Privacy Policy
1. Who this policy applies to
This policy applies to two groups of people:
- Contractors — sole traders, performers, artists, sportspeople, and other individuals whose superannuation contributions are processed through ContriPay.
- Employers — businesses and venues that use ContriPay to meet their superannuation obligations when engaging contractors.
Different information is collected from each group. Where this policy refers to both groups, it says “you.” Where it applies to one group only, it says “contractor” or “employer.”
2. What information we collect
From contractors
| Information | Why we collect it |
|---|---|
| Legal name | Required for SuperStream and for recipient created tax invoices (RCTIs) |
| Email address | To send invites, onboarding links, and RCTIs |
| Gender | Mandatory SuperStream field required by the clearing house |
| Date of birth | Mandatory SuperStream field required by the clearing house |
| Residential address | Mandatory SuperStream field required by the clearing house |
| ABN | Required for RCTI and to confirm GST registration status |
| Stage name or act name | Optional; displayed on RCTIs where provided |
| Tax file number (TFN) | Required to route contributions to your super fund |
| Bank account details (BSB and account number) | Required for super fund contribution processing via SuperStream |
| Super fund details (fund name, USI, member number) | Required to direct your super contribution to the correct fund and to check your member details with the fund |
| RCTI agreement acceptance (time, version of the agreement, and the employer) and GST registration status | To record that you agreed that the employer may issue recipient created tax invoices for your services |
From employers
| Information | Why we collect it |
|---|---|
| Business name and ABN | Required for SuperStream employer identification and RCTIs |
| Contact name, email address, and phone number | Account administration and SuperStream employer contact requirements |
| Refund bank account (BSB and account number) | Required by the clearing house to return funds if a super contribution cannot be processed |
| Stripe customer reference | Stored to identify the employer in Stripe's billing system — no payment credentials are stored by ContriPay |
| Subscription and billing records | Fee structure, included job count, and overage rates applied at the time of subscription — retained as an audit record |
| Accounting software OAuth tokens | To post RCTIs to the employer's accounting software on their behalf |
3. How we collect information
We collect contractor information directly from contractors via the onboarding form linked in the invite email sent by their employer. Contractors provide their own details and submit them through the form.
We collect employer information directly from employers during account registration on contripay.com.au.
ContriPay looks up the ABN entered by an employer or contractor in the Australian Business Register (ABR JSON API) to confirm the registered name and GST registration status. This is publicly available information.
We also receive information from the service providers listed in section 6 as part of providing the service. SuperChoice tells us the payment status, member verification results, and the reason a contribution was rejected. Xero tells us whether a matching contact exists in the employer's file. Stripe tells us whether a fee payment succeeded. Resend tells us whether an email was delivered. We do not collect personal information from data brokers.
4. How we use personal information
We use personal information only for the purpose it was collected:
- To calculate, record, and submit superannuation contributions to the contractor's nominated fund via the SuperChoice clearing house
- To ask the contractor's super fund to confirm their member details when they save their fund details
- To generate and deliver recipient created tax invoices to the contractor and post them to the employer's accounting software
- To communicate with contractors and employers about their account and contribution status
- To meet our obligations under the Superannuation Guarantee (Administration) Act 1992, the Superannuation Industry (Supervision) Act 1993, and related ATO rulings
We do not use personal information for marketing, profiling, or any purpose unrelated to superannuation processing. We do not sell personal information.
5. Cross-employer contractor records
ContriPay maintains a single record per contractor. If you are engaged by more than one employer that uses ContriPay, your existing details will be pre-filled into the onboarding form when a new employer invites you. This means you do not need to re-enter your information for each new engagement.
Employers cannot view your personal information until you have accepted their invite. Your details are never shared between employers. Each employer sees only what is described in section 6.
6. Who we disclose information to
- SuperChoice Services Pty Limited (ABN 78 109 509 739)
Authorised representative of PayClear Services Pty Limited (ABN 93 124 852 320), AFSL 314357. SuperChoice processes and routes super contributions via SuperStream. PayClear holds contribution funds in transit prior to disbursement to the contractor's nominated fund. SuperChoice also passes member verification requests to the contractor's super fund. A request carries the contractor's name, gender, date of birth, residential address, TFN (or a code showing none is held), member number, and the reference number ContriPay gives the contractor. It also carries the fund's USI (or the self managed super fund's details) and the employer's business name, ABN, and contact person details. It carries no bank details. The fund replies with a result code, which ContriPay keeps. Employers should consider the SuperChoice Clearinghouse Combined Financial Services Guide and Product Disclosure Statement before using the service.
- The contractor's super fund
Through SuperChoice, the contractor's super fund receives each contribution and each member verification request for the contractor, with the details described above. The fund holds those details under its own privacy policy.
- Xero Limited
ContriPay posts RCTIs to the employer's Xero account using the employer's own Xero OAuth connection. Xero receives the contractor's name, email address, and ABN on the contact, the bank account details, payment amount, and GST status on the bill, and a PDF copy of the RCTI attached to the bill. The PDF shows the contractor's name, stage name, ABN, masked bank details, and, for an individual contractor, the super fund name, USI, masked member number, and super amount. Xero may transfer and process this data in countries other than Australia, including New Zealand and the United States, in accordance with Xero's own privacy policy at xero.com/au/legal/privacy.
