Privacy Policy

Sparks Support Pty Ltd operates Sparks Scribe and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to all users of the Sparks Scribe platform, website, and related services.

We collect personal information you provide directly, including:

• Your name, email address, and business or sole trader details

• Information you enter in the platform, such as client names, shift notes, and invoices

• Billing and payment data, processed securely via Stripe

• Metadata such as IP address, browser or device type, and platform usage patterns

• Support requests and other communications with our team

Participant and client information

Sparks Scribe is a documentation tool. Users may choose to enter information about the people they support, such as behaviour notes, communication needs, or medication details. When you do this:

• You are responsible for ensuring you have the authority, consent, or lawful basis to collect and store that information.

• You are responsible for the accuracy and appropriate handling of all information entered under your account.

• Sparks Scribe acts as a tool for your use. The responsibility for how participant information is handled rests with you as the user.

By entering this information, you confirm that you have the appropriate basis to do so and consent to its handling under this policy.

We collect your information when you:

• Register or log into the Sparks Scribe platform

• Use features within the app

• Contact us via email or support channels

• Browse the website via analytics tools and cookies

We use your information to:We use your information to:

• Provide and maintain the Sparks Scribe platform

• Process payments and manage subscriptions

• Communicate service updates and respond to support requests

• Improve our product and user experience

• Comply with legal, regulatory, or security obligations

We do not sell or rent your personal data to third parties.

AI features

Sparks Scribe includes optional AI-assisted features, such as note formatting assistance. These features may be used at your discretion and are never applied automatically. When AI assistance is used, the text you are working with may be processed by our AI provider (OpenAI). Before any text is sent for AI processing, participant identifiers such as names and NDIS numbers are removed. Your data is not used to train AI models. See our AI Use Statement for full details.

All Sparks Scribe data is stored on Australian-based servers, managed by Supabase using Amazon Web Services (AWS) Sydney region infrastructure.

Data protection measures

• Encryption in transit via TLS

• Encryption at rest using AES-256

• Row Level Security (RLS) for per-user data protection

• Strict internal access controls and audit logs

• Only authorised team members with a need-to-know basis can access your data

Content delivery

Some non-sensitive assets — such as interface images, fonts, and static files — are delivered via a global content delivery network (CDN) for performance. The authoritative origin of all user data, including client records, shift notes, and documents, remains on Australian-based servers. Sensitive information does not leave Australia.

We use trusted providers to help deliver Sparks Scribe:We use trusted providers to help deliver Sparks Scribe:

• Stripe — Payment processing

• Supabase — Hosting and secure data storage (Australian servers, AWS Sydney)

• SendGrid — Email communication

• Google Analytics — Website traffic insights (anonymised)

• OpenAI — Optional AI-assisted features only. Participant identifiers are removed before processing. Data is not used for AI training.

Some providers, including OpenAI, may process data outside Australia when you choose to use AI-assisted features. In all cases, we ensure compliance with APP 8 by working only with providers who maintain robust security and privacy standards.

We retain your personal data as long as needed to provide services to you, comply with legal obligations, and maintain business records. You may request deletion of your account and data at any time. Backups may take up to 30 days to purge fully after deletion.

Under Australian privacy law, you have the right to:

• Access your personal information

• Correct errors or outdated data

• Request deletion or export of your data

• Withdraw consent where applicable

• Lodge a privacy complaint

To make a request, contact us at info@sparksacademy.com.au. We will verify your identity and respond within 30 days.

If we detect a data breach likely to cause serious harm, we will notify affected individuals promptly, notify the Office of the Australian Information Commissioner (OAIC), and take immediate steps to contain the breach and prevent recurrence.

If you believe your privacy has been mishandled, please contact us at info@sparksacademy.com.au first. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at:

www.oaic.gov.au or 1300 363 992.

For privacy-related enquiries, contact info@sparksacademy.com.au or visit www.sparkscribe.ai.