HomePrivacy Policy
Privacy Policy
How we handle your personal information
This policy explains how Shifto Connect collects, uses, stores and shares personal information when you visit our website, request support, create a provider account or contact our team.
Draft prepared: 6 October 2026 · Effective date: [CONFIRM before publication]
Draft for client review — not approved for publication.
This policy is proposed wording for Shifto Connect. Items marked [CONFIRM] must be completed and checked against the live system before this page is published.
Privacy at a glance
Care details help us connect you with relevant providers. Providers can see request previews and pay to unlock contact details, so a request is not an anonymous listing. More than one provider may contact you. You can ask us about your information, request a correction or raise a privacy concern.
1. Who we are and what this policy covers
Shifto Connect is operated by [CONFIRM: full legal entity name], trading as Shifto Connect (we, us or our). ABN: [CONFIRM: ABN].
We connect people seeking care and disability support with providers. Participants submit support requests; providers review opportunities and use purchased credits to unlock contact details. We do not deliver the care or manage participants’ NDIS plans.
This policy covers the Shifto Connect website, participant and provider accounts, messaging, credit purchases and support enquiries. It does not automatically cover a separate care business or a future Shifto product.
[CONFIRM] Identify the operating entity and explain any relationship with Australian Safe Care, including any shared administration, account access or information-sharing arrangements. Do not assume that a related business can use Shifto information for its own purposes.
2. Information we collect
The information we collect depends on how you use Shifto Connect.
- Care seekers and representatives: name, email, phone number, location, who support is for, support type, frequency, preferred start time, funding category, hiring intentions and details provided about the request.
- Providers: contact and business details, profile information and images, services offered, service locations, lead preferences and account verification information.
- Account and communication records: messages, enquiries, verification and login records, support-request status, lead unlocks and related activity.
- Purchases: credit packs, discounts, amounts paid, payment status, transaction references and billing information.
- Website information: technical records such as IP address, browser or device type, pages visited and referral information, where collected by the services described below.
Please provide only what is needed. Do not include passwords, full payment-card details, NDIS numbers, identity documents or detailed medical records in request descriptions, messages or general support enquiries.
[CONFIRM] Check this list against the final forms, verification process, activity tracking, server logs and any call-recording or analytics tools. Delete categories not collected and identify any additional collection.
3. How information reaches us
We collect information when you complete a form, create or update an account, submit a request, buy credits, exchange messages or contact us. Submitting a support request can also create a participant account.
Information can also come from an authorised representative, a provider responding to your request, a referral contact or a payment or technical service involved in operating the platform. Where relevant, we explain the source and purpose when that information is collected.
You can browse general information without creating an account. You can ask a general question anonymously or under another name where practical. We need accurate contact and request details to arrange connections, maintain accounts or respond to account-specific enquiries. Without necessary information, some services may not be available.
[CONFIRM] Describe any collection through advertising lead forms, support coordinators, public business directories or purchased contact lists before using those channels. A public email address is not, by itself, marketing consent.
4. Care information, consent and representatives
A support request or message can reveal information about a person’s health, disability or care needs. This is sensitive information and needs particular care.
We seek consent to collect and handle sensitive information that is reasonably needed to provide the requested connection service, unless the law permits or requires otherwise. The request form should explain the proposed handling before you submit. Reading this policy or browsing the website is not, by itself, consent to every use of your information.
When submitting information for another person, you must have their permission or appropriate authority to act for them. This also applies to requests concerning children. Being a family member or carer does not automatically establish that authority. We may need to check your authority and involve the person concerned.
You can contact us to discuss consent, withdraw consent for future handling that relies on it, or ask for help understanding the process. Withdrawal may mean we cannot continue matching your request. It does not undo information already shared or remove records we must lawfully keep.
5. Why we use personal information
We use information to run accounts, understand support requests, match them with provider services and locations, enable lead unlocks and conversations, process credit purchases and respond to enquiries.
We also use relevant records to resolve complaints, investigate misuse, maintain security, fix technical problems and meet legal obligations. Service analysis should use aggregated or de-identified information where practical.
