THE HUG← Back to site

HUG

Privacy Policy

Effective July 1 2026 · Version 1.0

The Hug App Pty Ltd (ACN 690 031 102 / ABN 26 690 031 102) (we, us or our) is committed to protecting your privacy and handling Personal Information (including Children’s Information) in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, hold, use, disclose, and protect Personal Information when you access or use our website at thehugapp.com.au, our HUG mobile application, and any related services (together, the Platform). HUG is a family support and carpool matching platform designed for use by Eligible Adults to coordinate child caring requests, shared school and activity transport, and other family support arrangements. Because the Platform is used to coordinate arrangements that may involve Children, this Privacy Policy contains additional provisions about the handling of Children’s Information.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent to collect or use Personal Information, you may withdraw that consent at any time by contacting us using the details in clause 17.

OPERATIVE PROVISIONS

1. ABOUT THIS PRIVACY POLICY

  1. This Privacy Policy applies to all Personal Information (including Children’s Information) we collect about you and about Children through the Platform, whether collected directly from you or from third party sources.

  2. This Privacy Policy should be read together with our Website Terms of Use, Mobile App Terms of Use, Acceptable Use Policy, Website Disclaimer, and Cookie Policy.

  3. We may update this Privacy Policy from time to time. Any changes will be posted on the Platform with an updated effective date. Where the changes are material (including changes affecting the handling of Children’s Information), we will use reasonable endeavours to notify you before the changes take effect.

2. DEFINITIONS AND INTERPRETATION

Definitions

In this Privacy Policy, the following definitions apply:

Account means a user account created and held by an Eligible Adult to access and use the Platform.
APPs means the Australian Privacy Principles set out in Schedule 1 to the Privacy Act.
Care Request means a request submitted through the Platform for child caring, family support, or related services to be provided by another Eligible Adult.
Carpool Match means a connection or pairing between Eligible Adults facilitated through the carpool matching feature of the Platform.
Child means a person under the age of 18 in respect of whom an Eligible Adult uses the Platform to coordinate care, transport, or family support.
Children’s Information means Personal Information about a Child that is provided to us, or otherwise collected by us, in connection with the Platform.
Data Breach means any unauthorised access to, or unauthorised disclosure or loss of, Personal Information (including Children’s Information) that we hold.
Eligible Adult means a person who is at least 18 years of age and who is the parent, guardian, or other adult lawfully responsible for a Child to whom Children’s Information relates.
Notifiable Data Breach has the meaning given to "eligible data breach" in Part IIIC of the Privacy Act.
OAIC means the Office of the Australian Information Commissioner.
Personal Information has the meaning given in section 6 of the Privacy Act, being information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.
Platform means the HUG website at thehugapp.com.au, the HUG mobile application, and any related services operated by us.
Privacy Act means the Privacy Act 1988 (Cth) and any regulations or subordinate instruments made under it, as amended from time to time.
Privacy Policy means this Privacy Policy, as amended from time to time.
Sensitive Information has the meaning given in section 6 of the Privacy Act, and includes (among other things) information about a person’s health, racial or ethnic origin, religious beliefs, and biometric information.
WWCC means a current and valid working with children check, working with vulnerable people check, or equivalent clearance issued by a State or Territory authority.

Interpretation

In this Privacy Policy, unless the context otherwise requires:

  1. headings are for convenience only and do not affect interpretation;

  2. the singular includes the plural and vice versa;

  3. a reference to a person includes a corporation, partnership, joint venture, association, government body, or other entity;

  4. a reference to a statute, regulation, or other law includes all amendments, consolidations, and replacements;

  5. a reference to writing includes email; and

  6. where a word or expression is given a particular meaning, other parts of speech and grammatical forms of that word or expression have a corresponding meaning.

3. WHO WE COLLECT INFORMATION ABOUT

  1. We collect Personal Information about:

    1. Eligible Adults who register for an Account, submit or respond to Care Requests, offer or accept Carpool Matches, or otherwise use the Platform;

    2. Children, where information about a Child has been submitted to us by an Eligible Adult in connection with a Care Request, a Carpool Match, or the management of an Account; and

    3. other adults whose contact details, role, or relationship to a Child or family have been provided to us by an Eligible Adult (for example, emergency contacts and alternative pick-up adults).

  2. The Platform is designed for use by Eligible Adults. The Platform is not intended to be used by, and we do not knowingly create Accounts for, anyone under 18. A Child does not directly create an Account, log in, or transact through the Platform. Where we collect Children’s Information, we collect it from the relevant Eligible Adult, not from the Child.

