Privacy Policy

Bluetail Pty Ltd ("Bluetail") provides software for small NDIS providers: a registration document pack (policies, agreements, contracts and forms pre-filled with your business details) and a compliance CRM for keeping participant, worker and service records. This policy explains what information we collect and how we handle it. Our handling complies with the Australian Privacy Principles under the Privacy Act 1988.

What we collect

• Account details - your email address and password (used to sign you in).
• Business details you enter - your business or organisation name, ABN, contact name, email, phone, website and logo. These are filled into the documents you generate.
• Your selections - the registration categories you choose, so we can tailor your pack.
• Order details - your purchase status and a Stripe reference. We never see or store your card number.

You don't need to give us any information about your participants to use the registration pack, and we ask that you don't.

How we use it

• To generate your registration documents, pre-filled with your business details and logo.
• To process your one-off payment and send you a receipt.
• To provide support and to keep the service running and secure.

Your documents

The documents Bluetail generates are your business's documents- yours to keep, edit, sign and use. We don't claim ownership of them. They are built by plugging your business name, ABN, contact details and logo into our prepared templates - a simple text-substitution step, and your business details are not sent to any AI model during document generation.

The Bluetail CRM and participant information

If you use the Bluetail CRM, your organisation keeps its service records in Bluetail. Depending on what you enter, that can include participant records (names, NDIS numbers, plan details, goals, contact and emergency details, and health and disability information), worker records (screening checks, training, supervision and HR documents), shift notes, incident and complaint records, risk registers, rosters, and documents you upload.

Much of this is sensitive information under the Privacy Act. Your organisation collects it from your participants and workers with their consent, and remains responsible for it - Bluetail stores and processes it on your behalf, on your instructions. In practice that means:

• It stays in Australia.All CRM records and uploaded files are stored in Supabase's Sydney region.
• It is isolated to your organisation. Every CRM record is scoped to your organisation with database row-level security, so it is invisible to every other Bluetail customer. Uploaded files live in a private storage bucket and are only reachable through short-lived signed links generated for signed-in members of your organisation.
• It is never sold, shared or used to train AI. CRM records are never sent to any AI model.
• The built-in NDIS assistant cannot see your CRM records.By design it reads only a fixed NDIS knowledge base (legislation, Practice Standards, pricing and guidance). The questions you type are sent to Anthropic's Claude API to generate the answer; they are not stored by us and Anthropic does not use API data to train its models. The assistant does not need participant details to help, and will remind you not to include them.
• You can leave with your data.Ask us to delete your organisation's CRM data and we will remove it from production within 30 days; backups expire within 90 days. You can download your uploaded documents at any time before that.

Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme, and tell you plainly what happened, what information was involved and what we are doing about it.

Who can access your data

Only you.Your account and orders are protected by row-level security, so they're invisible to other Bluetail users. Bluetail staff have administrative database access for maintenance (patching, migrations, backups) but do not browse customer data in the normal course of running the service. We'd only ever access your records if you ask us to (for example, to help debug a problem) or if we are legally compelled by a valid court order or regulator. Access is logged.

Where your data is stored

On Australian infrastructure - Supabase's Sydney region.

Processors we use

• Vercel - hosts the app.
• Supabase - database, authentication and storage (Sydney region).
• Stripe - processes your one-off payment. Stripe handles your card details; we don't.
• Resend - transactional email (account verification, receipts).
• Anthropic - powers the optional NDIS assistant in the CRM. Only the questions you type and our NDIS knowledge base are sent; your CRM records are never sent, and Anthropic does not use API data to train its models.
• Google Analytics - aggregate site usage only (which pages are visited, from which region). No document content or account-identifying information is sent to Google.

Accessing, correcting and deleting your data

• You can ask for a copy of the information we hold about you, or ask us to correct it.
• You can ask us to delete your account and details - we'll remove them from production within 30 days. (You keep any documents you've already downloaded.)
• Backups are retained for up to 90 days for disaster recovery, then expire.

A note on our other tools

If you also use Bluetail's legacy Support Coordination tools, any participant information you choose to add there is likewise stored in your account on Australian servers, is never sold or shared, and is never used to train AI. AI features in those tools are opt-in per use.

Contact

Privacy questions: info@bluetail.com.au