Privacy

• You can search and contact providers without an account, and without giving your name, diagnosis or NDIS number.
• Your theme, saved providers, last search and location are remembered by your browser. Clearing site data removes them.
• We record visits and contact taps with a pseudonymous identifier. It is not anonymous. These records are scheduled for deletion after 90 days.
• We do not use advertising trackers or session recordings, and we do not sell or rent email addresses.
• Email contact@supportfinder.io for a copy, correction or removal of your information, or to make a privacy complaint.

You do not need to give us your name, diagnosis or NDIS number to search and contact providers. Avoid including sensitive personal information in searches or support requests.

Your browser can remember your theme, saved providers, last search and location. With your permission, coordinates are sent to our postcode lookup and can be retained in your browser for later searches. In the page address they are rounded to about 100 metres. Clearing site data removes these preferences. Requests also pass through our hosting provider.

Saved preferences use theme, supportfinder:shortlist, supportfinder:shortlists and supportfinder:location. Your saved lists, their names and any notes you write stay in your browser. A link you make with “Share list” carries the providers’ ABNs, the list name and, only if you choose, your notes, after the # in the address. Browsers don’t send that part of an address to us. Activity uses sf_vid. These tab settings last only until you close the tab: supportfinder:lastSearch, sf_ses_start, sf_sid and sf_utm.

For activity reporting, your browser stores a random visitor identifier and temporary visit and campaign information. Ordinary visitors do not receive an account cookie. Provider sign-in uses a four-hour session cookie and, once you have signed in, a 90-day cookie that lets us recognise your browser so a stranger cannot use up your sign-in codes. It holds no readable personal details and never replaces the emailed code.

We record activity and contact actions with a pseudonymous identifier, a random identifier for the current tab, country, device/browser category, referring site, screen width, time zone, visit duration and campaign source information. The identifier combines browser information with a keyed hash derived from your IP address and user-agent. It is not anonymous. Our activity records show that a search showed results, not what was searched for. When you follow a link to a provider’s website, the link carries our campaign tags but not your visitor identifier. Providers see aggregate reports, not visitor identities, and a count below 5 browsers is shown only as “fewer than 5”. Contact taps are not confirmed enquiries.

New activity records do not retain raw IP addresses, full user-agent strings, referring page paths or query strings, or campaign search terms. Older records may contain those fields until deleted. Activity records are scheduled for deletion after 90 days. Searches with no results, or that we answer with a corrected spelling, may be counted by day to improve matching, except a search containing an email address or a run of six or more digits, such as a phone number or ABN, which is not stored; these counts are scheduled for deletion after 90 days. A report that something is wrong with a listing keeps the listing, the kind of problem, any note you write and the time, and is scheduled for deletion after 90 days.

Listings combine an earlier provider dataset, Commission register and enforcement files, reviewed additions, and provider or administrator corrections. These sources have different fields and dates. A Commission refresh does not update every contact detail, profession or availability statement.

Details published through the portal appear on your listing. Enquiry addresses previously found on provider websites may also be held. Public contacts do not grant account access.

From your website: an optional invitation may use an address your website publishes for enquiries, subject to our outreach controls and suppression records.

Automated checks store results and evidence from business and Commission records, the listed website, whether the email domain is set up for email, and address matching. Source dates and check dates are recorded separately.

Listing access requests privately record your name, role, email, supporting details, request IP address and review history. Your account email stays separate from your public enquiry email. Reviewers confirm authority; email confirmation alone does not grant access.

Sign-in codes are stored as hashes and expire after ten minutes. Code records are scheduled for deletion after one day; expired session records after a further day. Failed administrator sign-in attempts are counted by IP address to slow guessing, and those counts are scheduled for deletion after 2 days. Listing-edit, check and account-access event histories are scheduled for deletion after two years. A backlog or outage can delay scheduled deletion.

The request IP address is removed 30 days after the request is made. If the email is never confirmed, the request’s personal details are removed 30 days after the confirmation link was sent. If a request is declined, or the access it granted is later removed, they are removed 180 days after that decision. What remains records the ABN, the outcome and its dates, so repeated requests can be recognised.

An account with no remaining listing access is deleted 180 days after its last access was removed. Account-access history records the listing, the change, its date, the reviewer’s reason and the name of the staff member who made the change, and is deleted after two years like the other histories. A request approved under our earlier process, with no sign-in account attached, has its personal details removed one year after approval; the listing details it approved are unaffected. Requests awaiting review, approved requests behind current access and accounts with current access have no fixed period: they are kept while that access is administered.

On a deletion request, we review what remains necessary, including security, legal and suppression records. Removing account access and removing a public listing are separate requests.

Resend delivers confirmation links, requested sign-in codes and account-review or security messages. Optional listing invitations include an unsubscribe link. Unsubscribing stops outreach; requested sign-in and necessary account messages can still be sent. Historic activity-renewal reminders are paused.

We retain suppression records so imports do not restart unwanted outreach. We do not sell or rent email addresses.

• Cloudflare: hosting, storage, security and network requests.
• Resend: email delivery and delivery outcomes.
• Plausible: site-usage measurement without advertising cookies, on public pages. It gets the page path and campaign tags, not your search words or location. It is not loaded in the provider portal.
• Cloudflare Web Analytics: page views and page-load timings, with the page address, the referring page, and the browser, device type and country Cloudflare reads from the request. It sets no cookies and does not use local storage. It is not loaded on the search page, the Check a provider page, the saved providers page, on provider pages (whose address briefly carries what you searched for, and is cleaned once the page has read it) or in the provider portal. Pages with no search words in the address still use it.
• Sentry: reports of errors on our servers. Request bodies, cookies and all but a few technical headers are removed, URL parameter values are redacted, and email addresses, phone numbers, NDIS numbers and IP addresses are stripped before a report is sent.
• Google Fonts: font requests from your browser.
• OpenFreeMap: map requests describing the area displayed in search or provider pages.

These services process information on our behalf or receive browser requests to deliver features. Processing may occur outside Australia. We do not use advertising trackers or session recordings.

Operated by Sam Young, a sole trader trading as Support Finder. ABN 73 921 039 985.

Email contact@supportfinder.io for a copy, correction, removal or privacy complaint. Include a listing link or ABN when relevant. We may confirm your identity or authority. Sam Young handles these requests.

Managers with listing access can edit or hide listings in the portal. You can also request help without an account. Suppression is preserved across imports. Official-register corrections must be raised with that source too.

If we need to retain information, we will explain why. Unresolved privacy concerns can be raised with the Office of the Australian Information Commissioner.

This statement forms part of our terms of use.