Privacy Policy

• Identity information: full name, job title, organisation name
• Contact information: email address, phone number, postal or business address
• Account credentials: username and hashed password
• Payment information: billing name, billing address, and card details (processed directly by Stripe; we do not store raw card numbers)
• Profile and configuration data entered into the Services
• Communications you send to us including support requests and enquiries

• Usage and interaction data: pages visited, features used, session duration, click paths
• Technical data: IP address, browser type and version, operating system, device type
• Performance data: page load times, Core Web Vitals metrics (collected via Vercel Speed Insights in aggregated, non-identifiable form)
• Error and diagnostic logs

• Payment and fraud-risk signals from Stripe
• A session reference and a pass/fail verification result from identity verification providers used in RedRock PM's optional AML/CTF and KYC feature, with your prior express consent

Certain of our Services involve sensitive information as defined in the Privacy Act, including health information (in CoordHub, for NDIS support coordination purposes) and government identifiers such as Tax File Numbers (in RedRock PM). Where a firm enables RedRock PM's optional identity verification feature, biometric information is captured and held by the identity verification provider, not by RedRock PM. We only collect sensitive information with your express consent or where otherwise permitted by law. See the “Sensitive Information” section below for further detail.

• Providing, operating, and improving the Services
• Creating and managing your account
• Processing payments and managing billing
• Providing customer support and responding to enquiries
• Sending transactional communications (account notices, receipts, security alerts)
• Complying with legal and regulatory obligations

• Analysing aggregated usage patterns to improve product features
• Detecting and preventing fraud, security incidents, and abuse
• Conducting audits, investigations, and resolving disputes
• Sending product updates or marketing communications (only with consent; see APP 7)

We disclose personal information to the following categories of third-party service providers who process data on our behalf:

• Supabase Inc: database hosting and authentication, data stored in Sydney (AWS ap-southeast-2)
• Stripe Inc: payment processing and fraud detection (United States and global)
• Resend Inc: transactional email delivery. For this website, Resend processes mail from infrastructure in Tokyo, Japan (ap-northeast-1). Client-facing emails go through the firm's own Microsoft 365 account when the firm has connected one; otherwise, and for system emails such as reminders, invitations and billing notices, they go through Resend. The processing region for CoordHub's and RedRock PM's own use of Resend is not stated here
• Vercel Inc: serverless functions and application hosting for CoordHub, RedRock PM and this website, pinned to Sydney, Australia; static asset caching runs on a global edge network for all Services
• Microsoft 365: receives this website's enquiries in RedRock's own mailbox. RedRock PM also uses a firm's connected Microsoft 365 account to deliver client-facing email where that firm has connected one; its processing region follows that firm's tenant
• Xero: this is the customer's or firm's own connected Xero account, not a RedRock Systems sub-processor. CoordHub and RedRock PM integrate with it when a provider or firm connects their own account, and RedRock does not control where Xero processes that data
• AWS KMS: per-organisation envelope encryption key management for RedRock PM, Sydney, Australia (ap-southeast-2)
• Sentry: application error monitoring for CoordHub and RedRock PM. For RedRock PM, it is configured not to send default personal data, with a filter that redacts tax file numbers, email addresses, phone numbers and ABNs from error reports; the processing region is not stated here
• PostHog: product analytics for CoordHub (United States)
• Annature: e-signing for RedRock PM documents (Australia)
• Anthropic: AI-assisted processing of materials you provide during a workflow review or custom development engagement, used only under the written Discovery Agreement for that engagement and with your consent (United States)
• Inngest: background job and workflow orchestration for CoordHub and RedRock PM; the processing region is not stated here
• Upstash Redis: rate limiting for RedRock PM; the processing region is not stated here
• Google Maps: address geocoding for CoordHub's provider directory; the processing region is not stated here

Each of these providers is engaged under its own standard terms of service, or its data processing agreement or standard contractual clauses where it offers them, and is instructed to process personal information only as we direct.

We may disclose personal information to regulators, law enforcement, or courts where required by law; to professional advisers (lawyers, accountants, auditors) under obligations of confidentiality; and in the event of a business restructure, merger, or acquisition, subject to appropriate confidentiality obligations.

• Encryption in transit: TLS 1.2 or higher for all data in transit across all Services
• Encryption at rest: AES-256 encryption applied to all data stored in Supabase (AWS ap-southeast-2)
• Row-level security (RLS): database policies enforced at the storage layer to ensure tenant data isolation. No customer can access another customer's data
• Authentication: secure session management, hashed passwords (bcrypt), optional multi-factor authentication
• Access controls: principle of least privilege applied to all internal system access
• Audit logging: access and modification events logged for security review

• Access to production systems restricted to authorised personnel only
• Third-party providers vetted for security practices, and engaged under each provider's own standard terms of service, or its data processing agreement or standard contractual clauses where it offers them
• Regular review of access permissions

If a data breach is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC), as soon as practicable.

When personal information is no longer needed for any purpose for which it may be used or disclosed, and we are not required by law to retain it, we will take reasonable steps to destroy it or ensure it is de-identified.

CoordHub is used by NDIS support coordinators to manage participant support plans. Health and disability-related information may be entered into CoordHub by our customers (NDIS registered providers). This information is processed on behalf of the customer and is subject to the customer's own obligations under the NDIS Act 2013, the Privacy Act, and the NDIS Practice Standards. We act as a data processor, not a data controller, for this information.

RedRock PM includes an optional identity verification (KYC) feature, built on a third-party provider, to support customer identification obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act). As at the effective date of this policy, this feature is in pre-production and is not enabled for any customer.

When a firm uses this feature, the identity verification provider, not RedRock PM, captures identity document images and performs facial biometric checks directly, only with the individual's express consent. That biometric information is held by the identity verification provider, not by RedRock PM. For checks run through the provider, RedRock PM does not store document images or biometric data. We store only the document's metadata (document type, issuing authority, and relevant dates: document numbers are stored encrypted), the provider's session reference, and the pass/fail result of the check.

RedRock PM also offers an optional manual document upload path, where a customer can upload identity documents directly rather than using the provider's capture flow. Documents uploaded this way are stored in our own infrastructure (Supabase Storage, Sydney), not with the identity verification provider.

Once the verification result is received, RedRock PM asks the identity verification provider to delete that session, including the document images and biometric data it captured, and records whether the deletion succeeded.

We use session and authentication cookies that are strictly necessary to operate the Services. These cookies expire at the end of your session or after a short fixed period. They cannot be disabled without preventing you from using the Services.

We use Vercel Analytics and Vercel Speed Insights to understand how visitors use our website. These tools are privacy-focused: they do not set third-party cookies, do not use fingerprinting, do not track individuals across sites, and do not collect personally identifiable information. All analytics data is aggregated.

Email your complaint to hello@redrocksystems.com.au with the subject line “Privacy Complaint”. Please include as much detail as possible about the nature of your complaint. We will acknowledge receipt within 5 business days and provide a substantive response within 30 days.

If you are not satisfied with our response, or if we fail to respond within a reasonable time, you may lodge a complaint with the OAIC:

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001