Privacy Policy

myWattle is operated by Bravely Adventures Pty Ltd (ACN 691 789 296) trading as myWattle ("we", "us"). This policy explains how we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We built myWattle for NDIS providers, so we take this seriously — the information in this system can be sensitive, and it belongs to the people it's about.

1. What we collect

myWattle is a workforce and operations tool used by NDIS providers ("providers"). The information in the system falls into two groups:

• Account information we collect directly: names, work email addresses, roles and login records for the people a provider adds to their myWattle account, plus support and billing correspondence.
• Provider records the provider enters and controls: rosters, shift and clock-in records, worker compliance documents, progress notes, incident reports, participant records (including NDIS numbers, plans, goals and uploaded documents) and claim data. This can include sensitive information, such as health and disability information, which providers collect from participants under their own consent processes.

2. Why we collect it

We collect and hold information only to provide the myWattle service: running rosters, records and claims for providers; keeping accounts secure; providing support; meeting our legal obligations; and improving the reliability of the service. We do not use participant or worker records for marketing, profiling or advertising, and we never sell personal information.

3. Where and how it's stored

All data is stored in Sydney, Australia on infrastructure provided by DigitalOcean's Sydney region. Data is not transferred overseas. All traffic is encrypted in transit (HTTPS/TLS), passwords are stored as salted hashes, backups are taken nightly and encrypted with AES-256, and access to production systems is restricted to authorised personnel using key-based authentication only.

4. Who can see it

Access inside myWattle is role-based and tenant-scoped: workers see their own shifts and need-to-know briefings, house managers see their houses, and directors see their organisation. One provider can never see another provider's data. We access provider records only when needed to provide support (at the provider's request) or to keep the service running, and every access is logged in the audit trail.

5. Disclosure

We do not disclose personal information to third parties except: to our hosting provider (DigitalOcean, Sydney region) as part of running the service; where the provider directs us to (for example, an export they request); or where we are required to by Australian law. If our in-app assistant "Wes" is enabled, messages you type to Wes may be processed by an AI service to generate a reply — please keep participant and worker names out of chat, and Wes will remind you to do the same.

6. Access and correction

If you are a worker or participant and want to access or correct information held about you in a provider's myWattle account, contact that provider first — they control their records, and myWattle gives them full export and editing tools to respond to you. If you need our help, or your request is about information we hold directly (such as account or support records), email hello@mywattle.com.au and we'll respond within 30 days.

7. Data retention and deletion

Providers can export their full dataset at any time from within myWattle. When a provider closes their account, we delete their live data and let encrypted backups age out of the backup cycle, except where Australian law (including NDIS record-keeping requirements that apply to providers) requires longer retention by the provider — in which case the provider should export their records before closing.

8. Data breaches

We comply with the Notifiable Data Breaches scheme. If a data breach occurs that is likely to result in serious harm, we will notify affected providers promptly so they can meet their own obligations, and notify the Office of the Australian Information Commissioner (OAIC) as required.

9. Complaints

If you have a privacy concern or complaint, email hello@mywattle.com.au — a real person reads every message and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

10. Changes

If we change this policy, we'll update the date at the top and let account holders know about any material changes before they take effect.