- Resend Inc
Our transactional email provider. Resend delivers invite emails, RCTIs, and failed contribution follow-up emails to contractors, and magic link authentication emails and contribution status emails to employers. Resend processes email addresses and message content for delivery only.
- Stripe Inc
ContriPay's payment processor for platform subscription fees. Employer name, business name, and contact email are sent to Stripe to create a billing customer record. Payment credentials — bank account details for BECS direct debit, and card details for card payments — are submitted directly from your browser to Stripe and never pass through ContriPay's servers. Stripe stores payment credentials, manages invoicing, and handles failed payment retries and refunds. Stripe operates under its own privacy policy at stripe.com/au/privacy. ContriPay retains only a Stripe customer reference identifier against the employer record — no raw payment credentials are stored by ContriPay.
- The engaging employer
Once a contractor has accepted an invite, the employer can see the contractor's name, stage name, email address, ABN, and GST status. The employer can also see the name of the contractor's super fund, the fund's USI (or the fund's ABN for a self managed super fund), the last 2 digits of the contractor's member number, and the result of the member verification check that ContriPay sends to the fund. This helps the employer resolve a member verification problem or a rejected contribution. ContriPay does not show the employer the contractor's TFN or bank details. Bank account details appear on the recipient created tax invoice in the employer's accounting software.
We do not disclose personal information to any other third party unless required by law.
7. Overseas transfers
Some personal information is transferred to and processed by third-party service providers located outside Australia. These providers and the countries involved are:
- SuperChoice / PayClear — Australia only
- Xero Limited — data may be transferred to and processed in New Zealand, the United States, and other countries. See xero.com/au/legal/privacy.
- Resend Inc — United States. Account data, email metadata, and logs are stored in the United States regardless of sending region.
- Stripe LLC — United States and potentially other countries. See stripe.com/privacy.
Each provider maintains safeguards for cross-border data transfers. ContriPay takes reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.
8. Tax file numbers
ContriPay collects TFNs under the authority of the Superannuation Industry (Supervision) Act 1993 and the Taxation Administration Act 1953. TFNs are collected solely for the purpose of processing super contributions. TFNs are sent to the contractor's super fund through SuperChoice, in contributions and in member verification requests, so the fund can match the member.
Providing your TFN is voluntary. It is not an offence to decline. However, if you do not provide your TFN, your super fund may deduct additional tax from your contributions, and some types of contributions may not be accepted.
TFNs are encrypted at rest using AES-256-GCM encryption. TFNs are never included in emails, logs, error messages, or any system output outside the encrypted database field. Your TFN is held for as long as your contractor record is active. This is because SuperStream requires that if a TFN is in our possession it must be included in every super contribution payload submitted on your behalf. Your TFN will be deleted when your contractor record is closed or deleted.
9. How we store and protect your information
ContriPay's database and files are stored in Australia on Amazon Web Services infrastructure in Sydney (AWS region ap-southeast-2), provided through Supabase. The ContriPay application runs on Vercel in Sydney. Requests to the database and the application can be routed through other regions by Supabase and Vercel, but the data is stored in Sydney. Information we send to the providers listed in section 6 is held by them as described in section 7.
Sensitive fields are encrypted at rest using AES-256-GCM encryption before being written to the database. Encrypted fields include: TFN, bank BSB, bank account number, super fund member number, and accounting software OAuth tokens.
Access to the database is controlled by row-level security policies. No personal information is accessible from the browser — all reads and writes go through authenticated server-side functions. Contractor data is only accessible using a valid, single-use, time-limited invite token or an authenticated account session.
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. We will notify affected individuals and the Office of the Australian Information Commissioner in the event of an eligible data breach under the Notifiable Data Breaches scheme.
10. Retention and deletion
We retain contractor records for as long as the contractor has an active relationship with any employer on the ContriPay platform, and for the period required to meet our obligations under the Superannuation Guarantee (Administration) Act 1992 and ATO record-keeping requirements.
TFNs are retained for as long as the contractor record is active, as described in section 8.
We keep the record of each RCTI agreement for 7 years after the agreement ends.
If you request deletion of your record and we are not subject to a legal obligation to retain it, we will delete or de-identify your information within 30 days.
11. Your rights
Under the Australian Privacy Principles, you have the right to:
- Access — request a copy of the personal information we hold about you
- Correction — request that inaccurate or outdated information be corrected. Contractors can update their own details at any time via their account at contripay.com.au/account
- Deletion — request that we delete your personal information, subject to our legal retention obligations
- Complaints — make a complaint about how we have handled your personal information
We will respond to access and correction requests within 30 days.
12. Complaints
If you have a concern about how we have handled your personal information, contact us first using the details below. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.
13. Changes to this policy
We may update this policy from time to time. Where a change is material, we will notify employers by email and update the effective date at the top of this page. Continued use of ContriPay after a policy update constitutes acceptance of the revised policy.
Contact
Nebulous Enterprises Pty Ltd
ABN 13 634 749 509 trading as ContriPay
Privacy enquiries: privacy@contripay.com.au
General enquiries: hello@contripay.com.au
Website: contripay.com.au
Contractor terms: contripay.com.au/contractor-terms