Privacy Policy

Last updated 2026-10-18 (rev 3)

This policy describes how FitForAudit ("we", "us", "our") collects, uses, stores, and discloses personal information when you use the FitForAudit platform. Our customers are NDIS-registered service providers and their staff who create accounts, invite team members, and upload compliance evidence.

1. What information we collect

  • Account information — name, email address, hashed password
  • Organisation information — business/trading name, ABN, contact email, NDIS provider type and registration pathway
  • Team information — who is a member of your organisation's account, their role, invite email addresses
  • Compliance evidence — documents you upload and their filenames, type, size, dates, and which Practice Standards indicator they're tagged against
  • Compliance status — checklist status and any notes your team adds
  • Billing information — subscription tier and status, and a reference ID from Stripe. We never collect or store your card details.
  • Usage/audit logs — actions taken in your account with timestamp and the user who performed them
  • Technical information — IP address, browser type, access timestamps
  • Campaign information — if you arrive through one of our ads or links, which campaign it was (for example "utm_campaign" tags in the link), the page you first landed on and the referring website, stored with your account when you sign up
  • Live chat — anything you type into the chat window, plus the name or email you give there

We do not intentionally collect information about NDIS participants directly. Please avoid uploading unredacted participant-identifying information where the compliance evidence does not require it.

2. How we use your information

We use the information above to:

  • Provide, operate, and maintain the FitForAudit platform
  • Authenticate you and enforce access controls between organisations — each organisation's data is isolated from every other's
  • Generate your compliance dashboard, checklist, and audit-ready evidence packs
  • Send transactional emails: account verification, password reset, team invitations, and reminders
  • Process subscription billing via Stripe
  • Maintain security and an internal audit trail
  • Respond to support requests and comply with our legal obligations

We do not use your information for advertising, sell it to third parties, or send unsolicited marketing email.

3. Where your information is stored

Application data and uploaded evidence are stored on servers in AWS's Asia Pacific (Sydney) region, encrypted at rest, with public access blocked. Access to evidence files uses short-lived, expiring links rather than permanent public URLs.

4. Who we share your information with

  • Within your organisation: other members of your organisation's account, according to their assigned role
  • Service providers we use to operate FitForAudit: Amazon Web Services (hosting, storage, database, in the Sydney region), Resend (transactional email), Stripe (payment processing), tawk.to (live chat)
  • Meta (Facebook/Instagram): on our public website pages only, to measure our advertising (see "Cookies and tracking")
  • Legal requirements: if required by law, a court order, or to protect the rights, property, or safety of FitForAudit, our customers, or others

We do not sell, rent, or trade personal information to third parties for marketing purposes.

Disclosure outside Australia

Your compliance evidence and application data stay in AWS's Sydney region. Some information is processed overseas by two of our service providers: Resend, Inc. (United States) processes the email addresses, names and message content of the emails we send you, such as verification, password reset, invitations and reminders; Stripe processes billing contact and payment details in the United States and other countries where it operates; tawk.to (tawk.to, inc.) processes live-chat messages and visitor details outside Australia, including in the United States and European Union; and Meta Platforms receives advertising-measurement data from our public pages, processed in the United States and Ireland. We take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles.

5. Data retention

We retain your organisation's account data and evidence for as long as your subscription is active. If your free trial ends without converting to a paid plan, or your subscription is cancelled, your account access is suspended and your data is retained for 30 days, during which you can still generate and download an audit pack of your evidence, or contact us to request your data. After 30 days, your account data and evidence are permanently deleted. Audit log entries are retained for as long as the underlying account data is retained.

6. Security

We take reasonable technical and organisational steps to protect your information, including encryption of data at rest and in transit, restricted access to production systems, per-organisation data isolation, and an internal audit trail. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. See our security page for more detail.

7. Data breach notification

If we become aware of a data breach likely to result in serious harm to individuals whose personal information we hold, we will comply with our obligations under the Notifiable Data Breaches scheme, including notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as required.

8. Your rights

Under the Australian Privacy Principles, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate or out-of-date information
  • Make a complaint about how we have handled your personal information

To exercise these rights, contact us at privacy@fitforaudit.com.au. We will respond to access and correction requests, and to complaints, within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

9. Cookies and tracking

  • Essential cookies: session and CSRF cookies needed for login and security.
  • Campaign information: when you arrive from one of our ads or links, we note the campaign in your session and save it with your account if you sign up. This stays with us and isn't shared.
  • Meta Pixel (public pages only): our home page, pricing, security, Terms, Privacy, "check your email" and "email verified" pages load Meta's pixel. It tells Meta that a visitor from our ads viewed a page or completed signup (confirmed by verifying your email), so we can measure and improve our ads. Meta receives your IP address, browser details, the page address and a Meta cookie identifier. We've switched off the pixel's automatic data collection, so it doesn't read what you type into forms. The pixel never runs on the signup form or anywhere inside the FitForAudit app, so it never sees your compliance data. Meta handles this data under its own privacy policy.
  • Live chat (tawk.to): the chat widget sets its own cookies to keep your conversation connected.

You can opt out of the Meta Pixel on this device: . You can also manage ad preferences in your Facebook or Instagram settings, or block cookies in your browser.

10. Children's information

FitForAudit is a business-to-business platform intended for use by adult staff of NDIS provider organisations. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy from time to time. We will notify account owners by email at least 14 days before any material change takes effect.

12. Contact us

FitForAudit is operated by RP Partners Pty Ltd (ABN 53 632 703 532), trading as Alpha7 Technologies, Australia. Privacy contact: privacy@fitforaudit.com.au.