) Individuals must typically identify themselves to use the Service. Given the nature of our Service (a paid, professional B2B platform requiring secure account registration), it is impracticable for us to deal with individuals who wish to act anonymously or under a pseudonym.(e) Unsolicited Information (APP 4) If we receive unsolicited personal information, we promptly assess it and, if we could not have collected it, we destroy or de-identify it as soon as practicable (unless a legal retention obligation applies).Summary (APP 5 Notification) We collect personal information directly from you (e.g., account sign-up, support) and indirectly through your uploads/Inputs, which may include third-party personal information. If you do not provide certain information (such as account or billing details), we may be unable to create your account, provide paid features, or respond to requests. Client Data (your Inputs and Outputs) is processed and stored in Australia. Providers located in Australia may handle identified Client Data to run the Service; Providers located outside Australia receive only de-identified data with client-identifying details removed. Billing information is processed by our payment Provider, which is located outside Australia (see the Vendor List for countries). See "Your Rights and How to Make a Complaint" below for how to exercise your rights.2. How We Use Your Personal Information (Purpose)We only use your Personal Information for the purposes for which it was collected (the "primary purpose") or as otherwise permitted by law.Our primary purposes for using your Personal Information are:To Provide and Maintain the Service: To operate the Elfworks.ai platform, authenticate Authorised Users, process your Inputs to generate Outputs, manage your subscription, and process payments.To Support and Communicate with You: To respond to your support requests and send you essential Service-related communications (e.g., security alerts, billing notifications, or updates to our Terms).To Improve the Service: To analyse aggregated and anonymised Usage Data (which does not include your Inputs) to understand usage trends, improve service functionality, and enhance security.To Ensure Safety and Compliance: To monitor for and prevent breaches of our AUP, enforce our Terms, and protect the security and integrity of the Service.To Comply with Legal Obligations: To meet our obligations under Australian law.For Direct Marketing (APP 7): We may use your Account Information (e.g., your email address) to send you communications about new features or subscription plans that we believe may be of interest to you. You may opt out of these communications at any time by using the "unsubscribe" link in the email. We will not use any Personal Information within your Inputs for marketing.Summary: We use your information to run the Service, bill you, support you, and improve our platform. We may send you marketing emails, which you can opt-out of. We never use the content of your Inputs for marketing.3. Our "No Training by Default" AI PolicyThis is a core commitment of our Service and is a condition of our Terms (Clause 6.4).We will not use your Inputs or Outputs to train or improve our AI models or the AI models of our third-party Providers.The only exception to this rule is if you provide your express, opt-in consent for us to use your data for this purpose. This is not a condition of using the Service. Any opt-in extends only to data from which client-identifying details and tax file numbers have been removed, unless the individuals concerned have given the consents the Privacy Act requires.Summary: We will never use your private data (Inputs or Outputs) to train AI models unless you explicitly and separately give us permission to do so.4. Where Your Data Is Processed: Our Two Processing PathsThe Service routes each task down one of two paths:Path A: Australian processing (default). Routine and structured tasks are processed end-to-end on language models hosted in Australia. No Client Data relating to the task is transmitted outside Australia.Path B: De-identified frontier processing. Where a task requires additional reasoning capability, we first detect and remove client-identifying information (names, entity names, addresses, dates of birth, contact details, account identifiers, ABNs and tax file numbers) on models hosted in Australia; send only the de-identified request to an overseas frontier model Provider; and re-insert the client details within Australia when the response returns. The overseas Provider receives the shape of the question, stripped of who it is about.Summary: Your clients’ identifying details are removed in Australia before any overseas processing and re-inserted in Australia afterwards. All storage, backups and logs of Client Data remain in Australia.5. How We Disclose Your Personal InformationWe only disclose your Personal Information in the limited circumstances set out below:(a) To Providers (To Run the Service) The Service functions by integrating with third-party infrastructure and Large Language Model providers ("Providers").To provide the Service, we disclose your Inputs (which may contain Personal Information) only to Providers that process and store data in Australia. Providers located outside Australia receive only de-identified data, as described in Section 6 below.Our current Providers and their roles are identified on our Vendor List.We have contractual agreements with these Providers that, among other things, enforce our "No Training by Default" policy and require them to protect your data.(b) Administered Accounts The Service is a B2B platform. If you register an account using an email address associated with your employer or firm (the "Customer"), your account is managed by that Customer. The Customer's administrators may have the ability to access, modify, and control your account and the data within it (including your Inputs and Outputs).(c) Legal and Contractual Obligations We may disclose your Personal Information if we are required to do so by law, court order, or in connection with a legal proceeding.(d) Business Transfers If Elf Works is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to our confidentiality obligations.