Rayvice — Privacy Policy

Effective date: To be confirmed at launch

Version: 1.1 (Pre-launch draft — not legal advice)

Service: Rayvice (https://rayvice.com)

Operated by: Md Sartaj Alam (sole trader, India)

Contact: privacy@rayvice.com

1. What this policy covers

1.1. This policy explains what personal information Rayvice collects, why we collect it, how we hold, use and disclose it, where it may be processed, how long we keep it, and how individuals can request access or correction.

1.2. By creating an account and accepting the Terms & Conditions, you agree to the contractual terms governing your use of Rayvice and acknowledge that you have read this Privacy Policy. Rayvice handles personal information for the purposes described in this policy and in accordance with applicable privacy laws.

1.3. This policy should be read together with the Rayvice Terms & Conditions.

2. What we collect

2.1. Your business account (from you at registration):

• Name, email, phone, industry, business name;
• ABN, BSB, bank account number/name, invoice prefix, GST status, business address (street, suburb, state, postcode);
• Login credentials (passwords are stored only as secure hashes — we do not store passwords in readable form);
• Google account identity (name, email) if you sign in with Google.

2.2. NDIS participants you enter:

• Participant name, 9-digit NDIS number, date of birth;
• Plan management type, Plan Manager agency name and claims email, or self-managed nominee billing email/phone;
• Agreed hourly rate, support category, allocated budget figures.
• Participants may include children. You must be authorised to provide participant information to Rayvice for the purposes for which it is entered.

2.3. Work records you create:

• Shifts (dates, times, travel kilometres, case notes), auto-split rate lines;
• Invoices, line items, dispatch records (recipient emails, message IDs), payment status;
• Immutable audit logs of security and billing events (for example, logins and invoice generation).

2.4. Automatic/technical data:

• Device/browser basics, IP address (security and rate-limiting), authentication session tokens (httpOnly cookies), error diagnostics;
• Voice recordings, if/when the voice feature is enabled (see Section 6).

2.5. What we do not collect through Rayvice:

• Card numbers for subscriptions (payment card data is handled by Paddle);
• Passwords in readable form.

3. Why we collect it (purposes)

We collect and use information to:

• Create and operate your Rayvice account, trial and subscription;
• Calculate NDIS rate splits, generate invoices and dispatch them to the recipients you specify;
• Track applicable plan limits and prevent fraud, abuse and unauthorised use;
• Maintain security and audit records;
• Send transactional communications such as verification, password-reset and invoice emails;
• Provide customer support and maintain, troubleshoot and improve the Service;
• Produce aggregated or de-identified statistics where reasonably possible so they do not identify an individual.

We do not sell personal information and do not use personal information for third-party advertising.

We do not use participant information for unrelated advertising or unrelated secondary purposes.

4. Who we share it with (disclosure)

4.1. Service providers, only as needed to operate Rayvice:

• Paddle — subscription payments and billing; Paddle handles payment-card information under its own terms and privacy practices;
• Google — identity information if you choose Google sign-in;
• Email delivery providers — transactional emails such as verification, password reset and invoices, including the recipient addresses you provide;
• Cloud hosting/database providers — hosting the Rayvice application and database;
• Other technology or professional service providers may be used where necessary to operate, secure or support Rayvice. We will update this policy when a material change to the relevant data flow occurs.

4.2. Invoice recipients: When you instruct Rayvice to send an invoice, relevant invoice and recipient information is transmitted to the email address you specify. A copy may also be sent to your configured business email where the Service provides that option.

4.3. Team members: Team members you invite (for example, Office Manager or Technician) can access business data according to their assigned role. Technicians are intended to access only the records permitted by their role.

4.4. Overseas processing: Some Rayvice service providers may store or process personal information outside Australia, including in the United States or other countries. Before using an overseas recipient, Rayvice will take reasonable steps required by applicable privacy law to protect personal information. Where Australian Privacy Principle 8 applies, Rayvice will assess the relevant overseas data flow and applicable exceptions or safeguards.

