The Australian Privacy Principles.
APP 1 through APP 13, in the order and with the content the Privacy Act asks for: what you collect and why, who else sees it, how someone gets access, has it corrected, or complains.
Some privacy policy generators only take five minutes. Ours can’t. We ask 129 questions (what you collect, who else sees it, what runs on your website, whether your meetings get recorded). It is your promise to your customers, and it is worth the time making sure it is right.
What your policy actually covers
We could ask you three and hand back a template with your business name dropped into it. That is what a five-minute generator does, and the result reads the same for a florist as it does for a physiotherapy clinic, because it was never about either of them.
If you want a quick generic template, this is not the right product. This will take about 15 to 20 minutes to complete, because we make sure it covers every privacy aspect of your business.
Your privacy policy is often the first place a customer looks to decide whether you can be trusted with their details. Getting it right is how you protect that trust, and keep it.
What comes out is built from those answers: not assembled from a template and renamed.
| What to compare | AegorIQ Privacy Policy Generator | Illustrative five-minute generator |
|---|---|---|
| Approach | What comes out is built from those answers: not assembled from a template and renamed. | a template with your business name dropped into it |
| Questions | 129 questions | three |
| Time commitment | about 15 to 20 minutes | five minutes |
| Guidance | Every question explained in plain English. | No comparison claim made |
| Website technologies | Analytics, advertising pixels, session recording, chat widgets, booking tools, embedded video and maps | No comparison claim made |
| Downloads | PDF, Word or HTML | No comparison claim made |
| Changes | regenerate free for 30 days | No comparison claim made |
Illustrative comparison only. The right-hand column describes the hypothetical “five-minute generator” referenced in AegorIQ’s existing copy, not any named competitor or a verified claim about other products. A dash means no comparison claim is made.
Every question exists because something in the law, or in how your business runs, turns on the answer. What comes out is built from those answers: not assembled from a template and renamed.
APP 1 through APP 13, in the order and with the content the Privacy Act asks for: what you collect and why, who else sees it, how someone gets access, has it corrected, or complains.
Part IIIC: how you assess a suspected breach, the 30-day assessment window, and when you must tell the person and the OAIC.
The APP 1.7 and 1.8 disclosure that applies from 10 December 2026, where software makes or materially helps make a decision about someone. Scoped against all three limbs of the test, so a spam filter does not land you with a disclosure you do not owe, and a recommendation a person rubber-stamps does not let you off one you do.
For the designated services brought into the regime on 1 July 2026, real estate, conveyancing, professional services, dealers in precious metals. Reached by asking which services you actually provide and whether they have an Australian link, rather than asking you to decide whether you are a reporting entity. Covers the identity documents, the retention period and reporting to AUSTRAC. Your AUSTRAC obligations themselves are a separate regime this does not discharge.
Letting someone pay 7 days or more after you supply makes you a credit provider under section 6G of the Privacy Act, even on ordinary invoice terms, and that surprises nearly everyone. Most businesses stop there: they never list a default with a credit reporting body and never pull a credit file, so section 21B(8) exempts them from keeping a credit reporting policy at all, and the generator tells them so instead of writing one they do not owe. If you do take part in credit reporting, the policy includes a credit reporting policy built against all ten things section 21B(4) requires it to say, from the kinds of credit information you hold to how someone complains. The rest of Part IIIA, collection notices, when a default may be listed, the Credit Reporting Code and your external dispute resolution membership, is a separate set of obligations this does not discharge.
APP 8 and section 16C: which countries, and what it means that you stay accountable for information you send there.
Analytics, advertising pixels, session recording, chat widgets, booking tools, embedded video and maps: named individually, not waved at as “cookies”.
Health records, childcare, tenancy databases, credit reporting, recruitment, professional services holding another business’s client data: asked about, and included only where they apply to you.
How long you keep what, with the common statutory periods shown beside the question so you can check yours against them.
Each one carries a short note on why it is being asked and what turns on the answer, so you are never guessing at what a question means.
You can regenerate it free for 30 days, in PDF, Word or HTML. Built from a clause library reviewed by an Australian law firm. Your policy is assembled from your own answers, so it is specific to your business and only as accurate as the answers you give. No lawyer has read it. We recommend having it reviewed before you publish it.
The clause library this generator is built from has been reviewed by an Australian law firm. Your policy is assembled from your own answers, so it is specific to your business and only as accurate as the answers you give. No lawyer has read your document, and it is not legal advice. We recommend having it reviewed before you publish it. Need a lawyer to review your generated privacy policy? To make this more accessible, we have partnered with Petra Law, which offers AegorIQ customers a discounted, fixed-fee legal review of a privacy policy generated by AegorIQ's Privacy Policy Generator for $400 plus GST. Customers engage Petra Law directly for this service, and AegorIQ receives no referral fees or commissions from the arrangement. You are not obliged to use them. We do not share or disclose your details to Petra Law. If you would like to engage Petra Law, contact them at enquiry@petralaw.com.au.
Every clause in the library records the provision it exists for. There are 108 clauses carrying 77 distinct citations, and your policy is assembled only from the ones your answers call for. The questionnaire covers all thirteen Australian Privacy Principles of the Privacy Act 1988 (Cth), read alongside the OAIC's APP Guidelines.
