Privacy Policy

1. About This Policy and Our Services

This Privacy Policy explains how ChildSupport Direct (trading as Australian Child Support Calculator) collects, uses, discloses, stores, and protects your personal information across all of our services:

• Free Calculator Tool — an online child support estimator that does not require you to create an account or submit personal information.
• Firm Contact Requests — optional firm-owned request forms, where available, that let you ask a named Client Firm to contact you. AusChildSupport does not match, screen, assign, or chase consumer legal matters from the Platform Site.

We apply the commitments in this policy across the services described above. Where the Privacy Act 1988 (Cth) and the APPs apply, they govern that handling; we offer the stated privacy contact processes in any event.

2. How Firm Contact Requests Work

When a firm-owned page offers a Contact Request and you choose to submit it, the following steps occur:

No platform matching: AusChildSupport does not route Platform Site visitors into a lawyer-matching queue. If a firm does not respond to a Contact Request, contact that firm directly.

3. Information We Collect

We collect personal information directly from you when you use the calculator, submit a firm-owned Contact Request, or contact support. We only collect information that is reasonably necessary for the purposes described in this policy (APP 3).

3.1 Firm Contact Requests

3.1A Conflict-Check Details Handoff

This optional capability is not enabled by default. If it is enabled for a particular Client Firm after the required agreement, legal/privacy review, approved firm privacy-policy URL, operational approval, and tenant activation, the collection notice shown before submission will identify that firm, the two names collected, and the short retention period. After an eligible Contact Request is already complete, you may then be offered the separate optional handoff. It collects only your full legal name and the other party's full legal name so that the named Client Firm performs its own conflict check. AusChildSupport does not perform or record the conflict check.

Skipping this optional handoff does not affect the Contact Request you already submitted. The firm may ask you for the names later. Do not provide a case narrative, documents, dates of birth, addresses, case numbers, or other information through this handoff.

For access, correction, deletion, or a privacy complaint about the platform copy, email privacy@auschildsupport.com.au. Platform access ends exactly 14 days after submission and the encrypted copy is deleted during the following daily retention run, within 24 hours. The firm handles its received copy under its own privacy policy.

3.2 Support and Professional Enquiries

The support or professional-enquiry form may collect your name and email address, the selected request category, and any firm or business name, website, role, area of interest, planned traffic source, or message that the form asks for and you choose to provide. The application sends the submission through our email-delivery path. Please do not include documents, detailed case narratives or sensitive information unless we ask for it.

3.3 Technical and Usage Data

3.4 Administrator Accounts (Law Firm Users)

If you register as a law firm user of our platform, we collect your name, work email address, and a one-way password hash. We do not store passwords in plain text or in reversibly encrypted form. This information is used solely to authenticate your account and manage your access to firm platform features.

3.5 Sensitive Information

3.6 Calculator-Only Use — Anonymity

You may use the child support calculator without providing any personal information. Calculator inputs and results are used only to display your estimate in-browser and are NOT stored or retained after your session ends. If you choose not to submit a Contact Request or support form, no direct contact details are collected.

3.7 Unsolicited Information

If we receive personal information we did not request (for example, if someone emails us unsolicited sensitive details), we will assess whether we could have collected it under APP 3. If not, we will destroy or de-identify it as soon as practicable, unless we are required by law to retain it.

4. Why We Collect This Information

We collect personal information for the following purposes where it is reasonably necessary for one or more of our functions or activities. Where the APPs apply, APP 3.2 applies to personal information other than sensitive information and APP 3.3 applies to sensitive information.

• Providing child support estimate calculations.
• Facilitating firm-owned Contact Requests where you explicitly submit one to a selected Client Firm.
• Transferring optional Conflict-Check Details to the named Client Firm after a Contact Request is complete, where you separately acknowledge that purpose.
• Processing and verifying payments via Stripe.
• Communicating with you about your inquiry or purchase.
• Meeting legal, regulatory, tax, and reporting obligations.
• Improving calculator accuracy and website performance using aggregated, de-identified data only.