(e) Payment Processing We disclose billing information to our third-party payment Provider (identified on the Vendor List) to process payments. That Provider may be located outside Australia.Summary: Your Inputs stay in Australia in identified form; overseas Providers receive only de-identified data. We share billing information with our payment provider. Data is otherwise shared only with our partners (our "Providers") to make the Service work. If you use a work email, your employer may have access to your account.6. Cross-Border Disclosure of Personal Information (APP 8)Client Data (your Inputs and Outputs) is processed and stored on infrastructure located in Australia, including backups and logs, except that de-identified data may be processed by overseas Providers as described below. We do not disclose Personal Information contained in Inputs to overseas recipients. Where a task requires processing by an overseas large language model Provider, we first remove client-identifying information (including names, entity names, addresses, dates of birth, account identifiers, ABNs and tax file numbers) within Australia, transmit only the resulting de-identified data, and re-insert the identifying details within Australia on return. De-identification is designed and applied so that the transmitted data is no longer about a reasonably identifiable individual in the hands of the overseas Provider; as a safeguard against residual risk, we nonetheless take reasonable steps (including contractual measures and our No-Training-by-Default requirement) to ensure overseas recipients handle all data consistently with the APPs. The only overseas disclosure of Personal Information in ordinary operation is billing information processed by our payment Provider (see the Vendor List for countries and purposes). We provide 30 days’ prior notice before adding a new processing country or materially changing Providers, with a right to terminate before the change takes effect.7. Government Related Identifiers (APP 9)We do not adopt, use, or disclose government-related identifiers (e.g., Tax File Numbers, Medicare or driver licence numbers) as our own identifiers, except as permitted by law. While you may provide Inputs that contain such identifiers (for example, client-related documents), we do not use them to identify or manage your account, and they are processed only in accordance with this policy and our Terms.Where Inputs include TFN information (including incidentally, within source documents), we handle it as a service provider to your firm in accordance with the Privacy (Tax File Number) Rule 2015 (Cth): we use and disclose it only for the tax-related purposes authorised by taxation law for which your firm provided it, restrict access to personnel who require it for those purposes, safeguard it, remove tax file numbers within Australia before any overseas transmission, and securely destroy or permanently de-identify it when no longer required.8. Data Quality (APP 10)We take reasonable steps to maintain data quality, including self-service profile updates, admin correction tools, field validation at collection, periodic prompts to confirm contact/billing details, and bounce-handling to update or remove invalid contact information. Outputs are AI-generated drafts and may contain errors, including inaccurate personal information. Our Terms and AI Product Terms require professional review and verification of Outputs before use; that verification is how the accuracy of personal information in Outputs is addressed before it is relied on.9. Data Security and Retention (APP 11)(a) Security (APP 11.1) We take reasonable steps to protect the Personal Information we hold from misuse, interference, loss, and unauthorised access, modification, or disclosure.We implement and maintain technical and organisational security measures, which are further described on our Trust and Security Page. However, no system is 100% secure, and we cannot guarantee the absolute security of your information. You are responsible for maintaining the security of your account credentials.(b) Retention and Deletion (APP 11.2) We retain your Personal Information only for as long as is necessary to provide the Service to you and to comply with our legal obligations (such as for tax or audit purposes).As set out in our Terms (Clause 14.5), following the termination of your subscription, you will have 30 days to export your Inputs and Outputs. After this period, we will take reasonable steps to securely destroy or de-identify your Personal Information from our active systems.Summary: We take security seriously and have measures in place to protect your data. We delete your data from our active systems after you terminate your account, following a 30-day export window.10. Your Rights and How to Make a Complaint(a) Access and Correction (APP 12 & 13) You have the right to request access to the Personal Information we hold about you and to request that we correct any inaccuracies.You can access and update most of your Account Information directly through your account settings. For information that is not available in your account, or to request correction, please contact our Privacy Officer at privacy@elfworks.ai. Access and correction requests are open to any individual whose personal information we hold, including clients of our Customers.We will respond to your request within a reasonable period. We will not charge you for making a request, though we may charge a reasonable fee for giving access if the request is complex.(b) Making a Complaint (APP 1) If you believe we have breached the Australian Privacy Principles or this Privacy Policy, please contact us first. We take all complaints seriously and will endeavour to resolve them promptly. We will acknowledge your complaint within 7 days, investigate it, and give you a written response within 30 days. If we need longer, we will tell you why and when to expect our response.Contact our Privacy Officer: Please provide your complaint in writing to privacy@elfworks.ai or our registered address below.External Complaint: If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).Summary: You have the right to access, correct, or complain about our handling of your Personal Information. Please contact us first at privacy@elfworks.ai. If you're not satisfied, you can contact the OAIC.11. Changes to this Privacy PolicyWe may modify this Privacy Policy from time to time. If we make a change that, in our reasonable opinion, materially reduces your rights or increases your obligations, we will provide you with 30 days' prior notice by email or via an in-product notification.Your continued use of the Service after any change constitutes your acceptance of the new policy.12. How to Contact UsIf you have any questions about this Privacy Policy or our privacy practices, please contact our Privacy Officer:Privacy Officer Elf Works Pty Ltd (ABN 92 678 538 086) Email: privacy@elfworks.ai Registered Address: 268 Long Road, Tamborine Mountain QLD 4272 Australia

