Privacy Policy

Who we are

Sparks Flow is operated by Sparks Support Pty Ltd (ABN 93 669 152 103), located at T312, 1 Village Centre Way, Forest Glen QLD 4556. In this policy, "we", "us" and "our" mean Sparks Support Pty Ltd, and "you" means the account holder using Sparks Flow.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You can contact us about privacy at hello@sparksflow.app.

Information we collect

We collect the information needed to provide the platform. This includes:

• Account information: your name, email address, phone number, business name and address, and login credentials.
• Participant information you enter: the details of the people receiving support, which may include yourself if you self-manage. This can include their name, date of birth, contact details, NDIS number, NDIS plan dates and budget, goals, support needs and uploaded plan documents. Some of this is sensitive information, including health related information.
• Support worker information you enter: names, contact details, pay rates, availability, qualifications and compliance records such as checks and their expiry dates.
• Job applicant information: when someone applies to one of your job ads by email, we receive their email and any attachments (such as a résumé), and the personal details these contain. This is summarised with AI assistance to help you review applicants (see our AI Use Statement), and you can delete an application at any time.
• Shift and notes data: rosters, shift details, tasks, and the notes a worker submits at the end of a shift, which may include incident details.
• Payment information: handled by our payment processor (Stripe). We do not see or store your full card number.
• Messaging and usage data: records of SMS sent through the platform, and basic usage and device information collected when you use the site.

Sensitive and health information

Participant records can contain sensitive information, including health related information. We only collect it because you choose to enter it so that you can manage support, and we handle it with the higher protections the APPs require for sensitive information.

You are responsible for having the authority and consent needed to enter another person’s information into Sparks Flow, including a participant’s, and for telling them how their information will be used.

How we use information

We use personal information to:

• Provide, operate and improve the Sparks Flow platform.
• Send shift requests and end of shift notes prompts by SMS to the workers you roster.
• Process your subscription payments and issue tax invoices.
• Provide optional AI assisted features, such as drafting job ads, summarising job applications, analysing interview notes, and producing worker check-in and management summaries. These are suggestions you review and confirm. Reading a pasted NDIS plan to pre-fill a profile happens on your device and does not use AI. See our AI Use Statement for detail.
• Provide support, respond to enquiries, and send service related messages.
• Meet our legal and record keeping obligations.

Who we share it with

We do not sell your information. We share it only with the service providers that help us run the platform, under agreements that require them to protect it:

• Supabase, for secure database hosting, authentication and file storage.
• Stripe, for payment processing.
• Twilio, for sending SMS.
• OpenAI, for the optional AI assisted features described above.
• Vercel, for website hosting.
• Resend, for sending account, service and lifecycle emails.
• Microsoft Clarity, for analytics on our public marketing pages only, such as heatmaps and session replays of those pages. It does not run on the signed in app or on worker pages.
• Meta (Facebook), to measure the performance of our advertising. Where you interact with our public pages or create an account, we may share a securely hashed (irreversible) version of your email so Meta can attribute conversions. We never share participant or support worker information with Meta.

Overseas disclosure

Some of our service providers store or process data outside Australia, including in the United States. Where this happens we take reasonable steps to ensure your information is handled consistently with the APPs.

How we protect information

We use technical and organisational measures to protect personal information, including row level access controls so each account can only reach its own data, encryption in transit and at rest, secured access tokens for worker links, and restricted administrative access. No system can be guaranteed completely secure, but we work to protect your information and review our security regularly.

Retention and deletion

We keep personal information for as long as your account is active and as needed to provide the service and meet our legal obligations. You can ask us to access, correct or delete personal information we hold about you by emailing hello@sparksflow.app. After you cancel, your data remains accessible for 30 days, after which we take steps to delete or de-identify it, unless we are required to retain it by law.

Cookies and analytics

We use cookies and similar technologies to keep you signed in and to understand how the platform and website are used. This includes Google Analytics and a Meta (Facebook) pixel. On our public marketing pages only, we also use Microsoft Clarity (heatmaps and session replays of those pages) and may share a securely hashed version of your email with Meta to measure our advertising. These do not run on the signed in app or on worker pages, and we never share participant information with them. You can control cookies through your browser settings.

Your rights and complaints

You can contact us at any time to access or correct your information, or to raise a privacy concern, at hello@sparksflow.app. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the date above. Significant changes will be communicated where appropriate.