What happens if I don’t provide information? Use of the calculator requires no personal information. However, if you submit a firm-owned Contact Request or support form, we need enough contact information to process that request. If you do not provide optional Conflict-Check Details, the completed Contact Request is unchanged and the Client Firm may request the names directly later.

5. How We Use and Disclose Your Information

5.1 Consent for Firm Contact Requests

We will NOT share your personal information with a Client Firm without your explicit, informed consent. Consent is obtained as follows:

• On a firm-owned page or branded calculator, you may be offered the option to ask that firm to contact you.
• A consent form will be displayed, clearly explaining what information will be shared, which firm will receive it, and for what purpose.
• You must tick a consent checkbox with language that clearly authorises disclosure to the named Client Firm for follow-up about your request.
• Pre-ticked checkboxes are not used. Consent must be an affirmative act.
• Your consent timestamp and IP address are recorded as an audit trail.
• You may withdraw consent before your information is shared with the selected Client Firm by emailing privacy@auschildsupport.com.au.

5.2 What Client Firms Receive

5.3 Client Firm Obligations — Data Sharing Agreement

Before a Client Firm can access Contact Request details, it must accept the current Data Sharing Agreement. Under this agreement, firms are contractually required to:

• Handle your information in accordance with the Australian Privacy Principles.
• Use your information only for the purpose of responding to your Contact Request.
• Not sell, resell, reroute, broker, or otherwise pass your Contact Request data to another business as a lead.
• Not use your information for unrelated marketing without your separate consent.
• Not use Contact Request data for model training, profiling, or unrelated product development.
• Delete your information if you do not proceed to engage their services.

5.4 Use of Information for Service Improvement

We may use aggregated, de-identified data to improve our calculator and services. This data cannot be linked back to any individual. We do not use identifiable personal information or Contact Request payloads for service improvement, model training, profiling, or unrelated marketing.

6. Third-Party Service Providers

This register identifies providers that may handle information for currently supported AusChildSupport services. A provider is listed only for the feature and data categories described below; listing does not mean every provider is used for every visitor or Client Firm. We do not sell personal information to data brokers or unrelated third parties for commercial purposes. Firm Contact Request data is not sold, resold, rerouted, brokered, or used as a paid lead resale product.

We may also disclose information to professional advisers, insurers, government agencies, regulators, courts, or law enforcement where reasonably necessary or legally required.

6.1 Product Feature Data Flows

6.2 Subprocessor and Provider Register

Register last reviewed: 1 August 2026. The register is maintained from typed application data, but repository source does not establish deployed provider configuration, contractual role, processing region, or provider retention. Location entries are bounded descriptions from the register and are not an Australia-only residency promise.

6.3 Material Subprocessor Changes

Before adding a provider that will process Client Firm personal information, or materially changing a listed provider's purpose or processing location, we complete privacy, security, contractual, location, retention, and data-flow review. The provider does not receive production data until that review is approved and this register is updated.

We notify affected Client Firms through their nominated operational or privacy contact at least 30 days before the new provider begins processing. The notice identifies the provider, purpose, data categories, expected processing locations, intended effective date, and a contact path for reasonable objections. If an urgent security, availability, or legal requirement makes advance notice impracticable, we notify affected Client Firms as soon as reasonably practicable and record the reason for the exception. Contractual details are set out in our Terms of Service.

7. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or as required by law (APP 11.2).

When personal information is no longer required, it is securely deleted using industry-standard deletion methods or permanently de-identified so that it can no longer be linked to an individual.

8. Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure (APP 11).

Security measures include:

• Encryption of browser-to-service traffic in transit using HTTPS/TLS.
• Role-based access controls and least-privilege principles — staff access personal data only when necessary.
• One-way hashed storage of administrator passwords; plain-text passwords are never stored.
• Application-level encryption for selected sensitive fields, including Contact Request payloads and MFA secrets, with Contact Request envelopes currently using AES-256-GCM.
• Separate application-level encryption and purpose binding for Conflict-Check Details, with names revealed only through an audited, non-cacheable firm portal action.
• Tenant-scoped HMAC lookup for Contact Request deduplication, authenticated firm admin access, short-lived export tokens, and audit trails for Contact Request access and export activity.
• Provider-managed database, storage, backup, logging, and infrastructure security controls for records and files that are not separately encrypted by the application.
• Regular security reviews and vulnerability assessments.
• Formal incident response procedures including escalation, containment, and notification processes.

