PaperCalm Privacy Policy

Last updated: 05/10/2026

PaperCalm ("we," "us," "our") is operated by PaperCalm (ABN 74 880 132 695). This policy explains what personal information we collect through papercalm.co (the "Service"), why we collect it, how it's used, and what rights you have over it.

PaperCalm helps NDIS participants, families, and carers understand NDIS paperwork, prepare information for NDIS processes, and stay organised. PaperCalm is not the NDIS or the NDIA, does not make or influence eligibility or funding decisions, and does not submit anything to the NDIS on your behalf. You review and submit everything yourself.

This policy is written to comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information we collect

Account information

• Your email address (used for passwordless login via a one-time code)
• A session token, stored to keep you logged in

Information you provide us

• Names of people you add to your account (e.g., yourself, or someone you support or care for)
• Descriptions of your situation that you type into the "Tell us what's changed" tool
• Documents you upload for explanation or to help draft form responses (e.g., NDIS letters, decision letters, reports)
• Answers you give in the guided form assistant

Information generated for you

• Plain-language explanations of documents you upload
• Situation summaries created from what you tell us
• Draft responses generated to help you prepare NDIS forms
• Your answers to NDIS forms you choose to fill in here (like the Access Request Form), and the key facts from your documents used to draft them, such as a diagnosis, treatments, and how a disability affects daily life. PDFs of your answers are made on your own device and are not stored by PaperCalm.

Payment information

• If you subscribe, payments are processed by Stripe. We do not receive or store your full card number. See Stripe's own privacy policy for how they handle payment data.

The Sunday Calm newsletter

• If you sign up for The Sunday Calm, our free weekly email, we collect your email address and, if you give it, your first name. We also note where you signed up (for example, a blog post, or a link in one of our emails), so we can see which signup works best.
• We use these only to send you the weekly newsletter. We don't add you to anything else, and signing up doesn't create a PaperCalm account.
• Your details are stored with Kit (ConvertKit), the service that sends the newsletter. Kit sends a confirmation email first, and nothing else is sent until you confirm. Kit may record whether a newsletter email is opened or a link in it is clicked, which helps us see how the newsletter is going.
• You can unsubscribe at any time with the link at the bottom of every email. You can also ask us to delete your details through our contact page.
• If you close the signup box on our site, or sign up, your browser remembers that for 30 days so it doesn't ask again. This is stored only on your device.

Technical information

• Basic technical and error logs, so we can see when something isn't working. We don't use analytics or tracking tools, and we don't build a profile of you.
• The dates (not times) you opened your dashboard in the last 14 days. We only use these to count, in weekly totals, how many people come back to PaperCalm. Those totals never include your name, email or anything about you.

We do not collect health or disability information unless you choose to share it with us, for example by uploading a document or describing your situation. Because this may include sensitive information under the Privacy Act (including health information), we treat it with extra care, as set out below.

2. How your information is used

We use your information to:

• Provide the core Service: explaining documents, generating situation summaries, and helping you prepare forms
• Maintain your account and let you log in
• Email you 7 days and 2 days before a deadline found in one of your documents. The email says only what's due, for whom, when, and what the document says happens if it's missed. You can turn these emails off with the link in any reminder, or under Account in your dashboard.
• Send The Sunday Calm, our weekly newsletter, if you signed up for it. You can unsubscribe from any newsletter email.
• Process payments and manage your subscription
• Keep a record of documents and summaries so you can return to them later, if you're logged in and this feature is enabled for your account
• Respond to support requests
• Improve the Service (using de-identified or aggregated information wherever possible), for example weekly totals of new accounts, documents explained and returning visitors, which contain only numbers

We do not use your information to make, suggest, or imply any decision about your NDIS eligibility or funding. We do not sell your information to anyone.

3. How AI processing works

When you upload a document or describe your situation, that content is sent to Anthropic (the provider of the Claude AI model) to generate the explanation, summary, or draft you see.

Anthropic retains this content for up to 30 days and does not use it to train its models. Anthropic may retain content for longer only if it is flagged for breaching its usage policies.

Draft responses generated by AI are always clearly labelled as AI-generated drafts for you to review. PaperCalm does not treat AI output as advice, and you are responsible for checking anything before you use or submit it.

4. Where your information is stored

• Account and record data is stored with our database provider, Airtable, on their secure infrastructure.
• Uploaded documents are temporarily stored during processing and are deleted automatically once processing is complete. If processing is interrupted (for example by a dropped connection), anything left behind is deleted automatically, normally within a few hours. We keep the explanation or summary, not the original document.
• Emails (login codes and deadline reminders) are sent via Resend.
• The Sunday Calm newsletter, and the email address and first name you gave for it, are held by Kit (ConvertKit).
• The Service itself is hosted via Netlify.

Some of these providers may store data on servers outside Australia. By using the Service, you consent to your information being handled by these providers as described in this policy.

5. Keeping your information secure

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, use, or disclosure, including:

• Encrypted connections (HTTPS) between your device and our servers
• Passwordless login (no passwords to be stolen or reused)
• Access to stored data limited to what's needed to run the Service

No online service can guarantee perfect security. If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

6. Keeping only what we need

We keep your information for as long as your account is active, or as long as needed to provide the Service to you, whichever is relevant. When information is no longer needed for the purpose it was collected for, we take reasonable steps to destroy or de-identify it, subject to any legal requirement to keep it longer.

You can delete your information yourself, at any time, from the Account tab in your dashboard:

• Remove a person you've added. This permanently deletes that person and every document, summary and tracker saved for them.
• Delete your account. This permanently deletes your account, every person you've added, and every document, summary and tracker, straight away. It can't be undone.

When you delete your account:

• Any subscription is cancelled at the same time, so you won't be charged again. There's no refund for time already paid.
• From your account itself, we keep only a scrambled code made from your email address (not the address itself). It's only used so the free trial can't be started again with the same email.
• Stripe keeps its own record of payments you've made, as payment providers are required to.
• Temporary copies are cleared automatically: uploaded files within hours, document results waiting to be shown within a day or two, and error logs after 30 days.

7. Your rights

Under the Privacy Act, you can:

• Ask what personal information we hold about you
• Ask us to correct information that's wrong or out of date
• Delete your information, yourself, from the Account tab in your dashboard (see section 6)
• Make a complaint if you think we've mishandled your information

To ask what we hold, correct something, or make a complaint, contact us through our contact page. If you're not satisfied with our response, you can complain to the OAIC at oaic.gov.au.

8. Using PaperCalm on someone else's behalf

PaperCalm is intended for use by NDIS participants, parents, and carers, managing NDIS matters for themselves or for someone else they support. If you add information about another person (for example, a child, a family member, or another participant you care for), you confirm you are their parent, guardian, carer, or otherwise authorised to provide that information on their behalf.

9. Third parties we use

We only share the minimum information each provider needs to perform its function.

10. Changes to this policy

We may update this policy from time to time, for example as the Service or the providers we use change. We'll update the "Last updated" date at the top, and if a change is significant, we'll let you know directly (e.g., by email).

11. Contact us

If you have any questions about this policy or your information, contact us through our contact page.

PaperCalm