Privacy Policy

1. Scope

This policy explains how Child Care Demand handles personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It covers the public website, the subscription product, and support interactions.

Report content is about places, services, and public planning records. It is not about individuals. The personal information we handle is mostly account and billing information about our users.

2. What we collect

• Account information: name, work email, and authentication identifiers, managed by our identity provider, Clerk.
• Workspace information: workspace name, membership, roles, and invitations.
• Billing information: subscription plan, seat count, and payment status. Card details are collected and stored by Stripe; we never see full card numbers.
• Usage information: pages visited, signups, workspace creation, checkout, trial and subscription lifecycle, report starts/completions/failures/views/refreshes/shares, share-link opens, comparisons, and product events collected in our application database, via Google Tag Manager / Google Analytics, and via PostHog when configured, plus standard server logs.
• Report activity context: report address, report name, report URL, report slug, report type, catchment, state, LGA, suburb or SA2 where available, workspace name, and the user account connected with the activity.
• Support correspondence you send us.

3. Why we collect it

• To operate the product: authentication, workspace access, report generation, and share links.
• To bill subscriptions and manage seats.
• To secure the platform, prevent abuse, and debug issues.
• To understand product usage, identify activation and churn risk, and improve features.
• To respond to support requests and send service notices.

4. Who we disclose it to

We disclose personal information only to the service providers that run the platform, each under their own security and privacy commitments:

• Clerk (authentication and user management)
• Stripe (payments and subscription management)
• Vercel (application hosting)
• Neon (database hosting)
• Google (Tag Manager and Analytics)
• PostHog (product analytics, when enabled)
• Mapbox and MapTiler (map rendering for reports)

5. Overseas disclosure

Some of these providers store data outside Australia, primarily in the United States. Where that happens, the disclosure is to deliver the service you signed up for, and we take reasonable steps to ensure providers handle personal information consistently with the Australian Privacy Principles. Our primary application database is hosted in the AWS Sydney region.

6. Security

Access to production systems is restricted and credential-based. Traffic is encrypted in transit, payment details never touch our servers, and webhook integrations are signature-verified. No internet service can promise perfect security, but we design so that a single compromised component exposes as little as possible.

7. Retention

We keep account, workspace, report activity, first-party analytics, and lifecycle alert records while your subscription is active and for a reasonable period afterwards for billing, dispute, support, product analytics, and audit purposes, then delete or de-identify them. Third-party analytics data is retained per the configured retention windows of the analytics providers.

8. Cookies and analytics

The product uses strictly necessary cookies for sign-in sessions. The public site uses Google Tag Manager / Google Analytics to measure traffic; these set analytics cookies. We also use first-party local storage and session storage identifiers to understand visitor sessions, registration drop-off, activation, and retention. Product analytics may use PostHog cookies or local storage when configured. Blocking analytics cookies does not affect product sign-in.

We do not collect passwords, authentication/session tokens, raw share-link tokens, full card details, API keys, webhook signatures, or credentials in analytics events.

9. Access, correction, and complaints

You can access and update most account details directly in the product. For access requests, corrections, deletion requests, or privacy complaints, email support@childcaredemand.com. We will respond within 30 days. If you are unsatisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Changes to this policy

We will update this policy as the product and our providers change, and will note the date of the latest revision at the top of this page. Material changes will be notified in-product or by email.