Privacy Policy

Our two roles

We hold personal information in two different ways, and who you should talk to depends on which one applies.

Records we hold for services. Services use QubieCare to keep their records — about their educators, the children in their care and those children’s families, incidents, complaints, self-assessments and Quality Improvement Plans. The service decides what to record and why, and it is responsible for those records under the Education and Care Services National Law and Regulations. We store and process them for the service, on its instructions and under our agreement with it. We do not use them for our own purposes.

Information we collect for ourselves. When you visit our website, contact us, create an account or pay for QubieCare, we decide what we collect and how we use it.

If you have a question about a record a service keeps about you or your child, the service is usually the best place to start. You can also contact us and we will help (section 9).

1. Personal information we collect

Records we hold for services

• Educator records — names, work email, phone, role, date of birth and address (regulation 147 of the National Regulations), Working With Children Check details, qualifications, teacher registration details, employment start date, a profile photo if one is added, and first-aid, anaphylaxis and child-safety training records. Where a service uses the ratio and attendance features, also planned rosters, when an educator signs in, goes on a break and signs out, and which room they are working in.
• Children’s enrolment and attendance records — where a service uses the children and rooms features: each enrolled child’s name, date of birth, address, gender, home language and cultural background, any special considerations (such as cultural, religious or dietary needs), and the other enrolment particulars the National Regulations require (regs 160–162), including parent and emergency-contact details, pickup authorisations, health information such as allergies, medical management plans, the child’s doctor and Medicare number (sensitive information), immunisation status, any court orders provided to the service, and per-child sign-in and sign-out times.
• Incident, injury, illness & trauma records — the details a service records when something happens to a child (regulation 87): which child, what happened and when, any injury or illness and the action taken, who saw it, which parent or guardian was told, any notification to the regulator, and who signed the record off. These name children and may name educators and witnesses, and include health information (sensitive information).
• Complaint information — the details a service records about a complaint or concern, which may name a child and identify an educator, and may include allegations. For a complaint, also the complainant’s contact details, whether they agreed to email updates, their preferred language, whether they need an interpreter, any accessibility or cultural-safety needs they mention, and whether a child raised it themselves.
• Quality & compliance records — self-assessments, Quality Improvement Plans, evidence and reports created in the platform, including the photos, videos and documents a service uploads as evidence, which may show or name children, families and educators. The service decides what to upload.

Information we collect for ourselves

• Account details — name, work email, phone, role, organisation, and sign-in and security settings such as two-step sign-in. When someone registers, we record when they accepted our Terms of Service and confirmed they had read this policy, and which versions. When someone accepts an invitation, we record when they accepted and which versions of the Terms of Service and this policy they were shown. When an administrator subscribes online for the organisation, we record when they accepted the Terms of Service and which version.
• Billing details — when an organisation subscribes, our payment provider, Stripe, collects the billing contact’s name, email and billing address, the organisation’s ABN if given, and payment details. We also send Stripe a reference number for the administrator who started the subscription, so we can match the payment to their account. Card details go straight to Stripe; we never see or store them. We keep our own record of the plan, its status and whether payments have gone through.
• Enquiries and messages — if you use our contact form, the feedback form in the app, or email us: your name, work email, role, the number of services you run and what you tell us.
• Email preferences — including any request to unsubscribe.
• Technical information — the IP address, browser or device, and the page or feature requested and when, in our server logs; the time of each person’s last sign-in; and the activity trail, which records the time of each entry and, for security actions such as a password or two-step change, the IP address and browser or device used.
• Privacy requests and complaints — what was asked and how we dealt with it.

Children’s records are the most sensitive information the platform holds. The children’s enrolment record is designed to hold only the particulars the National Regulations require a service to keep; notes, incident and complaint details and uploaded files are written or chosen by the service and can hold more, so the service decides what to put in them. Access inside a service follows each person’s role (an educator sees the full record only for the room they are working in), uploaded plans and documents are stored privately and reachable only through short-lived links, and changes to a child’s enrolment record and its documents are written to an activity trail.

