Welcome to POPM (Public Outrage Predictive Modelling), a service provided by Predictive Modelling Australia Pty Ltd. By accessing or using our website and services, you agree to comply with and be bound by these Terms and Conditions.

POPM: Public Outrage Predictive Modelling, the tool and services provided by the website.

User: Any individual or entity accessing or using POPM.

Service: The predictive modelling, tools, reports, and related services provided by POPM.

Company: Predictive Modelling Australia Pty Ltd trading as POPM.

Your Content: The documents you upload and the project information you enter into POPM.

POPM is designed to provide insights and predictions based on historical data and general assumptions. It is intended to assist in risk management but should not be solely relied upon for making critical decisions.

Users acknowledge that the predictions are based on available data and are subject to change as new information emerges.

POPM uses artificial intelligence to analyse documents you upload and to propose evidence, scores and commentary. AI-generated material may contain errors. It can be reviewed, challenged and revised before it is accepted as part of an assessment, and you remain responsible for the decisions you make using it.

Appropriate Use: Users must not misuse the POPM system, including attempting to reverse-engineer the tool, sharing confidential data without permission, or using the system for unlawful activities.

Accuracy of Information Provided: Users are responsible for the accuracy of the information they provide, as the tool’s effectiveness depends on the quality of the input data.

Predictive Nature: POPM provides predictive modelling that reflects likely outcomes based on the data provided. However, these predictions are not guarantees of future events, and the accuracy of the predictions cannot be guaranteed.

No Liability: POPM is not liable for any decisions made by users based on the results of the assessments or predictions provided. Users should consider other forms of analysis and consultation before making decisions.

Data Accuracy: The effectiveness of POPM is dependent on the accuracy and relevance of the data inputted. Generalised assumptions may not cover all nuances of specific projects or community contexts.

All content, tools, and methodologies used within POPM are the intellectual property of Predictive Modelling Australia Pty Ltd. Users are granted a non-exclusive, non-transferable licence to use the content for their internal purposes.

Users may not copy, distribute, or create derivative works based on the content of POPM without prior written consent

Ownership: You keep ownership of the documents you upload and the project information you enter (“Your Content”). Nothing in these Terms transfers it to us.

Permission to process: You give Predictive Modelling Australia Pty Ltd permission to store and process Your Content, and to have our service providers do so on our behalf, for the purpose of providing the Service to you.

Your right to share it: You confirm that you are entitled to provide Your Content to us, including any personal information about other people it contains.

Confidentiality: We treat Your Content as confidential. We do not sell it, and we do not disclose it to anyone except our service providers as described below, or where the law requires.

We collect and use information to provide the Service, in accordance with the POPM Privacy Policy.

Service providers: We use service providers to host the Service and to carry out AI-assisted analysis. They handle Your Content only to provide their service to us. They are listed in our Centre of Trust, and we will update that list before a new provider starts handling customer information.

Processing outside Australia: Your Content is stored in Australia. When AI-assisted analysis is run, the text of the relevant documents is processed outside Australia by the AI providers listed in the Centre of Trust. By using AI-assisted analysis you agree to this. If you cannot agree, tell us before you start: assessments can be completed without it.

Improving the Service: We use aggregated information that does not identify you or your projects to improve the Service. We do not use Your Content, or allow it to be used, to train AI models.

Security: The measures we take to protect Your Content, and what we have not yet done, are set out in our Centre of Trust.

Retention: We keep Your Content for as long as you use the Service. We then keep it for six months after your engagement or account ends.

Deletion: You may ask us to delete Your Content by contacting us. We will delete or anonymise it within 30 days, except where the law requires or permits us to keep it. Copies in routine backups are overwritten within seven days.

On termination: If your access ends, you may ask for a copy of Your Content within 30 days before it is deleted.

Third-Party Links: POPM may include links to third-party websites or services. Predictive Modelling Australia Pty Ltd is not responsible for the content, accuracy, or practices of these external sites.

Service providers: The Service relies on the service providers listed in our Centre of Trust.

POPM’s liability is limited to the amount paid by the user for the service. In no event shall Predictive Modelling Australia Pty Ltd be liable for any indirect, incidental, or consequential damages arising out of the use of the service.

Predictive Modelling Australia Pty Ltd is not liable for failure to perform obligations due to circumstances beyond its control, including but not limited to natural disasters, acts of war, or significant technical failures.

POPM reserves the right to modify these Terms and Conditions at any time. Users will be notified of significant changes, and continued use of the service constitutes acceptance of the new terms.

Predictive Modelling Australia Pty Ltd may terminate or suspend access to the service at any time, without notice, for conduct that breaches these terms or is harmful to other users.

These Terms and Conditions are governed by the laws of South Australia. Any disputes arising from these terms shall be resolved in the courts of South Australia, unless agreed otherwise by both parties and evidenced with prior written consent.

