Privacy Policy

Information We Collect

NDIS Provider Finder collects information you give us when you use the site. For participants and carers, this can include your name, email address, phone number, suburb or postcode, the type of support you are looking for and any message you write when you send an enquiry, ask to see a provider's phone number or ask us to match you with providers. If you write a review, we collect your name, email address, rating and review; if the review is published, your name, rating and review appear on the provider's page, but your email address does not. For providers, we collect organisation name, ABN, contact details, service information and details of paid plans. Card details are entered on Stripe's payment page and are held by Stripe, not by us. When anyone signs in, we record their email address and, for security, the IP address and browser used.

We also collect information about how the site is used, such as the pages visited and the search terms entered, including through the Google and Meta tools described below.

We do not ask for health records, disability diagnoses or NDIS plan details. If you choose to include information like this in an enquiry, message or review, it is stored with that enquiry, message or review and shared only as described in this policy. The contents of enquiries, messages and reviews are never sent to Google or Meta.

How We Use Your Information

We use the information we collect to operate and improve the directory, respond to inquiries, process provider registrations, and send relevant communications such as account notifications and service updates. We may use aggregated, de-identified data to understand how the platform is used and to improve search results and recommendations.

We do not sell your personal information. We share it only in the ways described in this policy: with the provider you send an enquiry to, with the service providers that help us run the site, and with Google and Meta as set out in the sections below.

Enquiries

When you send an enquiry, ask to see a provider's phone number or ask to be matched with providers, your details and message are saved on our system and our team can see them.

If your enquiry is about a particular provider, we pass it to that provider. A provider who manages their listing on our site can see enquiries sent to them in their provider account (on the free plan, with your contact details partly hidden), and we may also email your enquiry to the provider. An enquiry that does not name a provider, such as a matching request, is seen by our team, who use it to help you find suitable providers.

Analytics and Advertising

Google Analytics

Every page of this site uses Google Analytics 4, a Google service that shows us how the site is used. When you view a page, Google receives the address of that page, including provider, service category, region and search pages and the search words and filters in a search address. It also receives your IP address (which Google uses to estimate your approximate location), details of your device and browser, and the address of the page you came from. Google sets its own cookies, whose names start with _ga, to recognise your browser on later visits. Before a page address is sent to Google, our site removes other information carried in it, such as the details you type into our enquiry form and the codes in sign-in, review and unsubscribe links.

Meta Pixel

Some pages use the Meta Pixel, a tool from Meta (the company behind Facebook and Instagram) that helps us measure our advertising. It loads only on these general pages: the home page, About Us, Contact Us, How It Works, NDIS Guide, NDIS Resources, Participant FAQs, Sitemap, For Providers, Register as a Provider, Provider FAQs, Pricing & Plans, Privacy Policy, Terms of Service and Accessibility.

On those pages, the pixel tells Meta that the page was viewed and sends the page address, your IP address, details of your browser and device, and the address of the page you came from. If you came from a page on our site that is not on the list above, Meta receives only our site's web address, not that page. The pixel sets a cookie called _fbp, and a cookie called _fbc when you arrive from a Meta ad. If you are logged in to Facebook or Instagram in the same browser, Meta may link this information to your account.

The Meta Pixel is not loaded on service category, region, provider profile, search or browse pages, on the enquiry, matching or quiz pages, or on sign-in, account, claim, review or unsubscribe pages. It is also not loaded on any page whose address carries search words, form answers or anything other than a page number or advertising campaign tags.

Information Our Servers Send to Meta

Separately from the Meta Pixel, our server sends Meta a small number of events about providers, using Meta's Conversions API. This happens only when a provider:

• creates an account with a sign-in link requested from a listing’s claim page, from our Pricing & Plans, For Providers or Register as a Provider page, from a link to upgrade to a paid plan, or from the provider dashboard;
• submits a claim for a listing;
• follows a link to upgrade to a paid plan from inside the provider dashboard;
• starts a checkout for a paid plan; or
• starts a paid subscription.

Each event contains the name of the event and when it happened; the provider's email address, converted into a SHA-256 hash (a scrambled code that Meta can still use to match the event to a Meta account with the same email address, so it is not anonymous); the IP address and browser details used; the Meta cookie identifiers (_fbp and _fbc) if present; and at most the first part of the page address where it happened (for example our pricing or claim section), never the address of a provider's listing. Checkout and subscription events also include the plan, whether it is billed monthly or yearly, the price and the currency. Upgrade and checkout events also include the plan and billing period chosen and which part of our site or dashboard the provider started from (for example the pricing page or the dashboard’s leads section), never which listing.

Our servers send Meta nothing about participants, carers or other visitors. We do not send Meta your enquiries, phone number requests, matching requests, reviews, support requests or the contents of any message, anything you type into search, or which providers or service categories you viewed or contacted.

Cookies

Our site sets its own cookies only to complete a sign-in and to keep you signed in. Google Analytics and the Meta Pixel set the cookies described above.

Service Providers We Use

• Stripe processes payments for providers' paid plans. Stripe receives the provider's email address, the listing and plan chosen, and the card details entered on its payment page. When a provider starts a checkout, we also store that provider's IP address, browser details, Meta cookie identifiers (if present) and the part of our site the checkout started from on the subscription record at Stripe, so that the later subscription event sent to Meta can be matched to the checkout. These details stay on the Stripe subscription record.
• Email: the emails we send, such as sign-in links, go through Google's email service.
• Hosting: our website and its database run on a server we rent in Germany.
• Fonts and page files: our pages load fonts and display files from Google Fonts, cdnjs and the Tailwind CSS content network. These services receive your IP address and browser details when your browser fetches the files.

Information Held Outside Australia

Google, Meta and Stripe store and process information outside Australia, including in the United States, and our own server is in Germany. This means the information described in this policy is sent to and held in countries other than Australia.

Your Rights and Choices

You have the right to access, correct, or request deletion of your personal information at any time. To exercise these rights, or to ask a question about this policy, contact us at support@ndisproviderfinder.net.au. We will respond to all privacy requests within 30 days. You may also opt out of marketing communications at any time using the unsubscribe link in any email we send.

You can also limit tracking yourself:

• Your browser settings let you block or delete cookies, and content blockers and privacy settings in your browser can stop Google Analytics and the Meta Pixel from loading.
• Google offers a Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.
• If you have a Facebook or Instagram account, you can review and limit how Meta uses information from other websites in your Meta ad preferences and in the "Your activity off Meta technologies" settings in Meta's Accounts Centre.

This Privacy Policy is governed by the Australian Privacy Act 1988 and the Australian Privacy Principles. If you have a complaint about how we handle your personal information, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.