Matching is based on information supplied by participants and providers. It is not a clinical assessment, an NDIS funding decision or a guarantee that a provider is suitable.
A new, unrelated purpose requires an appropriate legal basis and any necessary notice or consent. A Shifto request is not permission to promote unrelated products, add you to another business’s database or use your care details for unrelated marketing.
6. What providers and participants can see
Before a lead is unlocked: relevant providers can see a request preview in the platform and in lead notifications. This can include your displayed name, general location, support type, frequency, timing, funding category and information from your request description. Phone and email details remain masked in these previews.
When a lead is unlocked: a provider uses credits purchased from Shifto to access the contact details associated with that request and contact you by phone, email or Shifto message. More than one provider may unlock the same request. Providers pay Shifto for this access; participants do not pay to submit a support request.
A preview is not necessarily anonymous. Please keep personal contact details and unnecessary health information out of free-text descriptions, because those descriptions can be shown before unlocking.
Participants can see relevant provider profile information and responses. Once a provider receives information, it is responsible for its own handling of that information under applicable obligations. You can ask the provider about its privacy practices and contact Shifto about misuse.
[CONFIRM] Check every field shown before and after unlocking, recipient eligibility, email content and any maximum number of providers. The form’s sharing notice and consent must match that exact process. This draft does not promise a five-provider limit or participant approval before each unlock.
7. Messages and notifications
Shifto stores messages and related conversation records so the participant and provider can communicate through the platform. Email notifications can include the sender’s name and an excerpt of a message or request.
Authorised administrators and technical support personnel may need access to account information and messages to assist users, investigate complaints, maintain the service or resolve technical problems. Access should be limited to what is necessary for that task.
Phone calls or emails exchanged directly between you and a provider are not automatically recorded in the Shifto conversation. Avoid including highly sensitive information in an initial message or ordinary email; discuss an appropriate way to share additional documents directly with the provider.
[CONFIRM] Verify administrator permissions, support access, notification previews and any message-read or activity indicators. Do not describe chat as end-to-end encrypted unless that is actually implemented.
8. Service providers and payments
We use service providers to operate Shifto, including hosting and storage, development and maintenance, payment processing, message delivery and support systems. They receive or access information needed for their role, subject to the arrangements we put in place with them.
Credit-pack payments are processed using Stripe. We use transaction information to confirm payments, allocate credits, issue receipts and handle payment queries. Stripe’s handling of information is explained in its privacy policy.
Our website loads Komet through Adobe Fonts. Your browser contacts Adobe to display the font; Adobe receives technical delivery information, including your IP address. See Adobe’s Fonts privacy information.
We may disclose relevant information to professional advisers, regulators, law enforcement or other recipients where required or permitted by law.
[CONFIRM] List the actual hosting, email, SMS, development, support and other data-handling providers. Confirm what payment details Shifto stores, including tokens or limited card details, before making any claim about card-data storage.
9. Overseas storage and access
Using an Australian website does not necessarily mean all information remains in Australia. Hosting, service-provider support or authorised remote access can involve other countries.
Countries where information is stored or likely to be disclosed: [CONFIRM: list actual countries and the relevant services or access arrangements].
Where overseas handling occurs, we will take the steps required by applicable Australian privacy law. This may include assessing recipients and putting appropriate handling and security arrangements in place.
[CONFIRM] Check primary hosting, backups, Stripe, email/SMS systems, analytics and overseas administrator or developer access. Do not replace this with a general “worldwide” statement or claim Australian-only storage without checking. The published policy must identify likely recipient countries where practicable.
10. Cookies, analytics and advertising tools
Cookies and similar technologies can support login sessions, security and preferences. Your browser allows you to manage cookies, although blocking essential cookies can stop parts of the platform from working.
Tools used and what they collect: [CONFIRM: list enabled cookies, analytics, advertising pixels, conversion tracking and any email tracking; explain their purposes, recipients and retention].
Non-essential tracking choices: [CONFIRM: describe the consent or opt-out controls that actually exist and how to use them].
