Privacy policy

The short version

The rest of this policy gives the detail.

• We collect what we need to run your account: your email, your setup answers and what you record.
• On the Pro plan, we store files you upload. They may include information about your workers and participants.
• Your records and files are stored in Sydney, Australia.
• Some of our service providers are overseas, mainly in the United States. We name them below.
• We don't sell your information, show ads or use tracking cookies. We count visits to the site without cookies, and without identifying you.
• The assistant sends Anthropic your question and official text, nothing else. It never sends your records or files.
• You can see, correct, download and delete your information.

Who we are

In this policy, “we”, “us” and “our” mean the operator of Readyfile. “You” means the person using Readyfile.

This policy covers people who use Readyfile, people who open an auditor link, and workers and participants whose information is in files that providers upload.

You can contact us about privacy at [email protected].

Readyfile is independent. It isn't part of, or endorsed by, the NDIS Quality and Safeguards Commission or the National Disability Insurance Agency. We don't share your information with them unless the law requires us to.

What we collect

Most of what you put into Readyfile is about your business. It can still be personal information, especially if you're a sole trader. We collect:

• Account details: your email address and when you signed up and signed in.
• Setup answers: business structure, team size, the classes of support you deliver, registration status, the dates printed on your certificate of registration (the period it's in force for and the mid-term audit date), any audit conditions you copy from your certificate or register entry, and your next audit date.
• Your business name, if you choose to add it.
• Document entries: for each item, its state, document name, a date, where you keep it, your notes, and the date you confirmed it's your own current document.
• Audit findings you record: which audit, the standard or indicator in the auditor's words, whether it's major or minor, the date on the written notice, and the dates you mark the plan submitted, the finding downgraded and the finding closed.
• Incident timers: the category you chose, the date and time you became aware, the times you mark the Commission notified and the details and final report submitted, and the reference number the Commission gives you. A timer has no free-text field, so it holds no account of what happened and nothing about a person.
• Register entries: the date, your one-line summary, the action you took, and the date the entry was recorded, which is our server's clock and can't be changed. Each register also records the months where you tapped “nothing to record”. We ask you to leave out names and anything that identifies a person.
• Monthly restrictive-practice reports: the month, whether a practice was used, and the date you submitted the report.
• Your own notes against each practice standard, about how you cover it.
• Files you upload on the Pro plan, with their names, sizes and upload dates.
• Your settings, such as whether reminder emails and the Monday email are on, and the last date you opened Readyfile.
• Subscription details from Stripe: your plan, its status and renewal date, and whether you've had a trial.
• Auditor links you create: their label, what you chose the link to show, and when they were made, expire or were revoked.
• Records of which reminder emails we've sent you, and how many assistant questions you've asked each day.
• How you found Readyfile, if you arrived from one of our guide pages, a partner's link, a tagged link or another website: the link's tags, the other website's name and the page you landed on. We save this with your account if you sign up in that visit.
• Technical details such as IP address, browser type and request logs, recorded by our service providers.
• Anything you send us, such as a support email.

What you have to give us

You need an email address to use Readyfile, because that's where we send your sign-in link. Readyfile needs your setup answers to build your checklist. Everything else is up to you. No law requires you to give us any of it.

You don't have to give your name or a business name. If you add a business name, it appears on your auditor links and in reminder emails.

Information about your workers and participants

Files you upload on the Pro plan can contain personal information about other people. Worker screening clearances, qualifications and ID documents are about your workers. Service agreements can include details about participants.

Some of this is sensitive information under the Privacy Act. Information about a person's health or disability is health information, which is sensitive. So is criminal record information. It needs extra care.

We store these files only so you can keep and share your own records. We don't open, read or review them, unless you ask us to help with a problem, we need to investigate a security issue or misuse, or the law requires it.

Please upload only what you need for your audit, and remove or cover participant details you don't need. Your own privacy obligations may require you to tell your workers and participants that you keep their records in an online service like Readyfile.

If you're a worker or participant, see “Seeing and correcting your information” below.

How we collect it

We collect most information directly from you: when you sign in, answer the setup questions, fill in your records, upload files or contact us.

