This policy describes what Covered actually does today. Covered is operated by Callixo Technologies Pty Ltd (ABN 85 696 368 153). It holds records about a childcare service, its educators and its compliance evidence. It does not hold records about individual children. Where a capability is not part of this release, this policy says that rather than describing it as something we already do.
A childcare service enters these records; Covered does not collect them from anywhere else.
Covered is bound by the 13 Australian Privacy Principles in the Privacy Act 1988 (Cth). The principles that carry a specific commitment on our side are set out below.
| Principle | What we do |
|---|---|
| APP 1 Open and transparent management | This policy is published at https://app.coveredapp.com.au/privacy and is available from inside the application. It describes what the platform does today, and says so plainly where something is not done today. |
| APP 2 Anonymity and pseudonymity | Covered cannot be used anonymously: an account belongs to a named person at a registered service. Text sent for AI analysis is not pseudonymised, and section 4 explains what protects it instead. |
| APP 3 Collection | We collect only what compliance management needs. Educator records are entered by the service, not gathered from third parties. |
| APP 5 Notification | Services using Covered are required to make this policy available to the educators whose records they enter. |
| APP 6 Use and disclosure | Data is used to run the service the organisation signed up for. It is never sold, and never shared for marketing. The only disclosures are to the providers in section 5, and to anyone the law compels us to tell. |
| APP 8 Cross-border disclosure | Customer records are stored in the Sydney region (ap-southeast-2), and document reading, personal-detail redaction and AI analysis run on Amazon Web Services in that region under Australia-geography model routing. Some things we run are operated from outside Australia, and none of them carries customer records: the operator dashboards and build logs of our web hosting provider, the support and operator plane of our database provider, our build pipeline, and the automated review of our own source code. None of them touches a customer database or a stored document. |
| APP 11 Security | Set out in full in section 3, including the parts of the design that are a second layer rather than the control we rely on. |
| APP 12 Access | You can ask for a copy of your personal information by writing to privacy@callixo.com.au. We answer within 30 days. There is no self-service portal for educators or families in this release, so a request comes to us or to the service that entered the record. |
| APP 13 Correction | A correction can be requested the same way. Where a record is corrected, the previous value stays in the activity log so the history of the record remains honest. |
This is the complete list. A provider marked as not in use holds nothing: the integration exists in our code and is switched off, so there is no data flowing to it.
| Provider | Status and region | What they handle |
|---|---|---|
| Amazon Web Services | In use Sydney (ap-southeast-2) | Hosting, the document store, document reading and personal-detail redaction, AI inference and text embedding, malware scanning of uploads, notification email, caching, and operational logs and metrics. All of it in the Sydney region. |
| Supabase | In use Sydney (ap-southeast-2) | The PostgreSQL database and the sign-in service that authenticates users. Stored data stays in the Sydney region. |
| Vercel | In use Sydney (syd1) for page rendering; global edge for public assets | Renders the web application. Pages that read service data render in Sydney. Public assets such as fonts and scripts are served from a global network and carry no records. Vercel operates its own dashboards and build logs from the United States. |
| PostHog (self-hosted by Callixo) | In use only where switched on Sydney | Product analytics and session replay, self-hosted by Callixo in Sydney. It is off unless it has been switched on for a service. Where it is on, recordings stay on the Sydney instance, password fields are masked, and a browser Do Not Track signal is honoured. |
| Stripe | Not in use today Not applicable while unused | Card payments. Covered charges nothing in this release, so there is no billing data to send. |
| Twilio | Not in use today Not applicable while unused | Text-message delivery. Notifications go out by email only, so no phone number is sent for delivery. |
| NQAITS and ACECQA programmatic interfaces | Not available today, no date set Not applicable while unavailable | A direct machine connection to the national registers. Covered has none. Regulatory details are entered and verified by the service, and we set no date for changing that. |
Covered sets a small number of cookies: two that keep you signed in, one that tells the application whether you are signed in, and, where product analytics have been switched on for a service, PostHog's own cookie. There are no advertising cookies and no third-party marketing or ad trackers anywhere in the product.
Product analytics and session replay are available through a PostHog instance that Callixo hosts itself in Sydney. They are off unless switched on for a service. Where they are on, a recording of what a signed-in user saw on screen may be captured, password fields are masked, the recording stays on the Sydney instance, and a browser Do Not Track signal is honoured. Nothing about analytics is shared with an advertising network.
| Data | How long | Notes |
|---|---|---|
| Educator records | 7 years after the record is deleted in Covered | Our own retention choice, for employment and taxation record-keeping. Some records carry a shorter regulatory minimum; we keep them longer, not shorter. |
| Compliance records, including working-with-children check records | 7 years after the record is deleted in Covered | Kept as the evidence trail a regulator or an assessor may ask us to produce. |
| Room observations and daily operational records | 7 years after the record is deleted in Covered | Room-level records. They name educators and rooms, never a child. |
| Uploaded documents | Kept until deleted; there is no automatic deletion of a document today | Uploaded documents are retained. Deleting the record a document was filed against detaches the document from that record rather than deleting it, and nothing removes a stored document on a schedule today. Removal is carried out on request. |
| Rejected document uploads | Quarantined and queued for removal as soon as the upload is rejected | When an upload is rejected, the stored copies are quarantined and queued for removal across the upload, scanning and document stores. Where a copy cannot be removed automatically it is flagged to an administrator and stays until that is done. |
| Working copies made while reading a document | Deleted as the read finishes, and in any case within 1 day | Reading a scanned document needs a short-lived copy inside our own Sydney storage. It is deleted when the read finishes, and a storage rule expires anything left behind. |
| Stored results of AI compliance analyses | 90 days | The stored output of an analysis. The record that the analysis happened stays in the activity log after the output is gone. |
| Activity log | Kept permanently, and hash-chained so tampering is detectable | Append-only by design: the product has no path that edits or deletes an entry, and each entry is hash-chained to the one before it, so tampering with the log is detectable. |
| Records about an individual child | Not collected, so nothing is held or retained | Covered holds no records about an individual child in this release, so there is nothing to retain. If per-child records are ever added, the retention schedule for them will be published before they are. |
How the schedule is enforced, stated exactly. These windows are our policy. A weekly job identifies records that have passed their window and deletes them, without anyone having to ask. Uploaded documents are the exception described in the table above: they are retained rather than deleted on that schedule. Deleting a record in the application removes it from every screen and every report immediately.
The longest windows in the table are our own choice. The education and care regulations set shorter minimums for some of these records; we keep them longer for employment and taxation record-keeping reasons, and we would rather say that than claim a regulation requires it.
If your personal information is held in Covered, you can:
We may update this policy. The current version is always published at https://app.coveredapp.com.au/privacy with the date it was last updated, and the same version is available from inside the application. Where a change materially affects how we handle personal information, we will email the account owner of each organisation using Covered before it takes effect.
For privacy enquiries, access requests, corrections or complaints, email privacy@callixo.com.au.
Callixo Technologies Pty Ltd · ABN 85 696 368 153 · Australia
If our answer does not satisfy you, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.