[CONFIRM] This section is not permission to install tracking. Audit Google, Meta and other integrations, including URLs and event data. Care requests, health/disability details, message text and identifying information must not be sent to advertising platforms without a specifically assessed lawful basis and compliance with the platforms’ rules.
11. Service messages and marketing preferences
We send messages needed to operate your account, such as verification or password-reset messages, request confirmations, payment receipts and conversation notifications. Providers can update service and location settings for matching lead alerts.
Promotional messages, including intro-offer reminders, are different from essential account messages. We send marketing only with the required consent or other lawful permission, identify Shifto as the sender and provide an easy way to unsubscribe. Marketing opt-out does not require you to close your account or log in.
We do not treat submitting a care request as consent to unrelated marketing. Consent to use sensitive information for marketing must be considered separately.
[CONFIRM] Check marketing consent records and suppression rules, add working unsubscribe links to promotional emails, and assess lead-alert emails on their actual content. Do not label every automated email “transactional”.
12. How we store and protect information
Information is held in the platform’s databases and the business systems used to operate and support it. Those systems can contain account records, requests, conversations, enquiries and payment records.
We take reasonable technical and organisational steps to protect information from misuse, loss, interference and unauthorised access, alteration or disclosure.
Safeguards in place: [CONFIRM: describe implemented access controls, secure transmission, password handling, backups, patching and staff/contractor confidentiality arrangements].
No online system can guarantee absolute security. If an incident occurs, we will assess it, take appropriate action and notify affected people and regulators where required by applicable law.
13. Retention, closed requests and deletion
Closing a support request is not the same as deleting your account, messages or records. Information already sent in notifications or accessed by a provider cannot necessarily be recalled.
We keep personal information for as long as it is needed for the purposes described in this policy or for legal record-keeping. When it is no longer needed and retention is not required, we take reasonable steps to securely destroy or de-identify it.
Retention periods or criteria: [CONFIRM: specify the approach for accounts, support requests, messages, support enquiries, transaction records, logs and backup copies].
Contact us to request account closure or deletion. We will explain what can be removed, what must be retained and any limitations. A provider may hold its own records separately.
[CONFIRM] Check whether closing or withdrawing a request stops further previews, notifications and unlocks, and how access by providers who already unlocked it is handled. Do not promise that closing removes all copies.
14. Access, correction and help with your information
You can update some details through your account and contact us to request access to personal information we hold about you or to ask for inaccurate information to be corrected.
We may need to confirm your identity or a representative’s authority. We will respond within a reasonable period and explain any lawful reason we cannot provide access or make a requested correction, together with available complaint options.
There is no fee to make an access request or request a correction. If a reasonable charge for providing access is permitted and proposed, we will explain it in advance.
Please tell us about any communication or accessibility needs. You can ask for help from an authorised representative or request this policy in another format.
15. Questions and privacy complaints
To raise a privacy concern, request access or correction, or discuss consent, contact the Privacy Contact, Shifto Connect.
Email: [CONFIRM: monitored privacy contact email]
Phone: [CONFIRM: published support number]
Online: Contact Us — please mention “Privacy” in your message.
Tell us what happened and the outcome you are seeking. We will acknowledge the concern, review the relevant information and explain our response. We aim to respond within 30 calendar days; if more time is needed, we will explain why and provide an update.
If you are not satisfied with our response, or we have not responded within a reasonable time, you can contact the Office of the Australian Information Commissioner (OAIC). The OAIC can advise whether it can consider your complaint. Other relevant regulators may also be available.
[CONFIRM] Nominate a responsible person, test the contact channels and approve the complaint-handling process and response target. Do not use an unmonitored notification address.
16. Changes to this policy
We will update this page when our privacy practices change and show the effective date. Where a material change requires additional notice or consent, we will address that before applying the change.
A policy update does not automatically authorise unrelated use of information collected previously.
Questions about your privacy?
Contact our team about your information, a correction or a privacy concern. Please avoid sending sensitive documents in your initial enquiry.