Privacy Policy
What we collect, where it lives, and what we deliberately don't hold.
Last updated 13 September 2026.
The short version. Your data is stored in Sydney. We hold business-level payroll totals, not employee records — no names, no tax file numbers, no individual super accounts. We don't run analytics, advertising or tracking of any kind. We don't sell anything to anyone.
Who we are
SuperDue is a registered Australian business name (ABN 91 346 778 459), Perth, Western Australia. You can reach us at hello@superdue.com.au.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We are a small business and may not be legally bound by that Act yet, but we have chosen to follow it, and this policy is what we hold ourselves to either way.
What we collect
| About you | Your email address and password (stored only as a cryptographic hash — we cannot read it). Your practice name, time zone, and your plan. |
|---|---|
| About your clients | Business name, ABN, state, payroll platform, pay cycle, super payment channel, your clearing-house lead time, and any notes you choose to add. |
| Pay runs | Pay dates, period start and end, and aggregate ordinary time earnings and super guarantee amounts for the run. |
| Alerts | Which reminders were scheduled and sent, and to which channel. |
| Activity log | An append-only record, kept for your practice's own records, of changes to your clients and pay runs (what changed, the values before and after, when, and by which signed-in account) and of each alert and reminder delivery. It is shown in the dashboard, included in your export, and deleted with the practice. |
| If you ask for a setup call | Your name, email, practice size, the payroll platforms you use, and anything you write in the free-text field. |
| If you ask the free checker to remind you | Your email address and the deadline you asked about — the payday, the state you picked, whether it was a new-employee or out-of-cycle payment. No name, no business name, no account. We use it for one thing: to email you 5, 3 and 1 business days before the send-by date for that deadline (the fund-receipt date less the clearing-house buffer), for that one deadline only. You confirm the address first by clicking a link, and every message carries a one-click stop link. |
What we deliberately do not collect
SuperDue works entirely at the level of a pay run total. It does not ask for, store or process:
- employee names or contact details
- tax file numbers
- individual superannuation fund or member account numbers
- individual salaries or per-employee contribution amounts
- bank account or payment credentials — SuperDue never moves money
This is a design decision, not an omission. Calculating a deadline needs a date and a total. It does not need to know who anyone is, so we chose not to hold it.
Data you upload about other people
Most SuperDue customers are bookkeepers or BAS agents entering information about their clients. When you do that, you are responsible for having the authority to share it with us, and we act on your instructions in handling it. You can export or delete it at any time.
Where your data is stored
The database sits in Supabase's Sydney region (ap-southeast-2). Australian data, stored in Australia.
Some supporting services necessarily sit elsewhere, and we would rather say so plainly than bury it. This is our disclosure under Australian Privacy Principle 8: the recipients below are outside Australia, and the countries they are likely to be located in are named in each row.
| Supabase | Database and authentication. Your data is stored in Sydney, Australia (AWS ap-southeast-2). Supabase Inc. is a United States company, so its staff and systems can reach the service that holds it. |
|---|---|
| Netlify | Website hosting and CDN. Serves the pages only — no customer data is stored there. Global edge network; Netlify is a United States company. |
| Resend | Sends transactional email such as sign-in, password reset, your deadline alerts (sent to your account address by default and switchable off in Settings or by the one-click unsubscribe in every alert), and the free checker's confirmation and reminder emails. Processes your email address and the message content. Our sending region is Japan (Tokyo, AWS ap-northeast-1); Resend is a United States company. |
| Stripe | Payment processing, only when you subscribe to a paid plan. Stripe sees your email address, name and card details; card details never touch SuperDue and we cannot see them. Billing records (plan, status, renewal date and Stripe's customer reference) are stored with your account. Stripe is a United States company and processes overseas, including in Ireland. |
| Google Workspace | Receives mail sent to our addresses, so anything you email us is stored there. Google is a United States company and stores and processes mail in data centres in several countries. |
| Telegram | Only if you opt in to Telegram alerts. If you do, alert content passes through Telegram's servers, which are outside Australia. The service is provided by Telegram Messenger Inc.; its parent Telegram Group Inc. is registered in the British Virgin Islands and its group includes Telegram FZ-LLC in the United Arab Emirates. Don't enable it if that isn't acceptable to you. |
We take reasonable steps to satisfy ourselves that these providers handle personal information consistently with the Australian Privacy Principles, but they are large overseas businesses on their own standard terms, not contracts we negotiated. If any of them handles your information badly, Australian law may not give you the same recourse against them as it does against us.
Tracking, cookies and analytics
We run no analytics, no advertising pixels, no session recording and no third-party tracking. Our content security policy actively blocks scripts from anywhere we haven't listed, so this isn't only a promise — the site is built so it can't happen quietly.
The only browser storage we use is the session token that keeps you signed in.
How we use what we collect
- To calculate deadlines and show you the state of your clients' obligations
- To send the reminders and alerts you've asked for, including the free checker's 5, 3 and 1 business-day emails if you asked for those
- To let you sign in and recover your account
- To answer you when you contact us
- To keep the service working and secure
We do not sell personal information, and we do not disclose it for marketing.
Email we send you, and how to stop it
Two different things:
- Service email — sign-in and password-reset messages, deadline alerts you set up, billing receipts and notices about the service. These are part of running your account. You can turn alerts off in the app; closing your account stops the rest.
- Free checker reminders — if you asked the deadline checker to remind you, we email you once to confirm the address (nothing else is ever sent to an unconfirmed address) and then at 5, 3 and 1 business days before the send-by date for that deadline (the fund-receipt date less the clearing-house buffer), for that one deadline only. They stop by themselves once the deadline passes, and every message has a one-click link that stops them immediately. We never use that address for anything else.
- A reply to a setup-call request — if you fill in the setup-call form, we email you back about that request. Asking us to get in touch is what that form is for, so it is the only thing submitting it signs you up for; it does not add you to any list.
- Anything promotional — we only send it if you ticked the separate, optional product-news box (unticked by default on the setup-call form), or told us so some other way. Ticking it is never a condition of anything else. Every one of those messages identifies us and carries a working unsubscribe link, and we act on an unsubscribe within five working days. You can also just reply and say stop, or email hello@superdue.com.au.
This is how we meet the Spam Act 2003 (Cth): consent, identification, and a functional unsubscribe.
Security
Traffic is encrypted in transit. Access to your rows is enforced at the database level by row-level security, so one practice's data cannot be read by another even if the application were wrong. Passwords are hashed and checked against known-breached password lists. We deliberately do not hold the categories of data that would make a breach severe.
No system is perfectly secure, and we won't pretend otherwise.
If something goes wrong
If a data breach occurs that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
Keeping and deleting data
We keep your data while your account is open. Ask us to close it and your practice, clients, pay runs and activity log stay available for export for 30 days, then we delete them, other than anything we're required to retain by law. You can export your data yourself from the dashboard at any time before then.
Free checker reminders are kept only as long as they are useful: an address that is never confirmed is deleted after seven days, and a confirmed reminder is deleted 30 days after its deadline has passed. You do not have to do anything for either to happen. To stop the reminder form being abused, we also keep a short-lived log of the IP address and email address of each reminder request; each entry is deleted within 25 hours and is used only to limit how many requests one address or one connection can make.
Your rights
You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email hello@superdue.com.au and we'll respond within 30 days.
If you're unhappy with how we've handled a privacy matter, tell us first and we'll try to fix it. If you're still not satisfied you can complain to the Office of the Australian Information Commissioner.
Changes
If we change this policy we'll update the date at the top, and we'll tell you by email before anything material takes effect.