2. How we collect it, and collection notices

• From services. Most information is entered or imported by a service’s staff. Parents, guardians and children do not use QubieCare. Where a service adds information about another person (an educator, a family member or a child), the service is responsible for telling that person and for having any authority or consent it needs.
• From you — when you create an account, accept an invitation, add educators, import data, log a complaint or an incident, upload evidence, subscribe or contact us.
• Automatically — our systems record technical information when you use QubieCare or our website (section 12).
• From others — for example, our payment provider tells us whether a payment went through.

Where practicable we show a short collection notice at the point of collection (APP 5), with a link to this policy.

3. Why we collect and use it (APP 6)

Records we hold for services are used only to provide QubieCare to that service: storing and showing its records, producing its reports, sending its notifications and reminders, supporting it when it asks, and keeping QubieCare secure and working.

Information we collect for ourselves is used to:

• set up and run accounts and keep them secure;
• send service and compliance messages, such as invitations, password resets and reminders about an expiring check or an overdue task;
• take payment, manage subscriptions, and keep business and tax records;
• answer enquiries and give support;
• find and fix faults;
• meet our own legal and regulatory obligations and deal with legal claims.

We do not sell personal information. We do not use it for advertising, and we never use information we hold for services to market to anyone. We do not use information for a materially different purpose without your consent unless you would reasonably expect it and it is related to the original purpose, or the law requires or permits it.

4. Sensitive information (APP 3)

Some of this is sensitive information under the Privacy Act: health information — a child’s allergies, medical conditions, medical management plans and immunisation status, the injuries, illnesses and treatment recorded in an incident record, and educators’ first-aid, anaphylaxis and child-safety training — and information that can reveal a child’s racial or ethnic origin or religious beliefs, such as cultural background or religious dietary needs. A complainant’s accessibility needs and cultural-safety considerations can be sensitive in the same way. We treat court orders about a child, Working With Children Check results and complaint allegations with the same care. We collect it only where it is reasonably necessary for the platform’s child-safety and compliance functions, and where you or the relevant service has provided it for that purpose. Service staff who log a complaint acknowledge our handling of it at the point of intake.

5. Disclosure & our service providers

We share personal information inside your organisation according to each person’s role, and with people your organisation chooses to give access to — for example an external assessor a service invites to help it prepare for assessment and rating, who sees only what the service gives them and never children’s records. When a service records a complaint and the complainant has agreed, we email the complainant updates on the service’s behalf. We also share information where the law requires or authorises it, such as a court order or to prevent a serious threat to someone’s safety. A service may give its own records to its regulator; that is the service’s decision.

Outside that, we share it only with the companies that run parts of QubieCare for us, and only as far as each needs to do that job:

• Supabase stores our database and the files uploaded to the platform.
• Google Cloud runs the application and keeps its technical logs.
• Resend delivers the emails the platform sends.
• Google Workspace runs our own email inboxes. Whatever you send us — to our privacy or enquiries address, through the contact form, or with the feedback form in the app — arrives there.
• Stripe takes card payments and manages subscriptions and tax invoices for organisations that pay for QubieCare.

Supabase, Google and Resend handle the information only on our behalf, under confidentiality obligations. Stripe does too, with one difference: as a regulated payments company it also uses payment information for its own purposes — to prevent fraud and to meet its legal duties — and it is responsible for that use under its own privacy policy. Section 6 explains which of these companies are overseas and what that means.

If the QubieCare business is transferred to a successor — for example a company set up to run it — the information would move with it and stay protected by this policy. We would tell account holders before that happens.

6. Where your data is stored, who can reach it, and what we send overseas (APP 8)

Your records are stored in Australia. Our database and the files uploaded to the platform sit in Supabase’s Sydney region, and the application itself runs on Google Cloud in Sydney. Both providers commit, in their contracts with us, to keeping that stored data in Australia. The one exception is the application’s technical logs — a record of each request, such as the internet address it came from and the page it asked for — which Google currently keeps in its worldwide log storage.

