privacy policy
Version 1.2 · effective 7 September 2026Separating couples hand over more sensitive information than almost any other customer: what you own, what you owe, where you live, your children's names. We built The Last Step so that we never receive most of it. This policy explains exactly what that means, and where it stops being true.
The key is deliberately split in two. One half travels in the emailed link. The other half is three things only you would know about yourself: your date of birth, your phone number, and the postcode of your address for service. Neither half opens anything on its own.
This is why: an email address typed with one character wrong does not bounce, and nobody ever finds out. If the whole key were in the email, one wrong address would hand a stranger every asset, every account, and your children's names. Because the other half is something only you know, a misdirected email opens nothing at all.
We never see those answers. Your browser turns them into a scrambled value and we compare that, which is enough to check them and not enough to learn them. After five wrong attempts the stored copy is destroyed outright, so there is nothing left to attack, and the person who sent it is emailed and asked to check the details they entered for you.
The invitation email itself is deliberately plain. It does not contain any of your financial details, or the other party's. It says who invited them, what the tool is, and what clicking does and does not commit them to.
5. What we do collect
| What | Why | How long |
|---|---|---|
| The encrypted matter block, a scrambled version of those answers, plus the recipient's email address and first name so the invitation can be addressed | To pass the matter between the two of you | 30 days, then deleted automatically, or immediately after five wrong attempts |
| Standard web server logs from our host, including your IP address, browser and the pages you requested | Security, and keeping the site up | Short-term, per our host's retention |
| Anonymous usage statistics, if analytics is enabled: pages viewed, device type, rough location by country or city | To see where people get stuck | Per the analytics provider's retention |
| Payment details | To take payment | Held by our payment provider, never by us |
| Anything you type into the support or contact form | To answer you | Kept while it is useful, then deleted |
We do not collect your name, your address, your children's details, your assets, your debts or your superannuation. Those never reach us.
6. Payments
Payments are handled by Stripe. Your card details go to Stripe, not to us, and never pass through this site. We never see or store a card number. Stripe is our only payment provider and it handles that information under its own privacy terms.
7. Support, and the one time we may see something
If you ask for help and describe a fault we cannot reproduce from your description, we may offer you a short screen-sharing call so that we can watch it happen on your own device. You choose what is on screen, we do not record the call, and we take no copy of your matter. It is the only circumstance in which anyone here sees your figures, and it happens only because you decided to show us. Anything you type into a support or contact message we do see, so send us the fault rather than your finances.
8. Who else is involved
- Netlify hosts the site and runs the short-lived storage used for the handover. Data is held in their infrastructure.
- Resend sends the invitation emails from our address.
- Stripe, for payments, once live.
Everything else the site needs, including its typefaces, is served from our own site. Where analytics is switched off, as it is at the time of writing, opening a page of The Last Step contacts nobody but us. The screens where you type financial details load no third-party analytics or tracking scripts at all, and no outside company learns that you visited them.
9. What we never do
- We do not sell or rent your personal information. Not to anyone, at any price.
- We do not build advertising profiles, and advertising signals are switched off in our analytics.
- We do not send you marketing you did not ask for.
- We do not share your matter with the other party's lawyer, with a mediator, or with anyone else, unless you send it yourself.
10. Mediators, lawyers and any related business
The Last Step does not share your information with any business related to its operator, or with any mediator or lawyer. Where the tool suggests mediation or legal advice, it points you to public directories — the national mediator register and the Court’s find-a-lawyer page — and nothing about your matter travels there unless you take it yourself.
If you are a mediator using our workbook
The settlement workbook at thelaststep.com.au/mediator-resources is different from the rest of this policy in one way that matters to you: what you type into it is not your own information, it is two other people's.
So it is built to send nothing. The page runs entirely in your browser. There is no account, no upload and no server call of any kind — the code contains no mechanism for making one, and we check that on every release. Your entries are held in that browser until you clear them, and the file you save is written by your own browser to your own disk. We never receive it, and we could not produce it if we were asked.
That also means the responsibility is yours. If you leave a matter open on a shared machine, or save the file somewhere others can read it, we cannot help and would not know. Clear this matter removes what the browser is holding, and the saved file is yours to keep or destroy.
The disclosure pack is a document you download. Once it is on your computer it is out of our hands entirely.
11. When we would disclose something
We would disclose what we hold if we were legally required to, for example under a court order or a valid request from a law enforcement or regulatory body. In practice what we hold is thin: server logs and, for up to 30 days, a block of encrypted data we cannot read and one email address. We could not hand over your financial details because we do not have them. That is a statement about what we hold, and nothing more: it does not reduce what the two of you must disclose to each other and to the Court, and full and frank disclosure is an obligation these orders depend on.
12. Overseas
Our host and our email and payment providers are global businesses and their infrastructure may sit outside Australia, including in the United States. Where information is handled overseas, it is handled under those providers' own protections and their contractual commitments to us.
13. Security
The site is served only over an encrypted connection. Matter data is encrypted in your browser before any handover. We hold no matter database, which removes the largest risk in a product like this. No system is perfect, and if a breach ever occurred that was likely to cause you serious harm, we would notify you and the Office of the Australian Information Commissioner as the law requires.
14. Your choices and your rights
You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, and we will respond within a reasonable time. Given the design, the honest answer is usually that we hold very little.
You can also act directly, without asking us:
- Clear your browser data for this site and your answers are gone from your device.
- Stop the handover from being retrievable by leaving it to expire, which happens automatically within 30 days.
- Use your browser's tracking protection or block scripts. The tool works without analytics.
If you are not happy with how we have handled your information, tell us first: email privacy@thelaststep.com.au, or use the contact form. If we cannot resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
15. Children
The tool is for adults. Children do not use it. The Court's form requires the names and dates of birth of any child of either party under 18, even for orders about money only, and those details stay in your browser with the rest of your answers and print onto the form you file.
16. Changes
If we change this policy we will change the version and date at the top. If a change is significant and affects a matter you are in the middle of, we will say so on the site.
17. Contact
Email privacy@thelaststep.com.au, or use the support form and choose “privacy request” as the topic. Either reaches the same person.