Privacy Policy
You hold some of the most sensitive records in the country. This page is the honest, plain-English account of what we do with data — and what we never do.
Last updated 21 July 2026 · Applies to tendaroo.com, app.tendaroo.com and the Tendaroo mobile app.
In plain English
- Your participant and worker data stays in Australia, encrypted, and is yours — you can export it any time.
- We never sell your data, and we never use care data to train AI.
- The app only reads your location when you clock in or out, and the camera only when you choose to attach a photo. Both need your permission and you can turn them off.
- You run the show: you decide what participant data goes into Tendaroo. We handle it on your instructions.
1 · Our role — and yours
Tendaroo is provided by SaaSForest Infotech Private Limited (“Tendaroo”, “we”, “us”). This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
When you use Tendaroo to manage your participants and workers, you are the organisation responsible for that information (the APP entity, and the NDIS-regulated party). You decide what to collect and why. Tendaroo is your data processor — we hold and process that information on your behalf, under your instructions and our agreement with you. Our handling of your organisation's own account and billing details, and of visitors to our website, is covered by this policy directly.
2 · What we collect
The information in Tendaroo falls into a few groups:
- Your organisation & account. Business name, ABN, your contact details, and the login details of the people you invite. Billing is handled by our payment provider — we never see or store full card or bank numbers.
- Worker records you enter. Names, contact and employment details, screening and compliance documents, availability and roster data.
- Participant & care records you enter. This can include sensitive information — health and disability details, NDIS numbers and plans, support notes, goals, incidents and consents. You collect and enter this as the responsible organisation; we hold it for you.
- Collected automatically by the app. Device and app version, a push-notification token, approximate location captured at clock-in/out (see §3), and diagnostic data if something crashes. The offline store on the device is encrypted.
- Website visitors. Our marketing site uses cookieless analytics — no visitor identifier, no cross-site tracking. If you fill in a form or start a trial, we collect what you give us.
3 · Location & camera on the mobile app
The worker app asks for two device permissions. We keep them narrow on purpose:
Location
Used only while you're using the app, and only to record where a shift was clocked in or out — as evidence of the visit. We do not track you in the background or follow your movements between shifts. You can decline or revoke it in your phone settings; clock-in still works, just without the location stamp.
Camera
Used only when you choose to attach a photo to an incident report or shift note. The app does not browse your photo library or access existing photos. You can decline or revoke it any time.
4 · Why we use it
We use information only to run the service you're paying for: to operate the platform and its features, sync the offline app, process your billing, provide support, keep the service secure, and meet our own legal obligations. Each part of the product is bound to the purpose it exists for — care records aren't repurposed for marketing, and we don't build advertising profiles.
6 · Our subprocessors
A short, deliberate list. Your participant and care records stay onshore in Australia; the only overseas services we use are operational ones that never carry participant records.
| Provider | What it does | Data location |
|---|---|---|
| Google Cloud | Hosting, database, document storage, backups | Australia (Sydney + Melbourne) |
| Stripe | Payment processing (card & bank debit) | Billing details only |
| Resend | Transactional email (invites, receipts, alerts) | Email metadata only — no care records |
| Firebase Cloud Messaging | Push notifications to the app | Device token + IDs only — no care records |
| Sentry | Error monitoring & diagnostics | Technical diagnostics only |
We keep a versioned subprocessor register and give notice before adding a new one that would touch your data. See Trust & security.
7 · Where your data lives
Your data is hosted, processed and backed up inside Australia — live in Sydney, with backups in Melbourne. Under APP 8, care data never crosses a border; that rule is enforced in the system, not just promised here. Full detail on Trust & security.
8 · How we protect it
Data is encrypted at rest and in transit, the most sensitive fields get an extra layer of encryption, and every view, change, export and signature is written to a tamper-evident audit trail. Access is controlled by the roles you set, and two-factor sign-in is required for anyone who can manage settings or export sensitive data. See Trust & security for the specifics.
9 · How long we keep it
While your account is active, we keep your data so the service works. Care, worker and audit records are held to the statutory 7-year retention that applies to NDIS providers, and are soft-deleted rather than hard-deleted within that window.
When you leave, we deliver a full export, hold your data for a 90-day safety window, and then crypto-shred your organisation's encryption keys so the data can no longer be read. The ongoing 7-year record-keeping duty transfers to you with that export, as set out in our data processing agreement.
10 · Your rights & choices
Under the APPs you can ask to access and correct the personal information we hold about you. In Tendaroo, corrections are saved as new versions — history is never quietly overwritten.
If you're a participant, worker, family member or nominee, the organisation that provides your supports controls your records, so please make access or correction requests to them in the first instance — they can action it directly in Tendaroo, and we'll support them. If you receive our marketing emails, every one has an unsubscribe link.
12 · Data breaches
We operate under the Notifiable Data Breaches scheme. If we ever confirm an eligible breach affecting your data, we commit to notifying affected providers within 72 hours so you can meet your own notification obligations, and we'll work with you on the response.
13 · Changes to this policy
We may update this policy as the product and the law evolve. We'll post the new version here with a fresh “last updated” date, and for material changes we'll give you reasonable notice by email or in-app.
14 · Contact & complaints
Questions, requests or a privacy concern? Email privacy@tendaroo.com and a real person will respond, usually within one business day.
If you're not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Tendaroo is a product of SaaSForest Infotech Private Limited, registered office No. 118, Block 5, 1st Floor, Rajparis, Mambakkam Main Road, Madambakkam, Chennai, Tamil Nadu 600126, India. Your participant and worker data is hosted in Australia.