Question 4

Elf Works Pty Ltd – Acceptable Use Policy (AUP)

Accepted Answer

Elf Works Pty Ltd – Acceptable Use Policy (AUP)Last Updated: 1 November 2025This Acceptable Use Policy ("AUP") supplements the Elf Works Terms and Conditions ("T&Cs") and the Privacy Policy.Capitalised terms used but not defined here have the meaning given in the T&Cs, AI Product Terms, or Privacy Policy. In the event of any direct conflict, the order of precedence in the T&Cs shall apply .By using the Service, you and your Authorised Users agree to comply with this AUP. 1. Core ResponsibilitiesYou must, and must ensure your Authorised Users:Use the Service lawfully and in accordance with your professional obligations.Keep all account credentials secure and confidential.Respect the rights of others, including confidentiality, intellectual property, and privacy rights.Comply with the "human-in-the-loop" and verification requirements in the AI Product Terms before relying on any AI-generated Output. 2. Prohibited ConductYou and your Authorised Users may not use the Service to:A. Compromise Security or IntegrityAccess, probe, or disrupt any account, system, or network without permission.Circumvent or attempt to bypass security controls, usage limits, or content safeguards (including "jailbreaking" or "prompt injection").Upload or transmit any virus, worm, or other malicious code.B. Engage in Abuse or HarmGenerate or disseminate content that is unlawful, defamatory, harassing, hateful, threatening, exploitative, or that incites violence.C. DiscriminateDiscriminate against others, or incite or promote discrimination, hostility, or violence, based on race, religion, sex, sexual orientation, age, disability, ancestry, national origin, or any other protected basis.D. Violate Privacy or ConfidentialityUpload, process, or submit Personal Information without a lawful basis (and, where required, valid consent), including each client’s prior permission where required by Tax Practitioners Board guidance (TPB(GS) 55/2026).Include government-related identifiers (e.g., TFNs) or Sensitive Information unless reasonably necessary for the specific tax-related task, lawfully held, and lawfully permitted to be disclosed to us (see clause 4.2(i) of the T&Cs).Breach any professional duty of confidentiality you owe to your clients or other third parties.E. Infringe Legal RightsInfringe or misappropriate the intellectual property, privacy, or publicity rights of any third party.F. Breach Professional or Regulated Use StandardsProvide medical, legal, financial, or tax advice based solely on Outputs without appropriate human review and verification by a qualified professional.Deploy fully automated decisions that produce legal or similarly significant effects on individuals (e.g., decisions affecting access to services, credit, employment, or legal rights) without the required human review.Commit, promote, or facilitate any unlawful activity, including fraud, money laundering, or sanctions evasion.G. Misuse the ServiceResell, sublicense, or otherwise provide the Service to any third party, except as expressly permitted by the T&Cs.Benchmark or publish comparative performance tests of the Service in a misleading manner, in breach of confidentiality, or contrary to the T&Cs.Use automated means to extract large volumes of data (scraping) except via our documented APIs or with our written consent, or in a way that disrupts the Service or circumvents rate limits. 3. Fair Use and Usage LimitsYou must respect all rate limits, credit quotas, and model-specific caps displayed within the Service or set out in your Subscription under the T&Cs. You must not attempt to evade these quotas (e.g., by creating multiple accounts). 4. Accounting & Tax Workflow ExamplesTo provide clear guidance, this section outlines examples of acceptable and unacceptable use for a professional accounting practice.Allowed Examples (Human-in-the-Loop):Research: Generating a first-pass summary of ATO guidance for an internal memo, which a practitioner then reviews and verifies before using it as the basis for client advice.Classification: Submitting expense line items to an AI Feature to suggest tax categories, followed by human verification from a qualified staff member.Data Extraction: Uploading a client-provided PDF to extract key data points (e.g., ABNs, dates, amounts) for reconciliation, followed by a human check for accuracy.Drafting: Generating a draft checklist for year-end workpapers, which is then reviewed, adapted, and signed off by a manager.Not Allowed Examples (Prohibited Conduct):No Verification: Automatically issuing a client advice letter or lodging a form based on an AI Output without a qualified practitioner first reviewing and verifying the content [Breach of 2(F)].Unnecessary Data: Uploading a full client register, including all TFNs and driver's licence scans, when not reasonably necessary for the specific task [Breach of 2(D)].Deception: Using AI Features to fabricate payslips, ASIC extracts, or invoices to "test" a client's response or for any deceptive purpose [Breach of 2(B) & 2(F)].Publishing as Final: Publishing an AI-generated analysis of a complex tax ruling as your firm's final position without practitioner review and sign-off [Breach of 2(F)].5. Monitoring and EnforcementWe may use automated safety systems to detect suspected breaches of this AUP, as described in the Privacy Policy and consistent with applicable law. If we reasonably believe a violation has occurred, we may rate-limit, suspend, or terminate access to the Service in accordance with the T&Cs .6. Reporting ViolationsIf you become aware of any violation of this AUP, please contact us at legal@elfworks.ai.7. Changes to this AUPWe may modify this AUP from time to time. Any changes will be notified and will take effect in accordance with the change process set out in the T&Cs . Download AUP

