Privacy Policy

1. Who We Are (APP 1 — Open and Transparent Management)

NepCanberra is an online business directory connecting members of the Nepali community in Canberra, ACT, with Nepali-run businesses and service providers. We are committed to handling your personal information in an open and transparent manner.

For any privacy-related questions or concerns, contact us at: legal@nepcanberra.com.au

This policy applies to all personal information we collect through the NepCanberra platform, website, and associated services.

2. What Personal Information We Collect (APP 3)

We may collect the following personal information:

From all users:

• Full name
• Email address
• Phone number (optional)
• Password (stored as a secure hash — never in plain text)
• IP address and device/browser information (collected automatically)
• Account activity and usage data (pages visited, search queries, timestamps)

From business owners (additionally):

• Business name, description, suburb, and category
• Business phone number and email address
• Business website and social media URLs
• Australian Business Number (ABN) — optional
• Business photos and images
• Business trading hours

From reviewers:

• Review text and star ratings submitted about businesses

We collect only the personal information that is reasonably necessary for the purposes described in this policy. Where information is optional, we will make this clear.

3. How We Collect Personal Information (APPs 3 & 4)

We collect personal information:

• Directly from you — when you create an account, submit a business listing, write a review, or contact us.
• Automatically — through our hosting infrastructure (Vercel) and database provider (Supabase), which may log IP addresses, access times, and browser/device information.
• Via Google OAuth— if you choose to sign in with Google, we receive your name and email address from Google in accordance with Google's privacy policy.

If we receive personal information about you that we did not solicit and that we could not have collected lawfully (unsolicited information), we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so (APP 4).

4. Why We Collect Your Information (APP 5 — Notification)

We collect personal information for the following primary purposes:

• Creating and managing your account on the Platform.
• Publishing and managing business listings.
• Enabling users to find and connect with Nepali-run businesses in Canberra.
• Processing and displaying user reviews.
• Communicating with you about your account, listing status, or support requests.
• Sending transactional emails (e.g., email verification, listing approval or rejection notifications) via our email service provider, Resend.
• Detecting and preventing fraud, abuse, and unauthorised access.
• Complying with our legal obligations.

We will notify you at or before the time of collection of the purposes for which we collect your information.

5. Use and Disclosure of Personal Information (APP 6)

We will only use or disclose your personal information for the primary purpose for which it was collected, or for a directly related secondary purpose, unless you consent to another use or disclosure, or an exception under the Privacy Act applies.

We may disclose your information to:

• Supabase — our database and authentication provider. Supabase stores your account data and business listing information securely.
• Vercel — our hosting and infrastructure provider. Vercel processes web requests and may collect anonymous usage metrics.
• Resend — our transactional email provider, used to send account verification emails and listing status notifications.
• Law enforcement or government authorities — where required or authorised by Australian law (e.g., in response to a court order or subpoena).

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

Approved business listings (name, suburb, phone, email, website, photos, hours, social links, and review data) are publicly visible on the Platform as part of the directory service. By submitting a business listing, you consent to this public display.

6. Direct Marketing (APP 7)

We only send transactional emails related to your account or listing (e.g., email verification, listing approval or rejection). We do not send promotional or marketing emails without your explicit opt-in consent.

Every email we send includes an unsubscribe mechanism. You may also opt out by contacting us at legal@nepcanberra.com.au. We comply with the Spam Act 2003 (Cth).

7. Overseas Disclosure (APP 8)

Our service providers — Supabase, Vercel, and Resend — may process and store data on servers located outside Australia (including in the United States). By using the Platform, you acknowledge and consent to this overseas processing.

We take reasonable steps to ensure that overseas recipients handle your personal information in a manner consistent with the Australian Privacy Principles, including by relying on contractual protections and the privacy frameworks of those providers.

8. Government Identifiers (APP 9)

We do not collect Tax File Numbers, Medicare numbers, or other government-issued identifiers. The Australian Business Number (ABN) is an optional field on business listings. ABNs are publicly available information registered with the Australian Business Register and are not treated as sensitive identifiers.

9. Data Quality and Security (APPs 10 & 11)

We take reasonable steps to ensure your personal information is accurate, up-to-date, complete, and relevant. You can update your account information by contacting us or through your account settings.

We take reasonable technical and organisational measures to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure, including:

• HTTPS encryption for all data in transit.
• Row-Level Security (RLS) on our database — users can only access their own data.
• Passwords stored as secure hashes using industry-standard algorithms (managed by Supabase Auth).
• Access to administrative functions is restricted to authorised personnel only.

In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme (Part IIIC of the Privacy Act 1988 (Cth)).

10. Accessing Your Personal Information (APP 12)

You have the right to request access to the personal information we hold about you. To make a request, contact us at legal@nepcanberra.com.au. We will respond within 30 days. We may need to verify your identity before providing access.

We may decline access in limited circumstances permitted by the Privacy Act (for example, where providing access would pose a serious threat to the life or safety of another individual, or where access would be unlawful). If we decline, we will give you written reasons.

11. Correcting Your Personal Information (APP 13)

You have the right to request correction of personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading. You can update most information directly through your account. For other corrections, contact us at legal@nepcanberra.com.au. We will respond within 30 days.

12. Cookies and Tracking

We use session cookies to maintain your login session, managed by Supabase Authentication. These are essential cookies required for the Platform to function.

We do not use third-party advertising cookies or tracking pixels. Vercel may collect anonymous, aggregated analytics data (e.g., page view counts) that cannot be used to identify you individually.

You can control cookies through your browser settings, but disabling cookies may prevent you from logging in or using key features of the Platform.

13. Children's Privacy

The Platform is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at legal@nepcanberra.com.au and we will take steps to delete that information promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. We will notify you of material changes by email or in-app notice where reasonably practicable. The updated policy will be posted on this page with a revised “Last updated” date. Continued use of the Platform after any changes constitutes your acceptance of the revised policy.

15. Privacy Complaints

If you have a concern or complaint about how we have handled your personal information, please contact us first at legal@nepcanberra.com.au. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001