  3. By submitting information about a Child to the Platform, you represent and warrant that you are an Eligible Adult in respect of that Child, that you have authority to submit that information on the Child’s behalf, and that you consent to the handling of that information in accordance with this Privacy Policy. Where another adult (such as another parent or guardian) shares parental responsibility for a Child, you must comply with any legal or shared parental responsibility obligations that apply between you and that other adult in relation to the submission of information.

4. INFORMATION WE COLLECT

  1. The types of Personal Information we collect about you, and the types of Children’s Information we collect, depend on how you use the Platform. We collect and hold the following categories of information.

  2. Information about Eligible Adults includes:

    1. account registration information, including your full legal name, email address, mobile telephone number, residential or service address, date of birth, and authentication credentials;

    2. identity verification information, including any government-issued identification you provide, any WWCC details you provide, and the outcome of any verification check we (or a third party identity verification provider engaged by us) conduct;

    3. payment and billing information, processed through our third party Payment Processor;

    4. profile information, including any profile photograph, biographical details, preferred locations, and availability;

    5. communications you send to other users through the Platform or to us, including support requests, in-app messages, and feedback; and

    6. any other information you voluntarily provide to us through the Platform.

  3. Children’s Information that we collect (from the Eligible Adult, not from the Child) may include:

    1. the Child’s first name (or first name and initial) and, where reasonably necessary for the arrangement, surname;

    2. the Child’s date of birth or age;

    3. the Child’s residential address or other pick-up or drop-off addresses (for example, school, after-school care, or extra-curricular activity addresses);

    4. information necessary for the safe care or transport of the Child, including known medical conditions, allergies, dietary requirements, special needs, and emergency contacts (some of which may be Sensitive Information);

    5. photographs of the Child, where uploaded by an Eligible Adult to assist with identification at handover; and

    6. information about Care Requests, Carpool Matches, and other arrangements involving the Child.

  4. We will collect only the minimum amount of Children’s Information that is reasonably necessary for the relevant arrangement, and we encourage Eligible Adults to do the same. You should not submit more information about a Child than is reasonably necessary.

  5. Information we collect automatically includes:

    1. device and browser information, including IP address, device type, operating system, browser type, and unique device or advertising identifiers;

    2. usage data, including pages and features accessed, time spent on the Platform, Care Requests and Carpool Matches submitted or accepted, referring URLs, search terms, and clickstream data; and

    3. approximate location data derived from your IP address or, where you have provided consent through the in-app permissions, precise location data from your device (for example, to support pick-up and drop-off coordination).

  6. Information we receive from third parties may include information from identity verification providers, payment processors, mapping providers, social login providers (where you choose to sign in through a third party account), and (where you authorise us to do so) WWCC verification providers.

5. SENSITIVE INFORMATION AND CHILDREN’S HEALTH INFORMATION

  1. We do not generally seek to collect Sensitive Information. However, where you submit information that is reasonably necessary for the safe care or transport of a Child (for example, information about the Child’s medical conditions, allergies, or special needs), that information may constitute Sensitive Information about the Child.

  2. By submitting that information through the Platform, you consent (on behalf of the Child, in your capacity as an Eligible Adult) to our collection and handling of that Sensitive Information for the purpose of facilitating the relevant arrangement and otherwise as described in this Privacy Policy. You should not submit Sensitive Information beyond what is reasonably necessary for the arrangement.

6. HOW WE COLLECT INFORMATION

  1. We collect Personal Information and Children’s Information:

    1. directly from you, when you register for an Account, build a profile, submit information about a Child, submit or respond to a Care Request, offer or accept a Carpool Match, make a payment, contact us, or otherwise provide information to us;

    2. automatically, through cookies, analytics tools, and similar technologies when you access or interact with the Platform; and

    3. from third parties, as described in clause 4 above.

  2. Where it is reasonable and practicable to do so, we will collect information directly from you. We will not collect Personal Information by unlawful or unfair means.

  3. If we receive Personal Information about you or a Child that we did not solicit, we will deal with that information in accordance with APP 4, including by destroying or de-identifying the information where it is lawful and reasonable to do so.

  4. At or before the time we collect Personal Information from you, or as soon as practicable after, we will take reasonable steps to notify you of the matters set out in APP 5 (including the purposes of collection, the consequences of not providing the information, the kinds of recipients to whom we usually disclose information, and how you can access and correct the information).