Information about your workers and participants comes from you, when you upload files about them. We don't collect it from them directly.

Stripe tells us about your subscription when you start, change or cancel a plan. Our service providers record technical details automatically when you use the site, or when someone opens a sign-in or auditor link.

How we use it

We use personal information to:

• sign you in and keep your account secure
• build your checklist and timeline from your setup answers
• store your records and files and show them back to you
• send sign-in emails and, if you have them on, expiry reminders
• show the records and files you choose to people you give an auditor link
• run your subscription through Stripe
• learn which guide pages, partners and websites bring people to Readyfile
• answer your questions and support requests
• find and fix problems, prevent misuse and keep Readyfile secure
• meet our legal obligations, such as keeping tax records

What we don't do

Some things we don't do with your information:

• We don't sell or rent your information.
• We don't show ads or share your information with advertisers.
• We don't use advertising, analytics or tracking cookies.
• We don't use your records or files to train AI models, and we don't send them to an AI service.
• We don't send marketing campaigns, newsletters or anything you didn't ask for. While Pro isn't on sale there is nothing to offer you: the reminder three days before a trial ends says what stays and what stops, and nothing else. It still carries an unsubscribe link that works without signing in.
• We don't use your information to make automated decisions that significantly affect anyone. Your checklist comes from fixed rules applied to your answers, and you can change your answers at any time.

The assistant

The Pro plan includes an assistant called “Ask about this standard”. When you ask it something, we send your question, the name of the standard you're reading and fixed extracts of official text to Anthropic's Claude API. Anthropic is based in the United States.

We don't send your records, setup answers, business name, files or anything else from your account.

Please don't put personal information in your question, such as a worker's or participant's name or details.

Anthropic says it doesn't use questions sent through its API to train its models. It deletes them within 30 days, unless it needs to keep them longer for safety or legal reasons.

We count how many questions you ask each day, to apply a daily limit. We don't save your questions to your account.

Our service providers

We use a few service providers to run Readyfile. They handle personal information for us, only to provide their service. Each one does this under its business terms with us, which limit how it can use the information.

• Supabase: database, file storage and sign-in. Your data is stored in its Sydney, Australia region.
• Cloudflare: hosts the website and counts visits to it. It may process IP addresses and request logs in many countries, including Australia and the United States.
• Stripe: payments. We give it your email address, and you give it your card details. It may process them in the United States and other countries.
• Resend: sends sign-in and reminder emails. United States.
• Anthropic: runs the assistant on the Pro plan. United States.

Other times we share information

When you create an auditor link, anyone who has it can see your business name, the setup answers that decide which documents apply (your classes of support, your business's structure and size, the extra standards you said apply, and your next audit date), your evidence index, any register histories and findings you chose to include, and download your uploaded files. This lasts until the link expires or you revoke it. The index shows each item's state, document name, dates, confirmation date and where you keep it. It never shows your notes, your incident timers, the incidents index, your other setup answers or your email address. You choose who gets a link.

We may disclose information when the law requires it, such as under a court order, or when it's needed to lessen a serious threat to someone's life, health or safety.

If Readyfile is ever transferred to a new owner, your information would go with it. We'll tell you before that happens, so you can delete your account first if you want to.

Overseas

Your setup answers, records and uploaded files are stored in Australia, in Supabase's Sydney region.

Some information is handled overseas. Your email address, and the content of emails we send you (such as your business name and which documents expire when), go to Resend in the United States. Your assistant questions go to Anthropic in the United States. Stripe may process payment details in the United States and other countries. Cloudflare may process your IP address and request logs in any country where it runs servers.

So the countries involved are mainly the United States, plus other countries where Stripe and Cloudflare operate. Our providers' staff may also access information from outside Australia to support or secure their services, even when it's stored here.

Cookies and local storage

Readyfile doesn't use advertising, analytics or tracking cookies.

We count visits with Cloudflare Web Analytics. It doesn't set cookies or store anything in your browser, and it doesn't try to identify individual visitors. It gives us totals, such as how many times each page was opened, which websites sent visitors, and which countries and kinds of device they came from.

