Collection Notice

The short version

You can skip any question and use CrisisFlare without giving your name. What you enter is used only to match you to support services and — if you choose — to connect you with one. No service ever sees who you are unless you say yes. We only ever ask for your suburb or postcode — never your exact address. If you type in the optional note box, that text is read once by an AI to improve your matches — sent without your name, never stored by us. Typing nothing means no AI is used.

(a) Who is collecting your information

CrisisFlare, currently operated by its founder, Graham Huf [legal entity and ABN to be confirmed on incorporation]. Privacy questions and requests: [email protected].

(b) What we collect, and when

People seeking help: the information you enter — answers about your situation (some of which is sensitive information, like health, family-violence circumstances, Aboriginal or Torres Strait Islander status, or LGBTQIA+ status), your suburb or postcode, and the optional “anything else” note. If you raise a flare or message a service, we also collect any contact details you choose to give and the messages you send. We collect it directly from you, or from a support worker helping you with your knowledge and agreement. Your question answers are stored on your own device; they are stored in our systems only when you raise a flare or send a message. Two transient exceptions during the questions: the postcode you type goes to our suburb lookup (Australia Post) to suggest suburb names, and the optional note is processed as described next — neither is stored, and neither carries your name.

The optional note (AI-assisted matching): if you type in the “anything else” box, we send that text once to our AI provider (Anthropic) so it can understand your situation and improve your matches. It is sent without your name or contact details, used only for that search, and not stored by us — the copy your device keeps stays on your device. Anthropic processes it transiently under our agreement and does not use it to train AI models; we are finalising a zero-data-retention arrangement [to be confirmed]. Leaving it empty means no AI is used.

Technical: like every website, traffic data (including IP addresses) passes through our infrastructure providers to deliver the site; we do not use it to identify you. We also count how the site is used in anonymous totals (for example, that a search for housing in a state found no results) — these counts identify no one and contain no free text.

Partner organisation representatives: your work email and password (stored hashed), multi-factor authentication enrolment, your organisation’s name and ABN (which we check with the Australian Business Register), a verification contact — name and/or email; please make sure that person knows you are providing their details — and any notes you provide.

Our public directory: listings are about organisations, not individuals, and are built from public sources — the ACNC Charity Register and charities’ own websites. Where a published detail identifies a person (for example a sole trader), we treat it as personal information — see the Privacy Policy, section 4.

If you register interest in supporting CrisisFlare: your name, email, supporter type, and any message you leave — used only to talk with you about supporting the service.

(c) Is it required by law?

No. Giving us information is voluntary. No part of the standard service requires collection by law [exceptions, if any, to be confirmed in legal review].

(d) Why we collect it

To match you to services that fit and have capacity; to let you raise an urgent request for help; to connect you with a service you choose; to pass messages between you and that service; to keep the service safe (preventing abuse and misuse); to understand service coverage and how the site is used — using de-identified, area-level records and anonymous usage totals only; and (for organisations) to verify partner services.

(e) What happens if you don’t provide it

You can skip anything and still browse services. With fewer details your matches may be less tailored, and an urgent request may reach fewer services — but skipping never locks you out. Organisations can’t be registered or verified without an ABN and a contact; supporters can’t be contacted without an email.

(f) Who we usually share it with

Only the service you choose — and only after it offers to help and you consent. Until then, your information travels as a de-identified summary with no name and no contact details (your summary text is shared exactly as you wrote it, so it’s best not to include identifying details in it). Three exceptions: our AI provider (Anthropic) processes the optional note as described in (b); our infrastructure providers (listed in the Privacy Policy, section 9) process limited data to run the service; and we check partner organisations’ ABNs with the Australian Business Register. Otherwise we share personal information only where required by law — and then only the minimum.

(g) Access and correction

You can ask for a copy of your information, or ask us to correct or delete it — see the Privacy Policy (sections 10–11), or use “Delete all my data” in My flares at any time.

(h) Complaints

Complain to us at [email protected]; if unresolved, to the OAIC (oaic.gov.au, 1300 363 992).

(i) Overseas disclosure

Our primary data store is in Australia (Sydney). The optional note is processed by Anthropic in the United States. Website delivery (Cloudflare), organisational email (Resend, Google Workspace), and charity phone-number checks (Twilio) involve US providers processing limited data as described in the Privacy Policy, section 9. We take the steps APP 8 requires [mechanism being confirmed in legal review], and we are pursuing a zero-data-retention arrangement for the AI note [to be confirmed].

(j) Countries

Primarily the United States (Anthropic — the optional note; Cloudflare — traffic; Resend and Google — organisational email; Twilio — charity phone checks; GitHub — behind-the-scenes checks of charities’ published directory details, organisational data only). Some infrastructure providers (Cloudflare, Google) operate global networks, so traffic and email may transit other countries. Our primary data store remains in Australia.