7. HOW WE USE INFORMATION

  1. We use Personal Information and Children’s Information for the primary purposes for which it was collected. These include:

    1. providing, operating, maintaining, and improving the Platform and the services made available through it;

    2. creating and managing Accounts, processing Care Requests, facilitating Carpool Matches, and processing payments and Service Fees;

    3. verifying the identity of Eligible Adults (including by reference to government-issued identification, WWCC details, and other verification checks), administering Accounts, and confirming eligibility for the Platform;

    4. coordinating the safe care and transport of Children, including by displaying relevant Children’s Information to the responding Eligible Adult to the extent reasonably necessary to perform the arrangement;

    5. communicating with you, including sending service-related notices, in-app and email notifications about arrangements, responding to enquiries, and providing customer and child safety support;

    6. sending you marketing or promotional communications where you have consented or where we are otherwise permitted to do so by law (subject to clause 8);

    7. conducting analytics, research, and product development to understand and improve the Platform and child safety features;

    8. detecting, preventing, and responding to fraud, security incidents, breaches of our Acceptable Use Policy, child safety risks, and breaches of our other terms; and

    9. complying with our legal obligations (including mandatory reporting and notifiable data breach obligations), enforcing our terms, and protecting our rights and the rights of others (including Children).

  2. We may also use Personal Information for secondary purposes that are related to a primary purpose, where you would reasonably expect us to do so, or where we have your consent. In the case of Children’s Information, secondary uses will be limited to purposes that are necessary or directly related to the safe and effective operation of the Platform in respect of arrangements involving the relevant Child.

  3. We will not use Personal Information or Children’s Information for a purpose materially different from the purpose for which it was collected, unless we have obtained your consent or are otherwise permitted or required by law.

8. DIRECT MARKETING

  1. We may use the Personal Information of Eligible Adults (including your name and contact details) to send you direct marketing communications about our products, services, promotions, competitions, or events where you have consented or where we are otherwise permitted to do so under the Privacy Act and the Spam Act 2003 (Cth).

  2. We do not send direct marketing communications to Children, do not knowingly use Children’s Information to target advertising to a Child, and do not knowingly enable third party advertising networks to do so.

  3. You may opt out of receiving direct marketing communications from us at any time by:

    1. using the unsubscribe link included in each marketing email;

    2. updating your communication preferences in your Account settings; or

    3. contacting us using the details in clause 17.

  4. If you opt out of direct marketing communications, we will continue to send you service-related communications that are necessary for us to provide the Platform and the services made available through it (including notifications about Care Requests, Carpool Matches, payments, and child safety matters).

9. DISCLOSURE OF INFORMATION

  1. We may disclose Personal Information and Children’s Information to the following categories of recipients for the purposes described in clause 7:

    1. Other Eligible Adults using the Platform: to the extent reasonably necessary to facilitate Care Requests, Carpool Matches, and related arrangements (for example, a Driver may see the first name and age of a Child being transported, and any relevant medical or allergy information you have chosen to share);

    2. Service providers: third party providers who perform services on our behalf, including hosting and cloud infrastructure providers, the Payment Processor, identity and WWCC verification providers, mapping providers, customer support tools, email and SMS delivery providers, content moderation services, and analytics providers;

    3. Group entities: other entities within our group of companies, where necessary to provide and support the Platform;

    4. Professional advisors: our lawyers, accountants, auditors, and insurers, where necessary for the provision of their services;

    5. Law enforcement and authorities: government authorities, law enforcement agencies, child protection authorities, WWCC authorities, the eSafety Commissioner, courts, tribunals, or regulators, where required or authorised by law, where reasonably necessary to address a child safety concern or suspected unlawful conduct, or to protect our legal rights and the rights of others (including Children); and

    6. Business transfers: a potential buyer, transferee, investor, or merger partner in the event of a sale, merger, restructure, or other transfer of all or part of our business or assets (subject to the recipient providing equivalent privacy protections in respect of Children’s Information).

  2. Before disclosing Personal Information or Children’s Information to a service provider or other third party, we take reasonable steps to ensure that the third party is contractually obliged to handle the information in accordance with the APPs and this Privacy Policy, and only uses the information for the specified purposes.

  3. We do not sell Personal Information or Children’s Information.

10. OVERSEAS DISCLOSURE

  1. We are based in Australia. Some of our service providers (including cloud infrastructure and payment processors) are located outside Australia, including in the United States, the European Union, and other jurisdictions. Where we disclose Personal Information or Children’s Information to an overseas recipient, we will take reasonable steps in the circumstances to ensure that the recipient does not breach the APPs in relation to the information, consistent with our obligations under APP 8.

  2. By using the Platform, you consent (on your own behalf and, where you submit Children’s Information, on behalf of the relevant Child as an Eligible Adult) to the disclosure of Personal Information and Children’s Information to overseas recipients for the purposes described in this Privacy Policy.

11. DATA RETENTION

  1. We retain Personal Information and Children’s Information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements, or to resolve disputes and enforce our agreements.

  2. Children’s Information will generally be retained only for so long as the relevant arrangement, Care Request, or Carpool Match is active, and for a further reasonable period to address any after-arrangement enquiries, disputes, or child safety matters. We will then take reasonable steps to destroy or de-identify Children’s Information in accordance with APP 11.2, unless we are required or permitted by law to retain it.