Which of these reach you depends entirely on your answers. A business with no premises, no staff and no overseas tools is asked about none of them, and its policy says nothing about them. This is a list of what the questionnaire can ask, not a list of what your policy will claim.
It is 129 questions, and it is not a five-minute form. That is deliberate: a policy that is actually about your business has to ask how your business works. A full run takes about 15 to 20 minutes, longer if you need to check on something. If you want a quick generic template, this is not the right product for you.
The Australian Privacy Principles, including what personal information you collect and why, who you disclose it to, whether anything goes overseas and to which countries, how long you keep it, how someone asks for access or correction, and how to make a complaint. It also covers cookies, analytics and tracking, and the Notifiable Data Breaches scheme where it applies to you.
PDF, Word (.docx), Word (.doc) and HTML. The HTML is the one to give a web developer to publish on your site.
Yes. For 30 days after purchase you can reopen your generator link, change any answer and generate the policy again. A link to your generator is emailed to you at purchase so you do not have to keep the tab open.
No. The clause library has been reviewed by an Australian law firm. AegorIQ is not a law practice, and your policy is not legal advice: it is assembled from your own answers, so it is specific to your business and only as accurate as those answers. No lawyer has read it. We recommend having it reviewed before you publish it. Need a lawyer to review your generated privacy policy? To make this more accessible, we have partnered with Petra Law, which offers AegorIQ customers a discounted, fixed-fee legal review of a privacy policy generated by AegorIQ's Privacy Policy Generator for $400 plus GST. Customers engage Petra Law directly for this service, and AegorIQ receives no referral fees or commissions from the arrangement. You are not obliged to use them. We do not share or disclose your details to Petra Law. If you would like to engage Petra Law, contact them at enquiry@petralaw.com.au.
The AegorIQ Privacy Policy Generator is AUD $59, paid once. There is no subscription.
Yes, and it scopes it rather than assuming it. APP 1.7 and APP 1.8 commence on 10 December 2026, and APP 1.7 is a three-limb test: personal information used in a computer program, the program playing a material role in a decision, and the decision being one that could reasonably be expected to significantly affect someone’s rights or interests.
The generator asks all three. That matters in both directions, a business whose only decision software is a spam filter should not publish a formal automated-decision disclosure it does not owe, and a business whose staff rubber-stamp a system’s recommendation does not escape one. If all three are met, the policy sets out the three things APP 1.8 requires: the kinds of information those programs use, the decisions made solely by the program, and the decisions where the program does something materially relevant to a person’s decision.
Yes. On 1 July 2026 the anti-money-laundering regime took in new designated services, real estate agency work, conveyancing, professional services that set up or administer companies and trusts, and dealing in precious metals and stones.
The generator does not ask you whether you are a reporting entity, because that is the legal conclusion and it is the thing people get wrong. It asks which services you actually provide, in the words you would use for your own work, and separately whether those services are provided from Australia or to customers in Australia: the geographical link in section 6(6) of the AML/CTF Act. If both are there, the disclosure is included: the identity documents you collect, that the service cannot be provided without them, how long you keep the verification records, and that you report to AUSTRAC without needing consent.
It is a privacy disclosure only. Your AUSTRAC obligations (enrolment, customer due diligence, reporting) are a separate regime, and this does not discharge any of them.
Yes, where you need one, and it tells you when you do not. Letting a customer owe you money for 7 days or more makes you a credit provider in relation to that credit under section 6G of the Privacy Act. Ordinary 30 day invoice terms clear that, which surprises nearly every business owner, because the everyday meaning of credit provider comes from the National Credit Code, which needs a charge for the credit and excludes anything under 62 days. They are different Acts and both are right. Afterpay, Zip and Klarna do not count, because they pay you in full and the customer repays them.
Being a credit provider is not the end of it. The generator then asks whether you actually take part in credit reporting: whether you list defaults with Equifax, Experian or illion, obtain credit reports about people, or pass credit information to another credit provider. If you do none of those you are a non-participating credit provider, and section 21B(8) exempts you from the separate credit reporting policy altogether. The generator says so plainly rather than writing you a document you do not owe, and tells you what would change that.
If you do take part, your policy contains a clearly identified credit reporting policy built against all ten items in section 21B(4): the kinds of credit information you collect and hold and how, the credit eligibility information you hold, what you derive from a credit report, the purposes you use it for, how someone gets access and seeks a correction, how they complain and how you will handle it, and whether credit information is likely to go to anyone without an Australian link, with the countries where it is practicable to name them. Note what section 21B(7) does: for credit information, APP 1.3 and 1.4 step aside and that part applies instead, while the rest of your policy still governs everything else you hold.
It is the policy only. Collection notices under section 21C, the rules on when a default may be listed and how long information may be held, the Privacy (Credit Reporting) Code and membership of a recognised external dispute resolution scheme are a separate regime, and this does not discharge any of them. Of everything the generator produces, this is the part we most strongly suggest you have a lawyer read.
Yes. If the Notifiable Data Breaches scheme in Part IIIC applies to you, the policy says that you assess a suspected eligible breach promptly and within 30 days, that if serious harm is likely you will notify both the person and the Office of the Australian Information Commissioner as soon as practicable, and that if you can prevent the harm before it happens notification may not be required.
That last part is in the scheme and is usually left out, which makes a policy promise more than the business can keep.