4.5. Legal and security disclosures: We may disclose information where required or authorised by law, court order, or where reasonably necessary to investigate or respond to fraud, security incidents, unlawful activity or serious Terms breaches.

5. Storage and security

5.1. Rayvice uses access-controlled cloud systems and is designed to keep one business's data logically separated from other businesses.

5.2. Security measures used by Rayvice include, where implemented in the production system:

• bcrypt password hashing (cost factor 12);
• hashed authentication/session tokens with rotation where applicable;
• httpOnly session cookies;
• HTTPS in transit;
• role-based access controls;
• tenant-level access controls and audit logging.

5.3. Rayvice will not describe a security control as implemented unless it is actually enabled in the production system. Security controls may change as the Service develops.

5.4. No internet service can guarantee absolute security. Rayvice maintains reasonable security measures appropriate to the information it holds and will respond to suspected data breaches according to applicable law, including the Notifiable Data Breaches scheme where applicable.

6. Voice data (currently OFF)

6.1. The voice-to-shift feature is currently disabled.

6.2. When enabled, the final production data flow will be documented before release. The policy will identify the actual transcription/AI providers, information sent to them, retention behaviour, and whether audio or transcripts are stored or logged.

6.3. Voice processing will be used only for the purposes described to the user. A voice-generated result will require user review before a shift is saved, if that remains the production design.

7. How long we keep data (retention)

• Active accounts: Data is generally kept while your account exists, including during any read-only period after cancellation, subject to applicable law and the purposes for which the information is held.
• After deletion/termination requests: We will delete or de-identify personal information when we no longer need it for a permitted purpose, subject to information we are required or authorised to retain under law, contractual/accounting requirements, security records, dispute handling or other applicable exceptions.
• Backups: Deleted information may remain in encrypted backups until those backups are overwritten or otherwise expire under the applicable backup cycle.
• Financial/tax records: Records may be retained for periods required by applicable tax, accounting or other laws.

Where a record is required to be retained, we will not delete it merely because an account has been closed, but will limit its use to the purposes for which retention is required or permitted.

8. Your rights — access, correction and deletion

8.1. Subject to applicable law and any relevant exceptions, you may:

• View and correct your business profile in Settings;
• Export invoices (PDF) and available shift/claim data;
• Request access to, correction of, or deletion of personal information by emailing privacy@rayvice.com.

8.2. We will handle privacy requests within a reasonable period and, where applicable, within the timeframe required by law. Our current target is to respond within 30 days.

8.3. Requests relating to participant records can be made through the same process. Some records may need to be retained for legal, accounting, security or dispute-related reasons; if so, we will explain the applicable reason where appropriate.

8.4. Marketing communications, if introduced, will include an unsubscribe mechanism where required. Transactional communications necessary to operate or secure an account may continue while the account is active.

9. Cookies and similar technologies

9.1. Rayvice currently uses strictly necessary cookies and similar technical mechanisms, including the httpOnly refresh-token session cookie and security/rate-limiting signals.

9.2. We do not use advertising trackers as part of the current product design.

9.3. Blocking essential cookies may prevent login or other Service functionality from working.

10. Children

10.1. Rayvice accounts are intended for adults (18+) operating an eligible Australian business.

10.2. Participant records may relate to children because NDIS participants can be of any age. The Rayvice customer is responsible for having the appropriate authority to provide that information for the stated business purposes.

11. Changes to this policy

11.1. We may update this policy when our information handling practices, Service features or legal obligations change.

11.2. Material changes will be announced in the app or through another reasonable notice method before or when they take effect, where required.

11.3. The current version is available in the app under Help → Legal and Settings → Legal.

12. Complaints and contact

12.1. Privacy questions, access/correction requests and complaints: privacy@rayvice.com.

12.2. We will investigate and respond to privacy complaints within a reasonable period.

12.3. If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au, subject to the OAIC's jurisdiction and complaint requirements.