Who we are
Prodja is offered by Ezyful Pty Ltd (ABN 77 655 487 406), trading as Prodja. We handle personal information in line with the Australian Privacy Principles. Questions, requests and complaints: privacy@prodja.com.au.
In short
- Prodja is about businesses, not people. It holds nothing about participants.
- For people who use Prodja, we keep what’s needed to run their account, and nothing is sold, shared for advertising or used to track you across the web.
- Prodja’s data is hosted in Sydney, Australia.
Information about businesses
Prodja holds business-level facts about providers from public and licensed sources: the NDIS provider register, Google search results and business profiles, ads, directories, business websites and government data. The methodology lists every source.
- No reviewers’ names or review text: only counts and ratings.
- No social media posts, and no profiles of individual workers.
- Addresses from the register are never shown or exported; they are used only to count coverage by area, because they can be where services are delivered, even people’s homes.
- Phone numbers are kept only as a one-way code, used to match records, never as numbers.
- Some businesses carry a person’s name, such as a sole trader’s. We show it only as the business’s name, as it is published.
Information about people who use Prodja
- Your account: your name, email address, a secure hash of your password, your two-factor setting, your organisation and your role.
- Invitations: the email address invited, who sent the invitation and when. The link in it is stored only as a one-way code.
- Claiming a business: the business claimed and how it was verified. For a code sent by email, we keep the website’s domain, not the address it went to; codes are stored only as one-way codes.
- Sessions: while you’re signed in, your session keeps your browser’s description (its user agent). Your IP address is used only to slow repeated sign-in attempts and is never stored.
- Use of Prodja: which pages your organisation reads, how long they take to load, and when you sign in, so we can make Prodja faster and see what’s useful. These records hold no IP address and no device details.
- Actions: a record of important actions, such as sign-ins, invitations, claims and changes to your areas, so we can show who did what.
- Billing: your organisation’s billing contact, plan, price and invoices.
- Emails: whether our emails to you were delivered. An address that bounces or reports our email as spam is not emailed again.
- Feedback: notes from pilot feedback sessions, recorded by role, without your name.
- Shared snapshots: a shared snapshot counts, for its own link, how often it is opened and read, clicks on its next step and answers to “Was this useful?”. So that each counts once per visit, the page keeps a random code in the browser tab until the tab is closed. Nothing about who you are is recorded.
How we use it
To run your account and your organisation’s subscription, verify claims, send the emails the service needs, keep Prodja secure, fix faults, improve Prodja and invoice you. We don’t use it for anything else without asking, and we don’t send marketing emails to your account.
Our team’s access
- Our team can see account and organisation details to run the service. Staff accounts use two-factor sign-in, and staff actions are recorded.
- To answer a support request or look into a fault, a senior member of our team may view an organisation’s dashboard as it sees it: read-only, for at most 30 minutes, with the reason recorded and the organisation’s owners told.
Who we share it with
We don’t sell personal information. We share it only with the service providers below, who handle it for us under their own security and privacy obligations, or where the law requires it.
| Provider | What it does | Where |
|---|---|---|
| BinaryLane | Runs Prodja’s servers. | Sydney, Australia |
| Supabase | Hosts Prodja’s database and stored files, such as snapshot PDFs. | Sydney, Australia |
| Resend | Sends Prodja’s emails: invitations and verification codes. | United States |
| Sentry | Receives error reports from Prodja’s background jobs, so we can fix faults. | United States |
| Xero | Keeps invoices and the billing contact for each paying organisation. | United States and Australia |
| Cal.com | Books walkthroughs from a snapshot page: the name and email given when booking. | United States |
So some information, such as your email address, may be held or processed outside Australia, in the countries shown. We choose providers that protect it to a standard comparable to the Australian Privacy Principles.
Cookies and tracking
Signing in sets one cookie, to keep you signed in. Public pages, including shared snapshots, set no cookies. Prodja has no advertising or analytics trackers.
Security
Connections are encrypted. Passwords, invitation links and verification codes are stored only as one-way codes. Each organisation sees only its own data, which is checked on our servers for every request. No system is perfectly secure; if a breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner as the law requires.
How long we keep it
- Account information, for as long as your account exists. When your organisation’s subscription ends, you can ask us to delete its data; we’ll do so within 30 days.
- Invoices and billing records, for as long as tax law requires.
- Records of important actions, for as long as they’re needed to keep Prodja secure and resolve disputes.
If we’ve contacted your business
We may email a business about Prodja at an address it publishes for business enquiries, such as on its website, about something relevant to its business. We record where we found the address. Every such email says who we are and has a way to opt out, which we honour.
If you book a walkthrough from a snapshot, the booking is made through Cal.com, which takes the name and email you give it. We use them only to hold the walkthrough.
Access, correction and complaints
- You can ask to see the personal information we hold about you, or to correct it, by writing to privacy@prodja.com.au. We’ll reply within 30 days.
- A business can ask us to correct information Prodja shows about it. Tell us what’s wrong and how to check it; we’ll look into it and reply within 30 days.
- If you have a complaint, write to us first and we’ll respond within 30 days. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
Changes to this policy
We’ll update this policy when how we handle information changes, and show the date it takes effect at the top. For a change that matters, we’ll tell account owners first.