Privacy Policy

This Privacy Policy explains how Hudlhq collects, holds, uses and discloses Personal Information. It applies to hudlhq.app, app.hudlhq.app, and the Hudlhq product generally (together, the “Service”).

“Personal Information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true and whether it is recorded in a material form or not.

If your school or organisation (“Institution”) has arranged for you to use the Service, your Institution is the party primarily responsible for deciding what Personal Information about you is entered into the Service, and what is kept, deleted, or archived within its own account. Hudlhq acts as the Institution’s service provider, processing that Personal Information to deliver the Service on the Institution’s behalf.

Hudlhq builds and operates the Service from Sydney, Australia. In this policy, “we,” “us,” and “Hudlhq” refer to the operator of the Service.

The party an Institution contracts with is identified in the agreement between us. If you need our current legal and registration details for your own records, contact support@hudlhq.app.

Questions, requests, or complaints about how we handle Personal Information can be directed to our Privacy Officer:

Hudlhq Privacy Officer
support@hudlhq.app

The kind of Personal Information we collect depends on your role and how you use the Service.

4.1 Identity and contact information

Your name, email address, and (where provided by your sign-in provider) profile photo.

4.2 Account and authentication information

When you sign in with Google (or Microsoft, once available), we receive your name, email address, profile photo, and a unique account identifier from that provider. We never receive or store your Google or Microsoft password.

4.3 Institution and role information

Which Institution you are associated with, and your role within it (for example, participant, staff, camp administrator, or institution administrator).

4.4 Program information

Depending on your role: which programs you are enrolled in or run, your group placement, your position on a schedule or timetable, and - for staff - which rooms and door codes you may access for the programs you work.

4.5 Administrative records

A record of changes made to institutional data (for example, when someone is added to or removed from a program), kept for accountability. This is a record of what changed, not a log of who viewed what.

4.6 Billing information

Where your Institution is a paying customer, we hold billing details at the Institution level, including the agreed fee and invoice records. We do not currently use a third-party payment processor, and we do not hold card or payment-instrument details.

4.7 Technical information

Standard technical data (IP address, browser type, timestamps) collected automatically by our hosting and infrastructure providers, for security, reliability, and abuse prevention.

4.8 Notification information

If you turn on notifications, or install the Service as an app on your device, we hold a notification token issued by your browser or device. A token identifies that browser or device rather than you personally, and it is what allows a notification to reach it. A notification may carry program details - the title of an announcement, or a change to your schedule. Turning notifications off, or removing the app, ends this.

4.9 Sensitive information

“Sensitive information” is a special category of Personal Information under the Privacy Act 1988 (Cth), including health information. We do not currently collect Sensitive Information. We intend to add features involving medical and emergency contact information in future. When we do, we will collect it only with appropriate consent (from you, or from your Institution or a parent/guardian acting on your behalf, as applicable), and we will update this policy before that feature is enabled.

We collect Personal Information:

• directly from you, when you sign in via Google or Microsoft, or enter information into the Service;
• from your Institution, when it invites you, assigns you a role, or enters information about you (for example, adding you to a program roster); and
• automatically, through standard technical logging by our infrastructure providers.

We collect, hold, use and disclose Personal Information to:

• verify your identity and create or maintain your account;
• determine which Institution and role you should be connected to (including by matching your email domain to your Institution’s registered domain);
• provide the Service’s core functionality - rosters, scheduling, rooming, and announcements - to you and to other authorised users at your Institution;
• maintain administrative and accountability records of changes made within your Institution’s account;
• administer billing, where your Institution is a paying customer;
• send notifications you have turned on - for example an announcement from your Institution, or a change to your schedule;
• respond to your enquiries and provide support;
• maintain the security and integrity of the Service; and
• comply with our legal obligations.

We do not use Personal Information for advertising, do not build marketing profiles, and do not sell Personal Information to any third party.

The name, email address, and profile photo we receive from Google or Microsoft are used solely for the purposes described in section 6 above - principally, to verify your identity, connect you to the correct Institution and role, and display your name and photo to other authorised users where your role would ordinarily make that visible (for example, on a staff roster). This data is never used for advertising and is never sold or shared with data brokers.

We disclose Personal Information only as needed to operate the Service, to the following categories of recipients:

Identity providers

Google, and Microsoft once available - solely to verify who you are when you sign in. Section 7 describes that data specifically.