If you purchase a paid service from POPM, refunds will be granted only under the conditions specified at the time of purchase. To request a refund, please contact Predictive Modelling Australia Pty Ltd at admin@popm.app.

Users may provide feedback and suggestions to improve POPM. By providing feedback, users grant Predictive Modelling Australia Pty Ltd a royalty-free, worldwide licence to use, modify, and incorporate the feedback into the service.

Predictive Modelling Australia Pty Ltd reserves the right to terminate user accounts for breach of these Terms and Conditions, including but not limited to unauthorised use of the service or prolonged inactivity. What happens to Your Content afterwards is set out under Data Retention and Deletion.

If any provision of these Terms and Conditions is found to be unenforceable, the remaining provisions will continue to be in full force and effect.

Users will be notified of significant changes to these Terms and Conditions through email or on-site notifications. Continued use of the service after changes are made constitutes acceptance of the new terms.

For any questions or concerns regarding these Terms and Conditions, please contact us at admin@popm.app.

POPM is operated by Predictive Modelling Australia Pty Ltd ABN 57 678 505 907 (“we”, “us”). This policy explains what information we collect when you use our website and the POPM system, what we do with it, who else handles it, and what you can ask of us.

It should be read with our Centre of Trust, which sets out our security measures and suppliers in more detail.

• Account information. Your name, email address and organisation, when an account is created for you or you contact us.
• Project information. Details of the projects you assess: descriptions, timelines, objectives, financial figures, scores and commentary.
• Documents you upload. Business cases, consultation reports, stakeholder registers and similar material. These may contain personal information about other people, for example stakeholders or community members named in a report. Please upload only material you are entitled to share with us.
• Website usage information. Our public website does not use analytics, advertising or tracking cookies. Like any website, our hosting provider (Vercel) automatically records standard technical information about each request, such as IP address, browser type, the page requested and the time, in server logs. These are used to operate and secure the site and are kept for a limited period. If you contact us or register your interest through the website, we collect the details you enter.
• The POPM system itself contains no analytics, advertising or session-recording tools. It keeps operational logs containing identifiers and error messages only.

• To provide assessments. We use project information and uploaded documents to produce POPM assessments, reports and recommendations for you.
• To run and improve the service. We use aggregated information that does not identify you to understand and improve how POPM works. We do not use your information, or allow it to be used, to train AI models.
• To communicate with you. We use your contact details to respond to you and to tell you about your account or changes to the service.

POPM uses a large language model to read the documents you upload, propose scores and reasoning against the assessment framework, write the report narrative and dashboard commentary, and answer questions about an assessment.

• POPM assesses projects, not people. It does not make decisions about individuals. Documents you upload may contain personal information about other people, and that information is sent to the AI as part of the document.
• When you upload a document, its full text is sent outside Australia to be read by the AI. This happens at upload, routed through Vercel AI Gateway to Anthropic’s Claude models. Evidence you paste in, your project details, assessment results and the questions you ask are sent the same way when you run an analysis or ask a question. If Anthropic’s own service is unavailable, the same models may be served through Google Cloud or Amazon Web Services.
• The results come back to Australia. Extracted text, proposed scores, narrative, answers and citations are saved with your assessment in Sydney.
• Your documents are not used to train AI models. Zero data retention is enforced on every request, so the model provider does not keep your document text after the response is returned.
• People decide the scores. An AI-proposed score takes effect only when a person accepts, edits or rejects it. The report narrative and dashboard commentary are written by AI from the accepted scores; they can be regenerated, but are not individually approved.

If your organisation cannot permit offshore AI processing of its documents, tell us before you start. An assessment can be completed without AI: scores can be entered manually, and nothing is sent if no documents are uploaded and no AI analysis is run. There is not yet a setting that locks AI off for an organisation, so we will work through how the assessment is run with you.

We do not sell your information. We do not share it with anyone for their own purposes.

We do use service providers to run POPM. They handle information only to provide their service to us, under their data processing terms:

We may also disclose information where the law requires it, or where it is necessary to protect our legal rights.

Your account information, project information and uploaded documents are stored in Australia.

When AI-assisted analysis is run, the text of the relevant documents is sent outside Australia to the AI providers listed above. It is processed to produce the result and is not kept by those providers after the response is returned, and it is not used to train AI models. Inference may run in any region those providers operate in; we cannot name a single country.

If you cannot permit this for your documents, tell us before you start. Assessments can be completed without AI-assisted analysis.

We protect information with access controls enforced in the database, encryption in transit and at rest, invitation-only accounts, and multi-factor authentication on the accounts used to operate POPM. The details, and what we have not yet done, are in our Centre of Trust.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We keep account and project information for as long as your organisation uses POPM, and afterwards for as long as we are required to by law. We keep uploaded documents and assessment outputs for six months after an engagement or account ends. We then delete or anonymise them within 30 days. You can ask for a copy of your material before it is deleted.