Supabase and Google are also global companies, and that is deliberate. Keeping a service running around the clock means someone has to be awake: their support and engineering teams work across time zones, so a fault at 3am Australian time is picked up by people who are at work somewhere else. To restore a backup, trace a fault or respond to a security incident, those staff — and the other companies in their corporate groups, and the subcontractors they use for the same work — may need to look at data that is stored here.

Australian privacy law does not only ask where data sits. It asks who can reach it. Because these people are overseas, the law treats this as disclosing personal information to overseas recipients, even though the data itself stays in Australian storage. We have assessed it that way, rather than relying on the Sydney location to claim that no overseas disclosure happens.

Some information does leave Australia:

• Email we send you. When the platform emails you — an invitation, a password reset, a notice that a check is expiring or a task is overdue — we hand the message to Resend, an email delivery company in the United States. Resend has no Australian location: it sends our email from its servers in Tokyo, Japan, and keeps a copy of each message and its delivery record in the United States for around 30 days. The message carries your name, your email address and whatever the notice is about.
• Email you send us. Our inboxes run on Google Workspace, which does not offer storage in Australia and keeps email in Google’s data centres around the world. Messages from the contact form and the feedback form pass through Resend on the way.
• Payments. An organisation that pays by card types its card details into Stripe’s own payment page; they never pass through QubieCare. Stripe keeps the billing contact’s name and email, the billing address, the ABN if one is given, and the payment history. We also send Stripe a reference number for the administrator who started the subscription, so we can match the payment to their account. Our payments contract is with Stripe’s Australian company, but Stripe stores and processes payment information in the United States, its Irish companies are responsible for parts of it, and it says it may also transfer information to India and to the other countries where its group companies and suppliers work.

The overseas recipients are these providers, their group companies, and the subcontractors they use to run and support their services. Between them they are located in the United States, Singapore, Japan, Ireland and India, and in a range of other countries where their support staff and subcontractors work — Google’s list alone names more than thirty. We do not keep a list of our own, because it would be out of date whenever a provider changed a supplier. Each provider publishes its own current list of the subcontractors it uses and where they operate: Supabase, Google Cloud, Google Workspace, Resend and Stripe.

We are required to take reasonable steps to see that those recipients handle your information consistently with the Australian Privacy Principles. Our steps are contractual — Supabase, Google and Resend each have a data processing agreement with us that:

• limits them to handling our data on our instructions, to provide the service;
• forbids them from using it for their own purposes or selling it;
• requires any subcontractor they bring in to be bound to equivalent obligations, and keeps the provider responsible for what that subcontractor does;
• requires them to tell us about a security incident; and
• requires them to return or delete our data when we stop using them.

Stripe’s agreement with us covers the payments work it does for us. For the purposes it pursues itself — preventing fraud and meeting its legal duties — Stripe is responsible under its own privacy policy, which tells Australians how to complain to Stripe and to the Office of the Australian Information Commissioner.

Two limits are worth stating plainly. These are the providers’ standard international agreements: they are enforceable, but they are written around European and United States privacy law, and none of them mentions the Australian Privacy Principles, so what we hold is the specific set of obligations listed above rather than a promise to follow the APPs as a whole. And choosing a provider does not move the responsibility off us — if your information is mishandled after it reaches them, we are still answerable to you for it.

We do not send personal information overseas for any other reason. We do not use it for advertising or analytics, and we do not sell it.

7. Security (APP 11.1)

We take reasonable technical and organisational steps to protect personal information:

• data is stored with providers that encrypt it in transit and at rest, and access is by role — each person sees only what their role and services allow;
• organisation administrators must use two-step sign-in, it is available to everyone, and accounts are protected against repeated password guessing;
• new passwords are checked against passwords exposed in data breaches, in a way that never sends the password itself;
• uploaded files are stored privately and reachable only through short-lived links;
• important changes are written to an append-only activity trail — changes to children’s enrolment records and documents, complaints, incidents, staff checks and qualifications, who has access, security actions such as password and two-step changes, exports, and billing;
• the operator console we use for support and billing shows account and billing details — not children’s records, complaints or evidence — and when we open a customer’s organisation, service or person record in it, that is written to the organisation’s own activity trail. Access to our databases and cloud accounts is limited to the people who run QubieCare, and is used only to operate, secure and support the service or when you ask us for help.

