Privacy Policy

NDIS Invoice ("we", "us") is an independent Australian tool that helps sole-trader support workers produce NDIS invoices. We are not affiliated with, endorsed by, or connected to the NDIA or the NDIS.

We handle information about NDIS participants, which is sensitive information under the Privacy Act 1988 (Cth). We build to the Australian Privacy Principles (APPs) regardless of our size, and we do not rely on the small-business exemption.

What we collect

• Account information: your email address, and the sign-in records needed to keep your account secure.
• Your business details: business name, ABN, contact details and payment details that you choose to put on your invoices.
• Information you enter about participants: name, NDIS number, shift dates and times, supports delivered, shift notes, and any files you attach. Some of this is sensitive information about the participant's health or disability supports.
• Technical information: basic security and error logs. We do not use third-party advertising or analytics trackers.

How we store it

Your data is stored in a PostgreSQL database hosted in Sydney, Australia (Supabase, ap-southeast-2), encrypted in transit and at rest. File attachments are held in a private storage bucket that only your account can read. Row-level security means each account can only ever read and write its own records.

Overseas processing when you use AI capture

This is the one place your information leaves Australia, and only if you choose to use the capture feature.

• Typed or dictated shift descriptions: when you use "capture", the text you enter is sent to Anthropic (United States) to extract scheduling fields such as the date, times and support type. The text you type is sent as you wrote it, so it may include a participant's first name and details about their supports.
• Voice: if you record a shift, the audio is sent to Deepgram (United States) to be transcribed, then discarded. We never store your audio.

Neither provider uses this content to train their models, and neither retains it for their own purposes. We never send rates, invoices, NDIS numbers, bank details or your client list to either provider.

If you would rather no information leave Australia, do not use the capture feature. Typing shift details straight into the shift form keeps everything in Sydney.

You need the participant's consent

You are the one with the relationship with the participant. Before you enter a participant's information, you must have their consent (or their nominee's or guardian's) to record it in a tool like this for invoicing. We rely on you for that consent.

What we never do

We do not sell your data. We do not share it with other users. We do not use it for advertising. We do not use your invoices, clients or shift notes to train AI models. We do not run third-party trackers on the app.

Access, correction, export and deletion

You can view and correct everything you have entered from inside the app at any time. You can ask us to export your data or delete your account and everything in it by emailing support@ndisinvoice.com.au. We will action deletion requests within 30 days. Some records may persist briefly in encrypted backups before they age out.

Data breaches

If a breach happens that is likely to cause you or a participant serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

How long we keep it

We keep your data while your account is open, and for as long as you may need it for your own tax and NDIS record-keeping obligations. Delete your account and we remove it.

Complaints

Email support@ndisinvoice.com.au and we will respond. If you are not satisfied with how we handled it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

Changes

If we change this policy we will update the date above and, for anything significant, tell you in the app.

Read our Terms of Service