Waitlist Privacy Policy

Last updated: 23 April 2026 | Version: 1.0

1. What this policy covers

This policy describes how ThimbleCare handles personal information collected through the ThimbleCare waitlist website. It covers the sign-up form on that site and the emails we send as a result of your registration. Nothing more. When ThimbleCare launches as a product, a separate and much more detailed privacy policy will apply to the product. That policy will address health information, NDIS records, and all the information ThimbleCare collects from workers and participants. This policy does not cover any of that.

2. Who we are

The ThimbleCare waitlist is operated by Joshua William Coleman trading as ThimbleCare, ABN 97 507 616 423.

Address: 45 Melaleuca Crescent, Tascott, NSW, 2250

Privacy contact: hello@thimblecare.com

ThimbleCare is an independent business-admin tool for NDIS sole-trader support workers. Not affiliated with or endorsed by the NDIS, NDIA, or NDIS Quality and Safeguards Commission. ThimbleCare does not provide tax, legal, or regulatory advice; does not submit claims or incident reports on your behalf; does not facilitate payments between workers and participants.

3. What we collect

Information you give us directly when you submit the form:

• Email address (required)
• Name (optional, first name or full name)
• Role selection: either "A support worker" or "A participant / family" (optional)
• Closed-beta opt-in (optional checkbox)

Technical information collected automatically:

• IP address (used by Vercel for abuse prevention, rate limiting, and edge routing; see section 6)
• Page view data collected by Vercel Analytics: the URL visited, referrer URL, browser type, operating system, and device category (desktop or mobile). This data is aggregated and anonymised. Vercel Analytics does not store your IP address.
• Timestamp of form submission

We do not collect health information, sensitive information, government identifiers, or financial details of any kind. The waitlist site is not the ThimbleCare product and has no access to any information the product will handle.

4. How we collect it

We collect your information directly from you when you submit the waitlist form. We do not purchase data, scrape data, or receive your personal information from any third party. Vercel Analytics data (described above) is generated automatically when you visit the site.

5. Why we use it

We use your information for these purposes only:

(a) To confirm your sign-up and add your email address to the waitlist.

(b) To send you occasional updates about ThimbleCare's progress toward launch.

(c) To notify you when ThimbleCare opens for trials or public access.

(d) If you ticked the closed-beta option: to consider your expression of interest and, if selected, to invite you to participate in the pre-launch closed beta.

We do not use your information for targeted advertising, and we do not disclose it to advertisers. We do not sell, rent, or trade your email address or any other information you give us.

6. Who we share it with

We share your information only with the service providers listed below, which we need to operate the waitlist and send emails.

Hosting and analytics Vercel Inc., United States. Vercel hosts the waitlist website and provides Vercel Analytics. Form submission data and page view data are processed on Vercel's infrastructure, which operates globally including nodes outside Australia. Vercel Analytics collects aggregated, anonymised page view data only; it does not store personal identifiers or your IP address. Vercel's full privacy information is at vercel.com/legal/privacy-policy. By submitting the form, you consent to your data being processed by Vercel in the United States in accordance with APP 8 of the Privacy Act 1988 (Cth).

Email sending Resend, Inc., United States. We use Resend to send your confirmation email and subsequent waitlist updates. Your email address is transferred to Resend for this purpose. Resend's privacy information is at resend.com/legal/privacy-policy. By submitting the form, you consent to your email address being transferred to Resend in the United States in accordance with APP 8 of the Privacy Act 1988 (Cth).

We have written agreements with both providers above that require them to protect your information and use it only for the purposes we specify.

We do not share your information with anyone else.

7. How long we keep it

We keep your waitlist record until one of the following:

• You ask us to remove it. We will do so within 5 business days.
• ThimbleCare formally launches and you convert to a product account, at which point the product Privacy Policy takes over.
• ThimbleCare formally launches and you do not convert to a product account. We will remove your waitlist record at that point.
• Your record has been on the waitlist for more than 24 months without any activity. We purge inactive records at that threshold.

8. Security

Information you submit is transmitted to us over an encrypted connection (TLS). We take reasonable steps to protect the small amount of information the waitlist holds against misuse, interference, loss, and unauthorised access, modification, or disclosure. The waitlist collects only an email address and a small number of optional fields. We treat this information with care, and we would notify you promptly if a breach affecting your information were to occur.

9. Your rights under the Privacy Act

Under the Privacy Act 1988 (Cth), you have the right to:

• Access the personal information we hold about you.
• Correct your information if it is inaccurate or out of date.
• Request deletion of your waitlist record (see section 7 for how deletion works).
• Withdraw consent and leave the waitlist at any time.

To exercise any of these rights, email hello@thimblecare.com. We aim to respond within 5 business days and will always respond within 30 days.

If you are not satisfied with our response, or if we fail to respond within 30 days, you may complain to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

10. Cookies and analytics

The waitlist site does not use cookies for analytics or tracking purposes. Vercel Analytics, which we use to understand site traffic, works without cookies and does not store personal identifiers. The only cookies the site may set are those strictly necessary for the sign-up form to function (for example, a session token to prevent duplicate submissions).

Vercel Analytics collects aggregated, anonymised data: pages visited, referrer, browser type, operating system, device category (desktop or mobile), and approximate country. It does not record your IP address or any personal identifier. You can review Vercel's approach to privacy at vercel.com/legal/privacy-policy.

11. Children

The waitlist is for adults aged 18 or older. If you become aware that someone under 18 has submitted their details through the form, please contact us at the email address in section 13 and we will delete that record promptly.

12. Changes

We may update this policy from time to time. If we make a material change, we will notify everyone on the waitlist by email before the change takes effect.

13. Contact

For any privacy queries or to exercise your rights:

Email: hello@thimblecare.com

Post: 45 Melaleuca Crescent, Tascott, NSW, 2250 (written contact is preferred by the OAIC for formal privacy complaints)