Privacy Policy

Kickbacks is operated by Kickbacks for Kids (ABN 17 611 988 900) (Kickbacks, we, us). Our website is https://kickbacks.app and you can contact us at support@kickbacks.app.

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It applies to supporters, businesses, club representatives, administrators and website visitors.

You must be at least 16 years old to create a Kickbacks account. We do not knowingly collect personal information from people under 16. If we learn that we have, we will delete it.

Supporters (people requesting a service). Name, email, phone, account credentials managed by our authentication provider, the club you nominate, your service request details (service type, description, urgency, preferred timing), your location information (see below), and communication preferences. We use this to publish an eligible lead to matched businesses, to let a purchasing business contact you, to credit your nominated club, and to support your account.

Businesses. Business name, ABN, contact name, business email and phone, logo, licence and credential details you supply, selected service categories, selected service areas (clusters), notification preferences and consents, subscription and payment status, and lead purchase history. If you submit a refund or invalid-lead claim, we also collect the reason you select, the explanation you write and any evidence you upload (such as call-log, SMS or email-failure screenshots), and we use it only to assess and record that claim. We use this to determine lead eligibility, to run matching and notifications, to process subscriptions and lead purchases, and for support, fraud prevention and audit.

Clubs and club managers. Club name, logo, sport, location, public contact details, claim application details (claimant name, position, relationship, official club email, supporting notes and any evidence you upload), verification records, and club ledger entries. We use this to verify authority, operate club pages, and record club funding.

Administrators. Account identifiers and an audit record of administrative actions taken on the platform.

Visitors. Technical information such as IP address, device and browser information, pages requested and referral information, collected through normal web server and edge network logging.

This is a core commitment of the platform and it applies before and after a lead is purchased.

• Your exact street address may be stored privately on your profile, and may be used for your convenience (pre-filling a request) and for matching. It is never disclosed to businesses.
• Businesses may see only your suburb or locality, city or region, state or territory, postcode, and the relevant service area (cluster).
• A purchased lead may unlock the permitted contact details you provided — name, phone, email and your request details — but it never unlocks your street address or precise coordinates.
• This is enforced in our database as well as in the interface: street address columns are not readable by business accounts.

If you choose to give a business your street address yourself (for example, when you talk to them about a quote), that disclosure is made by you and is outside the platform.

Where a service is regulated, we may collect and check licence or credential details supplied by a business, and may ask for supporting evidence. Verification is an administrative check of the information supplied. It does not make Kickbacks a regulator and it is not a guarantee of a business's competence, currency of licence or quality of work.

We use automated processing to decide which businesses are eligible to see or be notified about a lead. Eligibility is based on service category, delivery mode, geography (service locality or preferred provider area and the business's selected clusters), subscription or administrator-granted access, notification preferences, and account status. Automated matching does not produce legal effects for you; a human can review any eligibility question you raise with support.

Where a club has been nominated by a supporter but has not completed Kickbacks verification, we may use publicly listed or club-supplied contact details (such as a club email address, phone number or website contact form) to invite the club to verify or claim its profile, and to record whether that contact was made. We use those details for that verification and administration purpose only.

Operational messages are part of the service and cannot be switched off while you hold an account: account confirmation, password reset, security notices, transaction receipts, lead and job status updates, club claim outcomes, and important changes to these terms. They may be sent by email and, where relevant, by push notification.

Matched-lead notifications for businesses are sent by email and web push to businesses who have opted in, and by SMS only where the business is eligible and has given separate, explicit SMS consent. Consent can be withdrawn at any time and an opt-out always wins.

Marketing messages are separate and optional. You choose them at signup or in your profile, and every marketing message includes an unsubscribe option.

We disclose personal information to:

• A business that purchases your lead — permitted contact and request details only, never your street address or precise coordinates.
• Stripe — payment processing for subscriptions and lead purchases. Card details are handled by Stripe, not stored by us.
• Resend — transactional and notification email delivery.
• Twilio — SMS delivery where SMS notifications are enabled.
• Google — where you choose Google sign-in.
• Cloudflare — content delivery, edge request processing and security.
• Lovable / Supabase (AWS) — application hosting, database, authentication and file storage.
• Web push infrastructure — the push services operated by your browser or device vendor, used to deliver push notifications you have opted into.
• Clubs — aggregate and transaction-level funding information relating to leads nominated to that club.
• Professional advisers, law enforcement or regulators where required or authorised by law, and to a purchaser in connection with a sale of the business.

We do not sell personal information.

• Primary data at rest: Singapore, on Supabase infrastructure running in AWS region ap-southeast-1. This includes the database, authentication data and uploaded files.
• Edge processing: requests are processed on Cloudflare's global edge network, which may be in any country, including outside Australia.
• Additional processors: identifiable data may be processed in the United States and globally by Stripe, Resend, Twilio and web push providers.

By using Kickbacks you acknowledge that your personal information is stored and processed overseas as described above. We take reasonable steps to ensure our providers handle personal information consistently with the Australian Privacy Principles, but overseas recipients may be subject to foreign laws.

We use row-level database security so that accounts can only read the data they are entitled to, column-level restrictions to keep street addresses out of business-facing queries, encrypted transport, restricted administrator access, audit logging of sensitive administrative actions, and file upload limits and access controls for evidence and logos. No system is completely secure, and we cannot guarantee absolute security.

We keep personal information for as long as needed for the purpose it was collected, and then for as long as we are required to keep it for tax, accounting, dispute, fraud prevention and audit reasons.

Financial and audit records — lead purchases, refunds, club ledger entries, webhook and administrative logs, and legal acceptance records — are retained even after an account is closed. Where an account with financial history is closed, we anonymise the personal identifiers rather than deleting the transaction record.

You can view and correct most of your information in your profile. You can also ask us for access to, or correction of, the personal information we hold about you by emailing support@kickbacks.app. We will respond within a reasonable period and will tell you if we need to refuse access and why.

You can ask us to close your account. Where you have no financial history we can delete your account data. Where you do, we anonymise your personal identifiers and retain the underlying transaction and audit records as described above.

We use cookies and similar browser storage that are necessary to operate the platform — keeping you signed in, remembering the role you selected at signup until it is applied, and keeping security state. We use aggregated request and error logging to keep the service reliable. We do not run third-party advertising trackers. You can block cookies in your browser, but the platform will not work correctly without the necessary ones.

If you think we have mishandled your personal information, email support@kickbacks.app with the details. We will acknowledge your complaint and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy. The version number and effective date at the top of this page always show the current version, and we keep a record of the version each user accepted. Where a change materially affects you, we will give reasonable notice and, where a document requires acceptance, ask you to accept the new version. See also our Terms of Use.