Infrastructure providers

The cloud hosting, database, authentication and file storage services the Service runs on. They process Personal Information on our behalf, under contract, and only to provide those services to us.

Notification delivery

Where notifications are enabled, a provider that delivers them to your browser or device. It receives the notification token and the message being delivered, and nothing else.

Regulatory or law enforcement bodies

Where we are required to disclose by law.

For the current list of the infrastructure providers we use, and where each of them operates, contact support@hudlhq.app. We will tell you.

We do not disclose Personal Information to any third party for their own marketing or advertising purposes, and we do not sell Personal Information.

Our primary infrastructure - application hosting and database - is located in Sydney, Australia.

Google and Microsoft are global businesses and may process limited Personal Information outside Australia as part of their identity-verification services. Some of the other providers described in section 8 may also store or process data outside Australia. If you would like to know which providers apply to your Institution and where each operates, contact support@hudlhq.app.

We hold Personal Information in database systems operated by our infrastructure providers. We apply access controls so that Personal Information within an Institution’s account is only visible to people with an appropriate role at that Institution, and we maintain administrative records of changes to institutional data for accountability. We require our service providers to apply appropriate technical and organisational security measures under contract. No method of storage or transmission over the internet is completely secure, and we cannot guarantee absolute security.

We generally retain records rather than immediately deleting them when someone is removed from a program or their account is deactivated, marking them as no longer current instead. An Institution can therefore always answer who was involved in a program and when.

Where an Institution uses the Service to run programs involving school-age users, those records describe supervised activity, and being able to answer that question matters for safeguarding and accountability. It does not mean Personal Information is kept indefinitely or cannot be deleted on request - see section 14.

Specific categories are retained as follows:

Accounts

If your access to an Institution is removed, your account record is kept, marked as removed, so the Institution retains an accurate history of who had access and when.

Program rosters and group/room assignments

Kept as a historical record even after a program ends or a person is removed from it. Not automatically purged.

Administrative change records

Retained for approximately five years for accountability, after which they may be purged. These records cannot be edited by anyone in the ordinary course of using the Service.

Invitations

Invitation links expire automatically after a set period and are not usable once expired or once superseded by a new invitation to the same address.

Billing records

Retained for approximately five years, in line with standard financial record-keeping practice.

Notification tokens

Held while notifications are turned on, and deleted when you turn them off or remove the app from your device.

Technical / server logs

Retained by our infrastructure providers for a limited period in the ordinary course of running the Service.

The Service is used by schools and similar Institutions to run programs for participants of any age, as determined by the Institution. Nothing in the Service assumes that a participant is an adult or a school-age user, and many Institutions run programs for adults only.

Every account on the Service - participant, staff, or administrator - requires sign-in via a Google or Microsoft account. Where an Institution does enrol school-age users, it will typically do so using accounts it manages itself, such as a school-issued Google Workspace for Education account, rather than a personal account the participant creates on their own. In that case, Personal Information about those users is provided and managed by the Institution, as described in section 1, including any consent required from a parent or guardian.

We use only cookies strictly necessary to keep you signed in and maintain your session. We do not use advertising or third-party tracking cookies. Our hosting provider may include basic, privacy-preserving usage analytics as part of its standard service; we do not use this data for advertising or to build marketing profiles.

If you install the Service as an app on your device, or turn on notifications, your browser stores a small amount of data on that device so it can work offline and receive notifications. None of it is used for tracking, and removing the app clears it.

You may contact our Privacy Officer to request access to, or correction of, the Personal Information we hold about you. We will take reasonable steps to verify your identity before actioning a request. Where you are a participant or staff member at an Institution, we will generally coordinate access or correction requests through your Institution in the first instance, since it is the party that entered the information and manages your access, but you are welcome to contact us directly. If we refuse a request, we will tell you why.

Some Personal Information may be retained even after a deletion request where required by law, or where retaining a limited record serves the safeguarding purpose described in section 11 - in those cases we will explain what is retained and why. To request deletion, contact support@hudlhq.app.

If you have a concern about how we have handled your Personal Information, please contact our Privacy Officer using the details in section 3. We will investigate your complaint and respond in writing within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (www.oaic.gov.au).

We may update this policy from time to time. If we change what Google or Microsoft Account Data we access or how we use it, we will update this page and change the effective date above; other material changes will be highlighted similarly.

Privacy Officer: support@hudlhq.app