You can ask us for access to the personal information we hold about you, and ask us to correct it. You can also ask us to delete it; we will do so unless we are required or permitted by law to keep it. Contact us using the details below and we will respond within 14 days.

If you believe we have mishandled your personal information, contact us first. We will acknowledge and respond to your complaint within 14 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy as our service changes. We will post the new version on this page with a new effective date, and tell account holders about significant changes.

Predictive Modelling Australia Pty Ltd

Email: admin@popm.app

Phone: 1300 191 925

POPM customer data is stored and processed in Australia (AWS Sydney, ap-southeast-2). Request routing traverses Vercel’s global edge network. AI-assisted document analysis is processed outside Australia by Vercel AI Gateway and Anthropic. See the supplier list below.

In practice that means:

• The database, your uploaded documents and the user directory are held in Sydney and stay there.
• Application code runs in Sydney.
• The first hop of each web request, the encrypted connection and the sign-in check, is handled at the network location nearest you, which may be outside Australia. Your stored data is not held there.
• Our hosting provider’s management console and operational logs are hosted in the United States. Logs record identifiers and error messages only, not document content and not personal details.

POPM uses a large language model to read the documents you upload, propose scores and reasoning against the assessment framework, write the report narrative and dashboard commentary, and answer questions about an assessment.

• When you upload a document, its full text is sent outside Australia to be read by the AI. This happens at upload, routed through Vercel AI Gateway to Anthropic’s Claude models. Evidence you paste in, your project details, assessment results and the questions you ask are sent the same way when you run an analysis or ask a question. If Anthropic’s own service is unavailable, the same models may be served through Google Cloud or Amazon Web Services.
• The results come back to Australia. Extracted text, proposed scores, narrative, answers and citations are saved with your assessment in Sydney.
• Your documents are not used to train AI models. Vercel’s agreements with each of these providers prohibit training on your content, and the gateway itself does not keep prompts or outputs once a request completes.
• Zero data retention is enforced on every request. The model provider does not keep your document text after the response is returned.
• People decide the scores. An AI-proposed score takes effect only when a person accepts, edits or rejects it. The report narrative and dashboard commentary are written by AI from the accepted scores; they can be regenerated, but are not individually approved.

If your organisation cannot permit offshore AI processing of its documents, tell us before you start. An assessment can be completed without AI: scores can be entered manually, and nothing is sent if no documents are uploaded and no AI analysis is run. There is not yet a setting that locks AI off for an organisation, so we will work through how the assessment is run with you.

Access and isolation

• Row-level security is enabled on every table. A person can only read or change projects their organisation has been given access to; the database enforces this, not just the screens.
• No data is readable without signing in.
• Uploaded documents sit in a private store, with access tied to the project they belong to.
• Accounts are invite-only. Sign-in is by Google or by email and password.
• The administrative key that can bypass access rules is held server-side only and is used for a single purpose: sending user invitations. It never reads or writes assessment data.
• The accounts used to operate POPM (source code, hosting and database) are protected with multi-factor authentication.

Encryption

• In transit: TLS on every connection, with HSTS preload. Database connections require SSL, and direct database access is restricted to an allow-list.
• At rest: database and file storage are encrypted (AES-256), provided by our hosting suppliers.

Change control

• Every change is tested and linted automatically before it can be merged.
• Dependencies are checked against published security advisories on every change; a high or critical finding blocks the change.
• Code is scanned for secrets before each commit and again in the pipeline.
• Every live deployment traces back to a specific, reviewable change.

Privacy by default

• No analytics, advertising, error-tracking or session-recording tools are embedded in POPM.
• Application logs contain identifiers and error messages only.

Each supplier publishes its own security and certification information: Supabase · Vercel · Anthropic · GitHub.

We will update this list before any new supplier starts handling customer data.

We think you should hear this from us.

• We are not ISO 27001 certified. See the roadmap below.
• No multi-factor authentication inside POPM yet. Sign-in with Google inherits whatever protection your Google account has.
• Backups are daily, kept for seven days. We do not yet offer point-in-time recovery, so in a worst case up to 24 hours of changes could be lost.
• AI analysis is processed offshore, and there is not yet a per-organisation switch to turn it off.
• Our formal security management documentation is still being written. The controls above are in place; the policies and audit evidence around them are in progress.

We are working toward ISO/IEC 27001:2022, the standard Australian government and enterprise buyers ask for.

• Done: an evidence-based review of our own systems against the standard’s controls, and the most serious findings fixed.
• Now: completing the remaining technical controls and writing the security management system.
• Next: independent internal audit, then the two-stage certification audit.
• Target date: to be confirmed once a certification body is engaged.

Until a certificate is issued, we will not describe POPM as certified, compliant or accredited.

Security questions, vendor questionnaires, or a suspected vulnerability: admin@popm.app. We respond to security reports within 14 days.

See also: Privacy Policy · Terms and Conditions

POPM is operated by Predictive Modelling Australia Pty Ltd.