Privacy at NipperHub
Effective: 27 August 2026 · Last updated: 27 August 2026
About this policy
NipperHub is a platform that helps surf life saving clubs run their Nippers programs — registration, payments, beach-day operations and club administration. This policy explains what personal information the platform collects, why, and the choices you have. It's written to satisfy Australian Privacy Principle 1 (open and transparent management of personal information).
Your club remains responsible for its members' information under its own privacy obligations; NipperHub processes that information on the club's behalf to run the season, and holds account information (like your sign-in details) in its own right.
There is a separate, simpler privacy page written for children.
What we collect, and why
About adults: your name, a verified email address and a verified mobile number — so you can sign in, be contacted about your family's season, pay and be sent receipts, and recover your account. Club volunteers' clearance records (such as a Working with Children Check's type, number and expiry) are recorded by the club because the law requires it.
About children: name, Surf Life Saving member ID, age group, program and group placement, attendance at sessions, and the care information a parent chooses to provide so the club can keep their child safe on the beach. We never collect or store a child's date of birth — age group comes from your club's own membership records, verified by the club.
Payments: processed by Stripe against your club's own Stripe account. NipperHub records that a payment was requested, made or refunded; card details never touch NipperHub, and payment records never include a child's information.
What we don't do: no advertising, no sale of personal information, no analytics trackers on this website, and no use of your information to train artificial-intelligence models.
Children's information
Every child on NipperHub is treated as under 15, and a parent or guardian always provides consent — there is no self-consent path, and because we hold no birth dates we never guess at a child's age. Consents are specific, never pre-ticked, and expire after at most 12 months, so your club asks again each season.
Access to a child's information is limited to three bases: their own parents and guardians, adults those parents have specifically nominated, and cleared club personnel whose role requires it. Clinical detail is held in a tighter tier than day-to-day care notes, and reaches fewer people.
Who can see what
- Your family: parents and co-parents see their own family's information. Adults you nominate see only what you granted them, per child.
- Your club: authorised, cleared club personnel see what their role needs — no more. Every access-affecting change is logged with who made it.
- Other clubs: nothing. A club sees only its own members and applicants.
- The platform: platform personnel do not browse club data in the ordinary course; support access is narrowly granted, time-boxed and audited.
Disclosure and overseas processors
Personal information is disclosed only to run the service:
| Processor | What | Where |
|---|---|---|
| Resend | Delivers our email (receipts, confirmations, club messages) | United States |
| Stripe | Processes payments — adult and payment details only | United States |
| Telegram | Optional club announcements — broadcast only, never personal information | Overseas |
Everything else stays in Australia (Google Cloud, Sydney region).
Club marketing email (the pre-season reminder) is sent only to families with a recent relationship with the club, carries the club's identification and a working unsubscribe, and unsubscribing is honoured permanently.
Retention and destruction
We keep personal information only while it serves the season it was collected for, and for the periods the law requires for specific record classes. When you ask us to delete your family's information — or when retention ends — we really delete it: deletion takes effect immediately in the live system and completes permanently once our short-lived backups age out. We keep a record that a deletion happened (not the deleted content) so a system restore can never resurrect deleted information.
Some records must lawfully be retained for a period even after a deletion request — for example child-safety records, financial records and clearance-verification minimums. Where that applies, we delete everything else, tell you what was retained and why, and delete the remainder when the lawful period ends.
Access, correction and complaints
You can see most of your family's information directly in NipperHub. For anything else — access, correction, or a deletion request — contact your club, or write to support@nipperhub.com. We respond in plain language, within a reasonable time.
If you're not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au · 1300 363 992 · GPO Box 5288, Sydney NSW 2001.
Changes to this policy
We'll post changes here with a new date, and for significant changes we'll tell parents directly by email.
Contact
support@nipperhub.com — privacy questions are answered by a person.