If you arrive from one of our guide pages, a partner's link or a tagged link, your browser notes where you came from in its session storage. The note is deleted when you close the tab. If you sign up in that tab, we save it with your account, as described in “What we collect”.

When you sign in, your browser keeps your sign-in session in its local storage. This isn't a cookie, but it does the same job: it keeps you signed in on that device. It's removed when you sign out, or when you clear your browser's data for the site.

When you pay, you use Stripe's payment pages. Stripe sets its own cookies there, mainly for security and fraud prevention, under its own privacy policy.

Emails we send

We email you a sign-in link when you ask for one.

On the Pro plan we also email you before each date falls due, at the lead times the rule behind it needs: 180, 120, 60, 30 and 14 days before a mid-term audit, 90, 30 and 7 before a document expires and once after it has, and the day a corrective action plan is due. There is one Monday email with the next fortnight, and one register check-in on the first of the month. You can turn the reminders and the Monday email off on the Reminders page.

Two emails go to everyone, free or Pro, because they carry a deadline measured in hours: the confirmation when you start an incident timer, which repeats both of its deadlines, and a reminder when six hours of a 24-hour notice period are left.

If a Pro trial is ending we email you three days before. While Pro isn't on sale it is facts only: the date it ends, what stays and what stops, with nothing to buy. It carries our business details and a link that unsubscribes you without signing in anyway, as the Spam Act asks of an email that does offer something. Unsubscribing turns off the reminder emails and the Monday email too, and changes nothing else about your account.

Everything else is a service email about your account, not marketing. Stripe may also email you receipts, payment notices and its own trial reminder for your subscription.

How we keep it safe

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access, change or disclosure. These include:

• sign-in by one-time email link, so there's no password to guess or reuse
• encrypted connections between your browser and our services
• encryption of stored data by our database provider
• database rules that let each account reach only its own records and files
• columns the app can't write at all, so a register entry's “recorded on” date, a finding's rating and notice date and a timer's category and start time stay as first recorded
• private file storage, not public web addresses
• auditor links with long random codes that expire and can be revoked
• access by us only when needed to run, fix or secure Readyfile

If something goes wrong

If we learn of a data breach that's likely to cause serious harm, we'll act quickly to contain it. We'll tell the people affected and the Office of the Australian Information Commissioner (OAIC), following the Notifiable Data Breaches scheme.

If a breach affects files you've uploaded, we'll tell you as soon as we can, so you can meet your own obligations to your workers and participants.

No online service is completely secure. Please keep your email account secure, because anyone who can read your email can sign in to Readyfile as you.

How long we keep it

We keep your information while your account is open, so your records are there when you need them. You can delete entries and files at any time.

You can delete your account on the Your details page. This deletes your account, profile, records, uploaded files and auditor links, and cancels your subscription. Some information stays for a while after that:

• Stripe keeps payment records, as tax law requires.
• Our providers' backups and logs keep copies for a limited time, then delete them in their normal cycle.
• We keep messages you've sent us while we need them to deal with your request, a complaint or a legal issue.

Seeing and correcting your information

You can see and change most of your information yourself: your setup answers, business name, records and files. On any plan you can download your evidence index as a CSV. On the Pro plan you can also download a zip of your evidence with your files.

You can also ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We'll need to confirm who you are. We don't charge for this.

We'll respond within 30 days. If we can't do what you ask, we'll tell you why in writing and explain how to complain.

If you're a worker or participant and a provider has uploaded a document about you, please ask that provider first. They decide what goes in their records and can correct or remove it. You can also contact us, and we'll help where we can.

Complaints

If you think we've mishandled your personal information, email us at [email protected] with the details. We'll look into it and reply within 30 days with what we found and what we'll do.

If you're not happy with our reply, or we haven't replied within 30 days, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or call 1300 363 992.

Changes to this policy

We'll update this policy when our practices or the law change. The date at the top shows when it last changed.

If a change significantly affects how we handle your information, we'll tell you by email or in Readyfile before it takes effect.

Contact us

For privacy questions, requests or complaints, contact us using the details below.

You can ask for a copy of this policy in another form, free of charge.

• Email: [email protected]