Privacy Policy
Last updated: Draft — pending legal review
[Attara Pty Ltd] (ABN [ABN]), trading as Provider Essentials ("we", "us", "our"), respects your privacy and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we do — and don't — collect, why, how we handle it, and your rights.
The short version: we built Provider Essentials to store none of your documents or your clients' information. The business and participant details you enter to generate a document are never saved to our systems. For pay-per-document use there are no accounts or passwords; if you subscribe, your subscription and billing details are held by our payment provider (Stripe), not by us. The only information we keep is the limited purchase record needed to take payment and meet our tax obligations.
1. Our privacy-first design — we store none of your documents or client data
Provider Essentials is a stateless document generator. When you generate a document, the details you enter — your business information, branding, and any participant or operational details — are sent to our server, used only in temporary memory for the few seconds it takes to render your PDF, and then discarded. We do not save them to any database, we do not write them to disk, and we do not log them. Once your PDF is returned, that information no longer exists on our systems and cannot be retrieved by us or anyone else.
The generator is a programmatic layout engine, not an AI system. Your information is never sent to any AI model or third-party language service, so there is no external party that could retain it, learn from it, or expose it. Every document template is engineered and reviewed by practising NDIS professionals.
Because we never store the contents of your documents, there is no store of participant information for us to lose, misuse, or have breached.
2. What stays on your device
Your convenience data — a saved business profile, your branding, draft documents, and your cart — is stored locally in your own web browser, on your own device. We don't receive a persistent copy of it.
Participant details, your draft documents, and your cart are held only in your browser's session storage and are cleared automatically when you close the tab — they never persist. Your own business profile and branding are, by default, remembered on your device (in your browser's local storage) so you don't have to re-enter them each visit; you can switch this off, in which case they too are cleared when you close the tab. This applies only to your own business details and never to participant information, and clearing your browser data removes everything.
3. The limited information we do collect
When you buy a document, we collect a small amount of information to take payment and meet our legal obligations:
- Payment information — processed securely by Stripe. We receive a confirmation and limited details such as the last four digits of your card and order metadata; we never receive or store your full card number.
- Purchase record — your email address (for your receipt and to deliver your finished documents to you), the type(s) of document purchased, the amount, and the date. We keep this to issue receipts and to meet our tax and record-keeping obligations. It does not include the contents of your documents.
- Document delivery — after you pay, we email your finished documents to you as PDF attachments so a failed download is never a lost purchase. To do this, the finished PDFs pass through our email provider (Resend) on the way to your inbox; we do not keep a copy, and they are discarded from our systems immediately after sending.
- Correspondence — if you email us or contact support, we keep that message and our reply so we can help you.
4. Who we share it with
We do not sell your personal information. We share the limited information above only with the service providers who help us operate, under appropriate confidentiality and data-protection obligations:
- Stripe — payment processing.
- Resend — sending your receipt, your finished documents (as attachments), and other transactional email.
- Our hosting/infrastructure provider — running the website and the generator. Your document content passes through it only transiently in memory to render your PDF, and is never stored there.
- Professional advisers or authorities — where required by law.
5. Overseas disclosure
Some of our service providers (such as Stripe, Resend, and our hosting provider) process data outside Australia, for example in the United States. Where this happens, we take reasonable steps to ensure your information is handled consistently with the APPs. By using the Service, you consent to these overseas disclosures for the purposes described above.
6. Security
Our strongest protection for the information in your documents is that we don't keep it — there is no stored copy to be accessed. For the limited purchase records we do hold, we take reasonable steps to protect your information from misuse, loss, and unauthorised access, including encryption in transit, access controls, and reputable infrastructure providers. No method of transmission is completely secure, but we work to protect your data and to respond promptly to any incident.
7. How long we keep it
We do not keep the contents of your documents at all — they are discarded as soon as your PDF is generated. The limited purchase records described in section 3 are kept for as long as needed to meet our legal, tax, and record-keeping obligations, after which they are deleted. The convenience data stored in your browser stays on your device until you clear it.
8. Cookies & local storage
We use only the cookies and browser storage necessary to run the generator and remember your preferences (such as your saved business profile and your current draft and cart). This data lives on your device, not on our servers. We don't use it to track you across other websites.
9. Analytics
To understand how the Service is used and to improve it, we use a privacy-friendly product-analytics tool (PostHog). It collects only anonymous usage information — for example which pages are viewed and which document types are started, previewed or purchased — associated with a random, non-identifying browser ID, never with you personally. We have configured it so that it does not record your screen, does not automatically capture what you type, discards visitor IP addresses, and honours your browser's “Do Not Track” setting. It never receives your name, your documents, or your clients' information. To opt out entirely, turn on “Do Not Track” in your browser.
10. Your rights
Under the Privacy Act you can request access to the personal information we hold about you — in practice, the limited purchase and correspondence records described above — and ask us to correct it if it's inaccurate. To do so, contact us using the details below. If you're not satisfied with how we've handled your information, you can complain to us, and you may escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
11. Changes to this policy
We may update this policy from time to time. The current version will always be available on this page, with the date it was last updated.
Contact us
Questions about this document? Email info@provideressentials.com.au — a human reads every message.