No system is perfectly secure, so we also maintain a data-breach response process (section 10).

8. Retention & destruction (APP 11.2)

We keep personal information only as long as it is needed for the purposes above or to meet record-keeping obligations, then de-identify or destroy it. Our internal data retention schedule sets the periods for each type of record. In summary:

• Records we hold for a service — while the organisation uses QubieCare, and for 12 months after it leaves, so it can come back or download its records. Then we destroy them, unless a law requires us to keep something longer. An organisation leaves when it tells us it is going, when we end the agreement, or when its workspace has stayed read-only for 12 months after a pilot or subscription ended: we then email its administrators, and at least 30 days later treat it as having left. So from the day a workspace becomes read-only, it is about two years and a month before its records can be destroyed. An organisation can ask us to destroy them sooner.
• Compliance records — complaints are kept as required and are soft-deleted rather than immediately erased. The activity trail cannot be changed or deleted, and is kept for 7 years.
• Accounts — when a person asks us to delete theirs, or one has been deactivated and unused for 7 years, we anonymise it, except for records a service must keep.
• Billing and tax records — at least 5 years, as tax law requires.
• Server logs — about 30 days. The security actions in the activity trail are kept for 7 years, as above.
• Backups — deleted information can stay in our daily database backups for up to 7 days, until those backups roll over. Uploaded files are not in these backups.
• Enquiries — only as long as we need to follow them up. We delete an enquiry when you ask us to.

Children’s records carry their own statutory minimums under regulation 183 of the Education and Care Services National Regulations: most records about an enrolled child must be kept for 3 years after the child’s last day at the service, and records connected to an incident, illness, injury or trauma until the child turns 25. While a service uses QubieCare, archiving a child keeps the record for those periods; a service that is leaving should download a copy of its children’s records first (Settings › Your data & privacy — section 12 of the Terms of Service) so it can keep meeting them. A parent’s deletion request is answered, but the service’s statutory record may have to be retained rather than erased, and we will say so rather than silently refuse.

9. Accessing and correcting your information (APP 12 & 13)

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. You do not need a form or a reason.

• If you have a QubieCare account, you can download a copy of your account and the main records about you under Settings › Your data & privacy; email us for anything else, such as your sign-in and break times or rosters. Correction and deletion requests you make there go to your organisation’s administrators, because they manage your records — they do not come to us. If you have not had an answer within 30 days, email us and we will follow it up.
• Anyone — with or without an account — can email privacy@qubiecare.com.au. Tell us who you are, which service (if any) your request is about, and what you would like.

Records a service keeps. If your request is about a record a service keeps in QubieCare — your child’s enrolment record, a complaint, or an educator record — the service decides what to give you or change. It may also know things we do not, such as a court order that limits what can be shared. With your agreement, we will pass your request to the service within 5 business days, tell you we have done so, and help it respond. If the service no longer uses QubieCare or cannot be reached, we will deal with your request ourselves.

What we will do. We will confirm we have your request within 5 business days and respond within 30 days — if we need longer, we will tell you why. We will check who you are, and for a child’s information that you are entitled to it, and ask only for what we need. There is no charge. If we refuse all or part of a request, we will tell you why in writing, unless that would be unreasonable, and how to complain.

Deleting information. We will delete what we can. But services must keep some records for set periods under the National Regulations (section 8), even when someone asks for them to be deleted. If that applies, we will tell you what is being kept, why and until when, and make sure it is used for nothing else.

There is more detail, and an email you can start from, on the Privacy & data requests page. You can browse our website and ask us general questions without telling us who you are; we need to know who you are to set up an account or to deal with a request about your information.

10. Data breaches

If we find out that personal information we hold has been lost, or accessed or disclosed without permission, we will act straight away to contain it and assess the risk of harm.

• If it affects records we hold for a service, we will tell that service within 72 hours of becoming aware, and give it what it needs to meet its own obligations, including under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act).
• If the breach is likely to result in serious harm, we will make sure the people affected are told what happened and what they can do to protect themselves — directly or through their service — and that the Office of the Australian Information Commissioner (OAIC) is notified where the law requires it.
• We will complete our assessment within 30 days, and record what happened and what we changed.