Question 5

Vendor List for AI Language Model Providers

Accepted Answer

Vendor List for AI Language Model ProvidersThis page lists the third-party AI language model providers used to process user information across our services. These providers assist with generating responses, content, analysis, and other AI-driven features.We maintain executed Data Processing Agreements (DPAs) with each vendor to ensure strict compliance with applicable data protection legislation, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).Core Data Commitment: We do not permit any customer or user data submitted to these models to be used for model training or retained beyond real-time inference. All data is processed ephemerally and purged immediately following output generation.Controller: Elfworks Pty Ltd (ACN 678 538 086), an Australian company, is the controller of data processed through the platform. Each provider listed below acts as a processor. Direct client identifiers are removed before a request is sent to a provider located outside Australia.1. OpenAI (ChatGPT)·       Contact Information: OpenAI, LLC | support@openai.com | https://openai.com·       Service Provided: Natural language processing, multimodal reasoning, and text generation.·       Categories of Data Processed: De-identified user queries/prompts, IP addresses, device information, session identifiers, and interaction metadata.·       Purpose of Processing: Real-time conversational AI responses, content assistance, and user interaction fulfilment.·       Data Retention & Storage: Zero data retention for model training; processed in-memory and deleted immediately post-generation. Hosted in secure US/EU regions under standard DPA safeguards.·       Corporate Control & Jurisdiction: United States. Data held by this provider may be subject to US legal process, including under the CLOUD Act, regardless of the region in which it is stored.·       Sale or Sharing: Strictly no sale or unauthorised sharing of personal data.·       Privacy Policy: https://openai.com/policies/privacy-policy·       User Rights & Controls: Access, correction, and deletion requests can be initiated via our platform privacy controls or by contacting our team.2. Anthropic (Claude)·       Contact Information: Anthropic, PBC | support@anthropic.com | https://anthropic.com·       Service Provided: Natural language understanding, contextual analysis, and text synthesis.·       Categories of Data Processed: De-identified user queries/prompts, IP addresses, device identifiers, and session metadata.·       Purpose of Processing: Providing AI-assisted content drafting, workflow analysis, and automated response generation.·       Data Retention & Storage: Ephemeral processing with prompt purging post-response; no data is retained for model retraining. Stored in US-based cloud infrastructure.·       Corporate Control & Jurisdiction: United States. Data held by this provider may be subject to US legal process, including under the CLOUD Act, regardless of the region in which it is stored.·       Sale or Sharing: Strictly no sale or commercial sharing of processed data.·       Privacy Policy: https://www.anthropic.com/legal/privacy·       User Rights & Controls: Supported via account settings and platform-assisted deletion requests under standard DPA clauses.3. Google (Gemini)·       Contact Information: Google LLC | privacy@google.com | https://cloud.google.com·       Service Provided: Multimodal processing, summarisation, and natural language generation.·       Categories of Data Processed: De-identified text queries, uploaded files/media (if applicable), IP addresses, device telemetry, and session IDs.·       Purpose of Processing: Powering contextual search, multimedia processing, and document summarisation.·       Data Retention & Storage: Processed transiently in-memory and discarded post-inference; not used for foundation model training. Encrypted across Google Cloud data centres (US/EU regions).·       Corporate Control & Jurisdiction: United States; a subsidiary of Alphabet Inc. Data held by this provider may be subject to US legal process, including under the CLOUD Act, regardless of the region in which it is stored.