Privacy Policy

Build Alpha Kids runs multi-sport coaching programs for children across South-West Sydney. To do that we hold personal information about children and about the parents and guardians who enrol them.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy is written around those principles and explains how we handle personal information in our booking system and parent portal.

TODO-CONFIRM: the legal entity name and ABN of the business that operates Build Alpha Kids, to be stated here.

About the parent or guardian, when you create an account or make a booking: your first and last name, email address, phone number and suburb, along with whether you have opted in to marketing emails and to SMS notifications.

About your child, when you enrol them: their first and last name, date of birth, age group, gender, and any medical notes you or your centre give us — for example allergies, asthma, or a condition our coaches need to know about. We may also hold a photo of your child.

About your child's participation, as the program runs: attendance at each session, skill ratings recorded by coaches, written observations by coaches, photos taken during sessions, and development insights generated from that data (see 'AI-assisted insights' below).

About payments: the amount, what it was for, and the reference numbers Square gives us for the transaction. We never receive or store your card number — see 'Payments' below.

If you enquire or subscribe: the name, email, phone, suburb and message you send us through an enquiry form, or just your email address if you subscribe to our newsletter.

Health information — the medical notes above — is 'sensitive information' under the Privacy Act and gets extra protection. We collect it only so our coaches can keep your child safe during a session, and we only collect it because you or your child's centre have given it to us for that purpose.

You do not have to give us medical information. If you do not, we may not be able to safely include your child in some activities.

We use the information above to run our programs and nothing more surprising than that:

Our coaches can upload photos taken during a session. Those photos are stored against the session and are visible to the coach who took them, to our administrators, and to the director of the centre where the session ran.

TODO-CONFIRM: Build Alpha Kids does not currently record a photo or media consent flag against a child in this system. Before launch, confirm how photo consent is obtained and recorded (for example, through the centre's own enrolment forms), how a parent asks for a photo to be removed, and whether photos are ever used for marketing. This section must then describe that actual process — and if photos may be used publicly, that requires its own clear consent and must be stated here.

We use an artificial intelligence service provided by Anthropic (the Claude API) to help write development insight reports about your child — a summary of their strengths, areas for growth, and suggestions for parents and coaches.

We think you should know exactly what is sent. When an insight is generated, we send Anthropic: your child's first and last name, their age group and approximate age in years, the name and dates of the school term, their attendance record for each sport, and the skill ratings their coaches recorded. This information identifies your child by name — it is not anonymised or aggregated with other children.

We do not send your child's medical notes, date of birth, gender, photos, your contact details, or any payment information to Anthropic.

Insights are generated when a coach or administrator asks for one, and automatically at the end of a term for children who have skill ratings for that term. The report that comes back is stored in our system and shown to you in your parent account.

Anthropic processes this information on our behalf as a service provider. TODO-CONFIRM: the applicable Anthropic terms and data-processing commitments (including their retention of API inputs and whether the data may be used for training) should be confirmed and summarised here by the reviewing lawyer, and Jayden should decide whether parents are offered a way to opt out of AI-generated insights — the system does not currently have an opt-out.

We do not sell your information, and we do not share it for anyone else's advertising.

We do share it with the centre or school your child attends, where they run the program with us, and with the coaches assigned to your child's sessions.

We also use the following service providers to run the platform. They handle information on our behalf, only to provide their service to us:

Some of your information is held or processed outside Australia. Under APP 8 we have to tell you that plainly, so:

Our application runs on servers in Mumbai, India. This means information you enter — including information about your child — is processed in India.

TODO-CONFIRM: the country in which our Supabase database physically stores data. This could not be determined from our code — it is set on the hosted Supabase project. This is the sentence that tells a parent where their child's records actually live, so it must be confirmed in the Supabase dashboard and stated here exactly, before this page goes live.

TODO-CONFIRM: the countries in which Anthropic, Resend, Square and Twilio store and process the information we send them. Each provider is based outside Australia, but the specific countries must be confirmed from each provider's own terms rather than assumed.

Card payments are handled by Square. When you pay, your card details go directly from your browser to Square — they do not pass through our servers, and we do not store your card number.

What we keep is the amount, what it was for, and the reference numbers Square returns so we can match the payment to your booking and issue a refund if one is due.

Your information is held in our Supabase database. Access is restricted by database-level security rules, so a parent account can only reach that parent's own information, and staff accounts are limited by their role and the centres they work with.

You sign in with a single-use link sent to your email address — there is no password to be guessed or reused.

We do not claim any security certification, and no system is perfectly secure. If you believe your account or your child's information has been compromised, please contact us straight away.

TODO-CONFIRM: our system does not currently delete or anonymise records automatically. In practice this means information about a child is kept until it is removed by hand.

TODO-CONFIRM: how long Build Alpha Kids intends to keep child records, parent records, booking and payment records (noting the separate record-keeping obligations that apply to financial records), enquiry and newsletter records — and what happens to a child's information after they leave a program. These periods must be decided and stated here. We have deliberately not written a retention period we do not actually honour.

You can ask us for a copy of the personal information we hold about you or your child, and you can ask us to correct it if it is wrong. These are your rights under APPs 12 and 13.

Some details you can change yourself at any time in your parent account, including your contact details and your marketing and SMS preferences.

For anything else — a full copy of your child's records, a correction you cannot make yourself, or a request to delete information — please contact us and we will handle it manually. We do not yet have a self-service export or account-deletion button.

TODO-CONFIRM: the timeframe within which Build Alpha Kids will respond to an access or correction request, and whether any fee applies. (The Privacy Act sets expectations here — this should be confirmed with the reviewing lawyer.)

This website does not use advertising or analytics trackers. The cookies we set are the ones needed to sign you in and keep you signed in to your parent account.

If you think we have mishandled your or your child's personal information, please tell us first — contact details are below — and we will look into it and respond to you.

TODO-CONFIRM: a named privacy contact (a person or role, with an email address) to receive privacy complaints, and the process and timeframe for responding to one. Do not publish this page without it: a complaints process with nobody at the end of it is worse than none.

If you are not satisfied with our response, you can take your complaint to the Office of the Australian Information Commissioner (OAIC), which oversees the Privacy Act. You can reach the OAIC at oaic.gov.au or on 1300 363 992.

If we change this policy, we will update the 'Last updated' date at the top of this page and publish the new version here.

If we make a change that materially affects how we handle your or your child's information — for example, sharing it with a new service provider, or sending it somewhere new overseas — we will tell account holders by email rather than relying on you to re-read this page.

If you have a question about this policy, or you want to access, correct or complain about the information we hold, please get in touch. Our contact details are in the footer of every page of this site.