11. Communications & opt-out

We send two kinds of email, and they are not treated the same. Service and compliance messages — an invitation, a password reset, a check that is about to expire, a task that is overdue, a complaint that needs a response — are part of operating the platform and of the records your service relies on it to keep. They are not marketing, and we keep sending them while your account is active. Anything non-essential or promotional identifies us as the sender and carries a working unsubscribe link, as the Spam Act 2003 (Cth) requires. We send it only about QubieCare, and only to an organisation’s administrators or to people who have contacted us — never to educators, families or other people just because a service added them.

When you unsubscribe we record it against your email address rather than your account, so it holds even if you were only ever invited and never signed up, or you dealt with us over a complaint and never had a log-in at all. Every message except those about your own account or a complaint you are part of is checked against that record before it is sent. The unsubscribe link in an email stops the promotional mail; you can also switch off reminder emails by category under Settings › Notifications once you have an account, and you can ask us at privacy@qubiecare.com.au to do either for you. Messages about your own account or a complaint you are part of — a verification code, an invitation, a password reset, an acknowledgement of a complaint — are not marketing and cannot be switched off. We act on an unsubscribe straight away, and always within 5 business days. We keep the record of an opt-out after acting on it, so we can show that it was honoured. Our emails carry no tracking pixels or tracked links.

12. Cookies, local storage & logs

Cookies. We use only the cookies needed to keep you signed in and to protect the service: two sign-in cookies, a cookie that remembers your “stay signed in” choice, and a short-lived cookie used while you complete two-step sign-in. We do not use advertising or analytics cookies or tracking pixels, and we do not load scripts or fonts from other companies’ servers.

Local storage. Your browser keeps a small copy of who you are signed in as — your name, email, role and organisation — so the app loads quickly, and removes it when you sign out. It also remembers the service you last viewed.

Server logs. Like most websites, our systems record technical information when QubieCare or our website is used — the IP address, browser type, the page or feature requested and the time — to keep the service secure and fix faults. We keep these logs for about 30 days.

13. Complaints & contact

If you have a question or a complaint about how we have handled personal information, email privacy@qubiecare.com.au and tell us what happened and what you would like us to do.

• We will acknowledge your complaint within 5 business days.
• We will look into it fairly, and may ask you for more information.
• We will give you a written answer within 30 days, explaining what we found and what we will do. If we need longer, we will tell you why and when to expect an answer.
• If your complaint is about a record a service keeps, we will work with that service, with your agreement.

If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au (1300 363 992). The OAIC can tell you whether it can deal with your complaint and what other options you have.

14. Changes to this policy

We will update this policy when our practices change. The version and date at the top show when it last changed. If we make a significant change, we will email account administrators at least 30 days before it takes effect. Earlier versions are available on request.

15. Children

Children do not use QubieCare, cannot have accounts, and we do not collect information from children directly. Services record information about the children in their care because the Education and Care Services National Regulations require them to keep enrolment, health, attendance and incident records.

If you are a parent or guardian, your child’s service is responsible for these records and for answering your questions about them. You can ask the service directly, or contact us and we will pass your request on and help them respond (section 9).

16. Automated features

Some features work things out automatically so that a service’s people can act — for example flagging a Working With Children Check, qualification or training record that has expired or is about to; working out educator-to-child ratios from sign-in and sign-out times; showing an educator a child’s full record only while they are on the floor of that child’s room; and sending reminders when a complaint, incident or task is due. Some checks do block an action until a record is current — for example an assessment cannot be delegated to someone whose Working With Children Check or child-safety training has lapsed. Beyond that, none of them decides anything about a person’s employment, enrolment or care by itself. The service’s people make those decisions.

17. De-identified information & benchmarking

We do not combine different organisations’ records, or produce comparisons or benchmarks from them. If we ever offer benchmarking, it will be something each organisation chooses to join, it will use only combined figures from groups large enough that no service, child or person can be identified, and we will update this policy before it starts.