Privacy at NipperHub
Effective: 27 August 2026 · Last updated: 19 October 2026
About this policy
NipperHub helps surf life saving clubs run their Nippers programs: registration, payments, beach days and club administration. This policy says what personal information we collect, and why. It also says what choices you have. It is written to meet Australian Privacy Principle 1 — open and transparent handling of personal information.
Your club stays responsible for its members' information under its own privacy obligations. NipperHub handles that information for the club, to run the season. It also holds your account information — your sign-in details — in its own right.
There is a separate, simpler privacy page written for children.
What we collect, and why
About adults: your name, a verified email address and a verified mobile number. We need them so you can sign in, hear about your family's season, pay, be sent receipts, and get back into your account. If you take on a club role, your club records your clearance — a Working with Children Check's type, number and expiry — because the law requires it.
About children: name, Surf Life Saving Australia (SLSA) member ID, age group, program and group placement. We also record attendance at sessions, and the care information a parent chooses to give so the club can keep their child safe on the beach. We never collect or store a child's date of birth. Age group comes from your club's own membership records, and the club verifies it.
Payments: Stripe processes them, against your club's own Stripe account. NipperHub records that a payment was requested, made or refunded. Card details never touch NipperHub. One detail about your child does reach Stripe, and we'd rather name it than let you find it on a receipt. Your child's given name appears on the program line of the payment. That is so you and your club's treasurer can tell what the charge was for. We send it only when the name you entered is a single word. If you entered more than one word we send none of it, because nothing tells us which word is the given name. We never send a surname, an SLSA member ID or a date of birth — we hold no date of birth. The payment's internal record carries no child detail at all, only reference codes that mean nothing on their own.
What we don't do: no advertising, no sale of personal information, no analytics trackers on this website, and no use of your information to train artificial-intelligence models.
Children's information
We treat every child on NipperHub as under 15, and a parent or guardian always provides consent. There is no self-consent path, and because we hold no birth dates we never guess at a child's age. Each consent is specific and never pre-ticked, and it lasts 12 months at most, so your club asks again each season.
One of those items is an acknowledgement rather than a choice. Clubs take photographs and video at sessions and events, and may use them in club material such as newsletters, social media and the club's own website. You can tell your club not to photograph your child on your Family page, under Photos and video, and change your answer at any time. Only you can set it; your club sees it. It reaches what NipperHub holds — which is no image at all — and cannot reach a photo already in a newsletter or online.
Inside NipperHub, three kinds of people reach a child's information, and no others: their own parents and guardians, adults those parents have nominated by name, and cleared club personnel whose role requires it. Health and care notes are held more tightly than everyday details. A club's list of applicants doesn't carry them at all, and opening a child's record needs a cleared role, checked afresh on every request.
Information also leaves NipperHub, on paper and in files, and we'd rather say how than let you assume it can't. A club may print its lists — the beach-day sheet, its roster, applications, members, families, payments, volunteers and event ticket holders — and whoever holds the paper can read it. A printed roster carries the words of each child's health or other notes, and of any note the club has written about them, because the adult running the group on the beach needs them. A club's administrator or registrar may also download those lists as a spreadsheet, and its treasurer may download the payments and event lists, which name no child. A downloaded list can name children and carry parents' email addresses and mobile numbers, and the mobile numbers of adults a family has nominated, with the email address of any who have their own NipperHub account. A club's administrator can also download the list of people the club must report to Victoria's WWC Connect, with the email address and mobile number of each adult it currently engages in child-related work. A spreadsheet never carries the words of a health or other note, or of a club's own note — only whether there is one — and never the confidential reasons behind a safeguarding decision. Every download and every printed list, except the beach-day sheet, is recorded against the person who took it. Once a file is on someone's computer, deleting your family from NipperHub cannot reach it; looking after it is your club's responsibility.
Who can see what
- Your family: parents and co-parents see their own family's information. Adults you nominate see only what you granted them, per child.
- Your club: authorised, cleared club personnel see what their role needs — no more. Every access-affecting change is logged with who made it.
- Other clubs: nothing. A club sees only its own members and applicants.
- The platform: platform personnel do not browse club data in the ordinary course. The platform-level screens that exist show club records, licences and system alerts, and nothing else. Each one demands an authenticator app to open. Your club can also lend us a support window when it asks for help. Only the club can open one. It lasts 14 days at most, it always has an end, and both the opening and the closing are recorded against the person who did it. Today that window reaches nothing at all — the list of what it allows is deliberately empty — and adding to that list is a reviewed change, not a setting. We'd rather be exact than reassuring here: the platform-level reads above are not written to the audit trail one by one. If any of that changes, this page changes with it.
