Privacy & Data Safety
You trust us with sensitive financial information about your family. Here's exactly how we protect it and what we do — and don't do — with it.
What information we collect
To calculate your entitlements, NestWise asks for your combined household income, the number and ages of your children, the childcare fees and hours you pay, and your work or study hours per fortnight. For paid subscribers we also store your email address and billing details (handled securely by Stripe — we never see your full card number).
We do not collect your Tax File Number, Centrelink Customer Reference Number, Medicare number, or any government identity documents.
How your data is stored
Your profile data is stored in Supabase, an enterprise-grade database platform built on PostgreSQL. All data is encrypted at rest and in transit using industry-standard AES-256 encryption. Supabase infrastructure is hosted in Australia (Sydney region) and is SOC 2 Type II certified.
Access to your data is protected by row-level security — meaning even within our own database, queries can only return your data when you are authenticated as you.
What we do with your data
Your data is used for one purpose: to calculate and display your childcare entitlement estimates. We do not use your data for advertising, profiling, or marketing to third parties.
We may use anonymised, aggregated data (for example, average CCS rates across income bands) to improve the product — but this data cannot be traced back to you or any individual family.
Who can see your data
Only you can see your family's data. Adelante Technologies staff have extremely limited access to production data and only for the purpose of debugging issues you have reported. We do not share your data with Centrelink, the ATO, or any government body.
Our third-party service providers (Supabase for database, Stripe for payments, Resend for email, Vercel for hosting, Intercom for in-app support) each have their own privacy and security certifications and only process the data required for their specific function.
In-app support and Fin AI
When you're signed in, NestWise loads the Intercom Messenger so you can ask a question, report a problem, or get help. Conversations may be answered by Intercom's "Fin" AI assistant in the first instance — trained on the public NestWise guides at /guides plus support-specific content we maintain. Fin escalates to a human at hello@nestwise.net.au when it can't help.
To make support useful we share these identity attributes with Intercom: your NestWise user ID, your email address, your first name (if you set one), your subscription tier (free / Family / Complete), your signup date, and your audience-branch tags (e.g. families_in_childcare, professional). We DO NOT share your income, your ATI, your entitlement amounts, or any dollar figure with Intercom or Fin — the same data discipline the rest of the product uses.
Conversation content (what you type into the Messenger) is stored by Intercom on their infrastructure under their privacy policy (intercom.com/legal/privacy). On sign-out we instruct Intercom to forget your session on the device — so the next user on a shared device doesn't see your conversation.
Payments and billing
Subscription payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor. NestWise never stores or sees your full credit card number. Stripe handles all payment data in accordance with the highest level of payment security standards.
Your rights
You can export or delete your NestWise account and all associated data at any time by emailing hello@nestwise.net.au. We will process deletion requests within 7 business days. You can also update or correct any information stored in your profile at any time from the Profile page.
Cookies and analytics
NestWise uses FIRST-PARTY product analytics — a small events table on our own database that records which calculators you opened and which wizard steps you completed. We use this to fix bugs and decide what to build next. We do NOT use Google Analytics, Meta Pixel, or any third-party tracking script. We use session cookies required for authentication; no advertising cookies, no cross-site tracking.
The events we record only ever capture the event NAME plus a few non-sensitive properties (e.g. which tool was opened, which wizard step). They NEVER capture income, ATI, entitlement amounts, or any dollar figure — the /api/track route strips these defensively server-side.