Legal
Privacy policy
Updated 14 October 2026. If anything here is unclear, email privacy@sixth.watch.
Sixth is operated by Yathra Pty Ltd (ABN 85 169 717 908) of Sydney, New South Wales ("we", "us"). This policy explains what personal information we collect through the sixth.watch website and the Sixth services. It also explains why we collect it, who we share it with and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
1. What we collect
When you visit the website
Our hosting provider, Cloudflare, receives the technical details that come with every web request, such as your IP address, your browser type and the page requested. It keeps them in short-lived logs for security and troubleshooting. The website sets no cookies and runs no analytics or advertising trackers. It serves its fonts from our own domain, so no other company learns that you visited.
When you send us an enquiry
We collect your name, email address and organisation, your phone number if you give it, the product you are interested in, your message and the time you sent it. We also collect a one-way scrambled form of your IP address, which we use only to stop automated spam.
When you join the waitlist
We collect your email address, the product you are waiting for, your organisation and staff numbers if you give them, and when you signed up and confirmed. The website does not keep these details. They travel inside the confirmation link we email you. Once you confirm, they are emailed to our company inbox and kept there.
When you use Scam Check
We collect the message you forward, including its text, any links, attachments and screenshots, and the details of whoever sent it to you. We also collect your own email address, the answer we gave and any correction you send us. Forwarded messages often contain other people's names and contact details. We use those only to check the message.
When your organisation is a client
We collect the contact details of the people we deal with; your brand names, domains and products; letters of authority; your suppliers' business details if you give them to us; staff email addresses you ask us to check for data breaches; and records of what we found and did for you.
When your organisation uses Inbox Watch (pilot)
When an organisation connects Inbox Watch to its Google Workspace or Microsoft 365, we read the emails in the mailboxes it chooses, with read-only access. For each email we keep a record: the sender's name and address, whether it passed the sender checks, the addresses its links point to, the names, types and sizes of any attachments with a digital fingerprint (hash) of each, our verdict and the AI's reasons. We keep the subject only for a small sample our team reviews. We do not store the email itself or its attachments. To judge an email, the AI providers listed below receive its sender, its subject, up to 5,000 characters of its text, the addresses its links point to and the names and types of any attachments, and sometimes a screenshot of a linked website's front page.
From public sources
To find impersonation we read public certificate logs, domain registration data, public website scans and the content of suspected scam websites. Domain records can include the name or contact details of the person who registered a domain.
Open banking (pilot)
Payment watch and Guardian will use the Consumer Data Right. We will not collect any banking data until you have given consent through the Consumer Data Right process. Before we collect any, we will publish a separate Consumer Data Right policy.
2. Why we use it
- To reply to your enquiry and, if you become a client, to provide and bill for the service.
- If you join the waitlist, to email you when that product opens, with founding-client pricing. We send no other marketing, and every email we send you has a way to unsubscribe.
- To check the messages you send us and tell you what we found.
- To check the emails in mailboxes an organisation connects to Inbox Watch, and tell it what we found.
- To find, investigate and request the removal of websites, accounts and apps that impersonate our clients, and to report scams to the bodies that act on them, when a client has authorised it.
- To test and improve how accurately Sixth decides what is a scam. We keep a set of real messages, including some sent to Scam Check, to test every change before it goes live.
- To keep our services secure and to meet our legal obligations.
We do not sell personal information, and we do not use it for advertising.
3. Who we share it with
We use these service providers to run Sixth. Each receives only what its job needs.
| Provider | What they do | Where |
|---|---|---|
| Cloudflare | Hosts the website and the Sixth console, receives and sends our email, stores enquiries, client records and case evidence, briefly stores incoming Scam Check messages, and opens suspect web pages in an isolated browser | Global network; our databases are located in the Oceania region |
| Anthropic | Claude AI models that read messages and screenshots and help decide what is a scam | United States and other countries |
| OpenRouter, and TypeSafe through it | Access to a classification model, and a backup route to Claude | United States |
| Resend | A backup route for sending our emails, used only if Cloudflare's is unavailable | Japan |
| Google Workspace | Our company email, where enquiries and replies arrive | United States and other countries |
| Have I Been Pwned | Checks staff email addresses against known data breaches, for Business Protection clients who ask for it (pilot) | Australia and global |
| AgentMail | The earlier Scam Check address used during our trial, until it is closed | United States |
We send AI providers only what a check needs, under their commercial terms. Anthropic's commercial terms do not permit it to train its models on what we send, and OpenRouter does not keep the content of requests by default.
When a client authorises a takedown, we send evidence about the impersonating website to the registrar, host or platform involved. That evidence is about the scam, not about you. We may also disclose information where the law requires it, or to the police or a regulator when it is needed to prevent a serious threat to someone's life, health or safety.
4. Overseas
Some of the providers above handle information outside Australia, mainly in the United States and Japan. We choose providers with strong security and confidentiality commitments, but overseas law may differ from Australian law.
5. How long we keep it
- Enquiries: for up to two years after our last contact, unless you become a client.
- Waitlist: until you unsubscribe, or for up to two years after the product you joined for opens, unless you become a client.
- Scam Check messages: up to twelve months, then deleted. We may keep a message longer, with personal details removed where we can, if it is part of our test set. Web addresses and domain names found in scams can be kept longer, because they help protect others.
- Client records: for the life of the service and seven years after, to meet tax and record-keeping duties.
- Inbox Watch records: while the organisation uses Inbox Watch. Subjects outside the review sample are deleted at the end of each day.
- The content of incoming Scam Check messages is deleted from Cloudflare as soon as our own systems have collected it, usually within a minute. A small receipt (the sending address, our receiving address, the size and the time) stays there for our records.
6. Security
Our own systems are in Sydney. Access to personal information is limited to the people and services that need it, credentials are held in a managed password vault, and connections are encrypted. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner as the law requires.
7. Your choices and rights
You can ask to see the personal information we hold about you, ask us to correct it, ask us to delete your Scam Check messages, or leave the waitlist by replying "unsubscribe" or emailing hello@sixth.watch. You can stop using Scam Check at any time. You can contact us without giving your name where that is practical, although we need an email address to reply to you. We will respond within 30 days.
8. Questions and complaints
Email privacy@sixth.watch. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
9. Changes
We will update this policy as Sixth changes, and show the date it took effect at the top of the page.