·       Sale or Sharing: Strictly no sale or third-party sharing beyond defined sub-processing.·       Privacy Policy: https://policies.google.com/privacy·       User Rights & Controls: Configurable via user privacy settings, consent management tools, or direct contact with our Data Protection Officer.4. xAI (Grok)·       Contact Information: xAI Corp | support@x.ai | https://x.ai·       Service Provided: Real-time conversational inference and dynamic search processing.·       Categories of Data Processed: De-identified user prompts, interaction telemetry, IP addresses, and session tokens.·       Purpose of Processing: Delivering real-time conversational analysis and interactive data retrieval.·       Data Retention & Storage: Ephemeral execution without persistence or retention for model training. Hosted within compliant data centre infrastructure (primarily US).·       Corporate Control & Jurisdiction: United States. Data held by this provider may be subject to US legal process, including under the CLOUD Act, regardless of the region in which it is stored.·       Sale or Sharing: Strictly no sale or unauthorised sharing of data.·       Privacy Policy: https://x.ai/privacy·       User Rights & Controls: Data access and purge requests supported via our primary contact desk.5. SCX.ai (SouthernCrossAI)·       Contact Information: SCX.ai Holdings Limited (ASX: SCX) | contact@scx.ai | https://scx.ai·       Service Provided: Sovereign Australian AI inference. Provides hosted access to open-weight language models running on Australian infrastructure.·       Categories of Data Processed: User queries/prompts, Australian tax and regulatory context, document text submitted for analysis, device information, IP addresses, and session metadata.·       Purpose of Processing: Onshore AI inference and domain-specific content generation, with data residency maintained within Australia.·       Data Retention & Storage: Processed in-memory and discarded immediately post-inference. Prompts are not stored, indexed, or replayed, and are not used to train or fine-tune any model. Inference runs on ASIC-based infrastructure at Equinix SY5 (Sydney). All data resides and is processed onshore within Australia.·       Corporate Control & Jurisdiction: Australia. Australian-incorporated and ASX-listed, with no foreign parent entity. Data is not transferred offshore.·       Sale or Sharing: Strictly no sale, cross-border export, or commercial sharing of data.·       Privacy Policy: https://scx.ai/privacy·       User Rights & Controls: Data access, rectification, and erasure rights managed in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).Updates and Inquiries: This list is reviewed periodically to reflect changes in our infrastructure and vendor ecosystem. If you have questions, DPA inquiries, or wish to exercise your privacy rights, please contact our Privacy Team at privacy@elfworks.ai.Last reviewed: 24 August 2026

Legal and Trust Centre

Our Commitment to Trust

Sovereign Language Models

De-identification before offshore processing

Security Measures

Compliance and Certifications

Vendor Management and Data Sharing

Incident Response

International Data Transfers

Continuous Improvement

Contact Us

Legal and Trust Center Documents

Elf Works Pty Ltd - Terms and Conditions

Elf Works Pty Ltd - AI Product Terms

Elf Work Pty Ltd - Privacy Policy

Elf Works Pty Ltd – Acceptable Use Policy (AUP)

Vendor List for AI Language Model Providers

Legal and Trust Centre

​

Our Commitment to Trust

Sovereign Language Models

De-identification before offshore processing

Security Measures

Compliance and Certifications

Vendor Management and Data Sharing

Incident Response

International Data Transfers

Continuous Improvement

Contact Us

Legal and Trust Center Documents

Elf Works Pty Ltd - Terms and Conditions

Elf Works Pty Ltd - AI Product Terms

Elf Work Pty Ltd - Privacy Policy

Elf Works Pty Ltd – Acceptable Use Policy (AUP)

Vendor List for AI Language Model Providers