Not every database field is separately encrypted by application code. Where this policy refers to encrypted Contact Request payloads, MFA secrets, token hashes, password hashes, or contact HMACs, it refers to those specific implementation controls rather than blanket application-level encryption of every database column.

8A. Enterprise Security Commitments

Security commitments for Client Firms, procurement teams, and enterprise reviewers are maintained separately from this consumer Privacy Policy. The current public security commitments are available at auschildsupport.com.au/security.

The security page describes the implemented controls, the limits of application-level encryption, incident response expectations, vendor dependency boundaries, and the procurement material we can provide under an appropriate business review process.

9. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. When you first visit, a cookie consent banner will be displayed and analytics cookies will only be set if you actively consent.

Microsoft Clarity is loaded only after analytics consent. Internal admin sessions may be identified in Clarity with the custom ID sam-admin and tagged with internal_user=true plus the current application environment.

You may withdraw analytics consent at any time using Cookie Settings or by adjusting your browser settings. Withdrawing analytics consent does not affect your ability to use the calculator, Platform Support, or firm Contact Requests where available.

10. Your Rights

You may ask us to provide access to or correct personal information we hold about you. Where the Australian Privacy Principles apply, APPs 12 and 13 govern those requests; we offer the contact process below in any event.

There is no charge to make an access request or to request or receive a correction. If providing access would involve a reasonable, non-excessive charge, we will tell you beforehand. If we refuse a request where the law requires reasons, we will provide written reasons and complaint options.

11. Cross-Border Disclosure of Personal Information

We prefer Australian regions where practical, but we do not claim Australia-only data residency unless we have verified the full chain of production dependencies, backups, logs, support access, and failover paths for the relevant service.

12. International Users

This policy does not state that the GDPR or UK GDPR applies generally to the service. Whether another privacy law applies depends on the circumstances. If you believe another privacy law gives you rights concerning our handling of your information, contact privacy@auschildsupport.com.au so we can consider your request.

13. Children’s Privacy

Our service is intended for adults (parents and guardians aged 18 and over). We do not knowingly collect personal information directly from children under 18.

When you use our calculator, you may provide information about your children, such as age bands and care arrangements, to generate a child support Estimate. Those calculator inputs are not sent with an ordinary Contact Request.

An adult may also choose optional Review Factors about a child, including care, location, schooling, costs, medical or disability support needs, or financial resources. If the adult submits a Firm Contact Request, AusChildSupport collects the selected factors and structured follow-up choices and shares them with the named Client Firm for intake review. The adult can continue without sharing these factors, and medical or disability information requires separate consent.

Review Factors do not ask for a child's name, contact details, address, date of birth, school name, documents or free-text narrative.

If you become aware that a child has submitted personal information to us without appropriate consent, please contact us immediately at privacy@auschildsupport.com.au and we will take steps to delete that information.

14. Complaints and Contact

If you have a privacy concern or complaint, please contact us first and we will endeavour to resolve it promptly:

Email: privacy@auschildsupport.com.au (subject: “Privacy Complaint”)

Complaints about AusChildSupport's platform handling or platform copy should be directed to us. Complaints about a Client Firm's separately held copy or its legal services should be directed to that firm and, where applicable, the relevant professional body.

Our complaint handling process:

• We will acknowledge your complaint within 7 business days.
• We will investigate and respond with a written decision within 30 days.
• If more time is needed, we will notify you and explain why.

If we have not responded within 30 days, or you are dissatisfied with our response, you may lodge a written complaint with the OAIC using its online privacy complaint form:

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy.
• Post a notice on our website homepage for at least 30 days.
• Email users who have submitted inquiries if the changes affect how we handle their information.

The current version of this policy is always available at auschildsupport.com.au/privacy-policy. We encourage you to review it periodically.

16. Glossary of Key Terms