Privacy Policy

Last updated: 7 September 2026

OurHub (“we”, “us”) is a registered business name of a sole trader based in New South Wales, ABN 26 338 765 388, who hosts websites for community groups and towns. The registered holder is named on the public register at abr.business.gov.au. This policy explains what personal information we collect, why, and how we look after it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Short version: we collect what the service needs to work, we do not run advertising trackers, and we never sell personal information.

1. What we collect

If you run a site (account holders and team members)

Your name and email address, and a password we store only as a salted cryptographic hash — we cannot read it.
The content you publish and the records you keep in your dashboard.

If you visit or use a community site

What you submit through that site's forms — contact messages, event RSVPs, booking requests, membership applications, directory suggestions, survey responses, and offers to help run a town hub. Typically a name, email address, sometimes a phone number, and your message.
These submissions go to the committee that runs that site (see section 3).

Records committees keep about their members

Committees may keep membership registers on OurHub — names, contact details, membership status and payment records. That information belongs to the group; we host it for them.

Technical information

Standard server logs (IP address, browser type, pages requested) kept briefly for security and troubleshooting by us and our hosting provider.
One session cookie when you sign in to the dashboard, so you stay signed in. Public community sites set no cookies. We use no advertising trackers or third-party analytics.

2. How we use it

To provide the service: hosting sites, delivering form submissions to the right committee, sending the emails the service needs (invitations, notifications, receipts).
To keep the platform secure and diagnose problems.
To contact account holders about their account and important changes to the service.

We do not use your information for advertising, and we do not sell or rent it to anyone.

3. Community sites: who holds what

Each community site is run by its own committee. When you submit a form on a community site, your submission is for that committee — they read it in their dashboard and respond from their own email. The committee is responsible for what it collects and how it uses it; OurHub stores and processes it on the committee's behalf. If you want information about you corrected or removed from a community site, the fastest route is the committee itself — and we will always help if you contact us instead.

4. Who we share it with

Only the service providers that make OurHub work, and only what they need:

Cloudflare — hosting, storage and content delivery. Data is stored on Cloudflare's network, which operates globally, so information may be processed outside Australia.
Resend — sends our transactional email (a US-based provider; it processes the email address and message content of mail we send).
Stripe — processes subscription payments. Your card details go directly to Stripe; we never see or store them.
Anthropic — checks content the moment it is published. Every public page, post, event, listing and notice is sent, as text (and pictures, once uploaded), to Anthropic's Claude service to be read against our acceptable use policy, and the answer comes back in seconds. Anthropic processes it on our behalf, in the United States, does not use it to train its models, and keeps it only as long as its own retention policy requires. Nothing private is sent: no member records, form responses, passwords or unpublished drafts.
Google Fonts — serves the typefaces our pages are set in. Your browser requests them from Google when a page loads, so Google sees your IP address and that a page was loaded. No cookie is set, and nothing there is used to track or advertise to you.

Beyond that, we disclose personal information only if the law requires it, or to enforce our terms or protect people's safety. Where information is processed overseas, we choose providers with strong, well-audited privacy and security practices.

5. Security

All traffic is encrypted in transit (HTTPS everywhere).
Passwords are hashed, never stored or transmitted in plain text.
Dashboard access is limited to the people a group's owners have invited, with role-based permissions.

No system is perfectly secure, but if a data breach ever occurs that is likely to result in serious harm, we will notify affected people and the OAIC in line with the Notifiable Data Breaches scheme.

6. How long we keep things

Account and site content: for as long as the account is active. When a site closes, content is deleted within a reasonable period, allowing for backups to cycle out.
Form submissions: kept until the committee (or we) delete them.
Server logs: kept briefly and rotated automatically.

7. Your rights

You can ask us at any time to access, correct or delete personal information we hold about you, or to export your group's data. Email hello@ourhub.au and we will respond within 30 days. If you are unhappy with how we have handled your information, tell us first and we will try to put it right; you can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

8. Children

OurHub is not directed at children, and dashboard accounts are for people 16 and over. That rule is about who signs in — it is not the whole picture, because a lot of community life involves young people.

Registers can contain children's details. A junior sports club, a P&C or a youth group keeping its membership register on OurHub will hold names, ages, contact details and payment records for people under 16. That information belongs to the group, not to us: the committee decides what to collect and is responsible for having a parent's or guardian's consent to hold it. We ask committees to collect only what the group actually needs, to keep it to themselves rather than publishing it, and to remove it when a membership ends.

Photos. We ask committees to obtain consent before publishing identifiable photos of children, and we act quickly on requests to take them down.

If you are a parent or guardian and want to know what a group holds about your child, or want it removed, ask that committee first — it is their register and they can act on it straight away. If you cannot reach them, or you are not getting anywhere, use the Report a problem link in the footer of any community site and it comes to us instead.

9. Changes to this policy

If we change this policy in a way that matters, we will note it here and give account holders notice by email or in the dashboard. The date at the top always shows the current version.