Disclosure and overseas processors
This is every outside service NipperHub sends anything to, and what each one receives. There is no sixth, and a sixth cannot be added quietly — adding one is a change to this table.
| Processor | What | Where |
|---|---|---|
| Resend | Delivers our email (receipts, confirmations, club messages) | United States |
| Stripe | Processes payments — the paying adult's name and email, the amount and the club's account, plus your child's given name alone on the program line (see Payments, above) | United States |
| MobileMessage | Delivers our text messages — the recipient's mobile number and the text of the message | Australia |
| Telegram | Optional club announcements — broadcast only, never personal information | Overseas |
| Have I Been Pwned | Checks a password you choose against known breaches. Your own browser sends the first five characters of its scrambled form, so the service also sees your IP address. Never the password, never your name, email or any account reference | Overseas |
Three of those five are overseas exceptions for personal information — Resend, Stripe and Telegram. MobileMessage is an Australian service. Have I Been Pwned is sent nothing your name or your email is attached to. The check does run from your own browser, though, so it sees your IP address — the same thing reCAPTCHA sees, just below. Everything else about your family and your children stays in Australia, in Google Cloud's Sydney region.
Two qualifications on that, because "everything else" should not be read wider than we mean it. Google's Identity Platform runs sign-in. It holds your email address and your sign-in events, and Google does not undertake to keep those account records in a single region. And the NipperHub app runs Google's reCAPTCHA Enterprise, which tells a real browser from an automated one. It sees your IP address and how you interact with the page. It runs on every page of the app, including the club directory, and it is part of keeping sign-in safe rather than something to switch off. This website is not the app: it loads nothing from anywhere else.
Club marketing email — the pre-season reminder — goes only to families with a recent relationship with the club. It names the club and carries a working unsubscribe. If you unsubscribe, that is honoured permanently.
Retention and destruction
We keep personal information while it serves the seasons it was collected for. After that, a family's records are destroyed automatically. Once three seasons have fully passed with no activity — no application, no attendance, nothing — a nightly job removes them. About a month before that happens we email the primary parent, where we hold a confirmed address for them.
You can also ask us to delete your family's information sooner. Write to support@nipperhub.com. Here we would rather be exact than reassuring: there is no delete button in the app and no same-day promise. A request reaches a person, who carries it out and tells you when it is done.
When a deletion does happen it is a real one, including the family's payment records. When the nightly job deletes a family, we keep a record that it happened, never the deleted content, so restoring a backup cannot bring the information back. A deletion we carry out on request is not yet recorded that way: if we ever restored a backup taken before it, that information would come back and we would have to delete it again. Four things deliberately survive a deletion, and you should know which.
- Records a club holds in its own right rather than as part of your family — a volunteer's own clearance declaration, and the club's points ledger.
- The audit trail of who did what, which is how a club can answer a question about a past decision.
- Safeguarding records, and the name attached to them. If a club has recorded a concern about a child, or suspended one, that record is kept — unless the club itself leaves NipperHub, when a suspension goes with the club's records. A record that cannot say who it is about is not a record. Child-safety rules set the floor at the year the child would turn 25, so your child's name and age group stay on the club's register until then. While that floor is running, the automatic three-season deletion skips that child. Asking us to delete your family removes everything else, but not that register entry — it comes from your SLSA membership rather than from anything you told NipperHub. We'd rather be exact than reassuring here: nothing destroys these records on the day the floor runs out, so in practice we keep them longer than the rule asks.
- Working with Children records of adults who volunteer or work with children. Victoria requires a club to keep these for seven years after someone stops child-related work for it. So at each club where you have done, or agreed to do, that work in the last seven years, these stay until seven years after your last day there: your check, the club's other clearance, employment and training records about you, any suspension, and the contact details the club last reported to WWC Connect. They are then deleted automatically, except a suspension, which is kept like any other safeguarding record. If a club's suspension of you has not ended, your sign-in account is kept too, so the suspension still applies if you return; when these records are deleted, so is that account, unless a suspension still has not ended or you have held a role at a club.
Access, correction and complaints
You can see most of your family's information directly in NipperHub. For anything else — access, correction, or a deletion request — contact your club, or write to support@nipperhub.com. We respond in plain language, within a reasonable time.
If you're not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au · 1300 363 992 · GPO Box 5288, Sydney NSW 2001.
Changes to this policy
We'll post changes here with a new date, and for significant changes we'll tell parents directly by email.
Contact
support@nipperhub.com — privacy questions are answered by a person.