Privacy policy

This policy explains how Supportville Pty Ltd (ACN 703 868 731, ABN 85 703 868 731), which runs Supportville (“we”), handles personal information.

What we collect

• Visitors: we don’t require an account. We count profile views as simple daily totals and don’t use advertising trackers or third-party analytics cookies. We use one essential cookie only when you log in.
• Enquiries and referrals: the details you type into the form, such as names, contact details, location, age group, supports needed and your message. We ask you not to include NDIS numbers, identity documents or detailed medical information.
• Providers: account and organisation details, profile content, photos and videos you upload, and billing status. Card payments are handled by Stripe; we never see or store card numbers. To check you’re a real business we look up your ABN on the government’s ABN Lookup and check your NDIS registration on the NDIS Commission’s register. We also check your business against the NDIS Commission’s published list of compliance actions. If you upload an insurance certificate, only our team can see it, and we delete the file once we’ve checked it, keeping only the type of insurance and the date it ends. Your certificate, profile text and uploaded photos are also read by an automated service (Anthropic’s Claude) to help us check them; it doesn’t keep them to train its models.
• Job applicants: your name, email, phone (optional), whether you have an NDIS Worker Screening Check, your note and your resume. You don’t need an account.
• Reports: what you tell us, and your email if you choose to give it.

How we use it

• To send your enquiry, referral or job application to the provider you chose, and only that provider.
• To operate provider accounts, subscriptions and the community feed.
• To keep the platform safe: preventing spam and abuse, and investigating reports.

Who can see it

Enquiries and referrals are visible only to the provider they were sent to and to a small number of authorised Supportville staff, whose access is logged. They never appear in public pages, search results or the community feed. Notification emails to providers don’t include participant details.

Job applications and resumes are visible only to the provider that posted the job. Resumes are kept in private storage, never published, and can only be downloaded by that provider. We send you a confirmation email with a link to withdraw your application, which deletes your details and resume straight away.

Sensitive information

Information about disability can be sensitive information under the Privacy Act. We collect only what is reasonably necessary for a first contact and only with consent. Providers who receive your information are responsible for handling it under their own privacy obligations.

Where it’s stored and for how long

Data is stored with our hosting providers (database, file storage and email services). Before launch we will confirm data residency in Australia where possible and list our service providers here. How long we keep things:

• Referrals: deleted 12 months after they’re closed. A referral that’s never closed is deleted 24 months after it was last updated; we email the provider a month before, so they can download a copy.
• Enquiries: deleted 24 months after they’re sent. Providers can delete referrals and enquiries sooner.
• Reports (when someone tells us about a problem): the reporter’s email address is deleted 90 days after we’ve dealt with the report.
• Our records of admin and account actions (the audit log): kept for 2 years; billing records for 5 years, as tax law requires.
• Deleted provider accounts: the profile, photos, referrals, enquiries and personal details are deleted straight away. We keep only a scrambled, one-way code made from the ABN and any professional registration number (it can’t be turned back into the number), for 2 years, so we can notice the same business signing up again.

Job applications and resumes are deleted automatically after about six months (the exact date is in your confirmation email), when the provider deletes the job, or when you withdraw.

Your choices

• You can ask for access to, correction of, or deletion of your personal information by emailing privacy@supportville.com.au.
• Providers can download all their data and delete their account from their dashboard.
• If you’re unhappy with how we handled a privacy issue, contact us first. You can also complain to the Office of the Australian Information Commissioner (OAIC).

Data breaches

If a data breach is likely to cause serious harm, we will notify affected people and the OAIC under the Notifiable Data Breaches scheme.