  3. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the information (with particular care given to Children’s Information and Sensitive Information), the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the information, whether we can achieve those purposes through other means, and applicable legal requirements.

  4. When information is no longer required, we will take reasonable steps to destroy or de-identify it in accordance with our information handling procedures. Where de-identification is used, the de-identified information may be retained for analytical and research purposes (including to improve the Platform and its child safety features).

  5. We may retain Personal Information (including Children’s Information) for longer than we would otherwise need to where you have consented to the extended retention, or where we are required or permitted to do so by law, including to respond to disputes, complaints, child safety investigations, mandatory reporting obligations, or legal proceedings.

12. DATA SECURITY

  1. We take reasonable steps to protect Personal Information and Children’s Information from misuse, interference, loss, and unauthorised access, modification, or disclosure, as required by APP 11.1. These steps include:

    1. encryption of Personal Information and Children’s Information in transit and, where appropriate, at rest;

    2. access controls that limit access to Personal Information and Children’s Information to authorised personnel on a need-to-know basis, with enhanced controls applying to Children’s Information and Sensitive Information;

    3. regular security assessments and testing of our systems and processes;

    4. staff training on privacy, data handling, and child safety obligations; and

    5. incident response procedures for investigating and responding to actual or suspected Data Breaches.

  2. While we take reasonable steps to protect Personal Information and Children’s Information, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of Personal Information or Children’s Information.

  3. Breach notification. In the event of a Notifiable Data Breach affecting Personal Information or Children’s Information, we will notify the OAIC and the affected individuals (or, where the information relates to a Child, the relevant Eligible Adult) in accordance with Part IIIC of the Privacy Act (the Notifiable Data Breaches scheme). Where the breach affects Children’s Information, we will prioritise prompt notification of the relevant Eligible Adult and will provide tailored guidance about the steps the Eligible Adult can take to protect the Child.

13. ACCESS AND CORRECTION

  1. Under APP 12 and APP 13, you have the right to:

    1. Access: request access to Personal Information we hold about you;

    2. Correction: request correction of any Personal Information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading;

    3. Access to Children’s Information as an Eligible Adult: where you are the Eligible Adult who submitted Children’s Information about a Child, request access to and correction of that Children’s Information; and

    4. Complaint: make a complaint to us or to the OAIC if you believe we have breached the APPs or mishandled Personal Information or Children’s Information.

  2. To make an access or correction request, please contact us using the details in clause 17. We may require you to verify your identity and (where the request relates to Children’s Information) your status as an Eligible Adult before actioning your request.

  3. We will respond to your request within a reasonable period and, in any event, within 30 days of receiving the request. We will not charge you for making a request, but we may charge a reasonable fee for providing access if the request requires substantial effort. We will explain the basis of any charge before responding.

  4. There are circumstances in which we may decline an access or correction request, for example where giving access would have an unreasonable impact on the privacy of other individuals (including another parent or guardian of the Child), where the request involves Children’s Information and we have a reasonable concern that complying with the request would pose a risk to the safety or wellbeing of the Child, or where we are required or authorised by law to refuse access. If we decline a request, we will explain our reasons in writing and let you know how to complain.

14. COOKIES AND TRACKING TECHNOLOGIES

  1. We use cookies and similar tracking technologies on the Platform. For detailed information about the cookies we use, the purposes for which we use them, and how you can manage your cookie preferences, please refer to our Cookie Policy, available at thehugapp.com.au/legal/cookies. We do not knowingly use targeting or advertising cookies to deliver advertising to Children.

15. THIRD PARTY LINKS

  1. The Platform may contain links to third party websites, services, or applications that are not operated or controlled by us (including payment processors, mapping providers, identity verification providers, and government child safety resources). This Privacy Policy does not apply to those third party services, and we are not responsible for their privacy practices.

  2. We encourage you to review the privacy policies of any third party service before providing your Personal Information or any Children’s Information to them.

16. CHILDREN USING THE PLATFORM

  1. The Platform is designed for use by Eligible Adults and is not intended to be used by, or to provide an account to, anyone under 18. Accounts are not made available to Children, and Children do not log in or transact through the Platform.

  2. If we become aware that an account has been created or used by a person under 18, or that Personal Information has been collected directly from a Child rather than from an Eligible Adult, we will take reasonable steps to suspend or close the relevant account and to delete the affected information as soon as practicable. If you believe that an account is being used by a Child, or that information has been collected directly from a Child, please contact us immediately using the details in clause 17.

17. CONTACT US AND COMPLAINTS

  1. If you have any questions about this Privacy Policy, wish to exercise your rights, or wish to make a complaint about how we handle Personal Information or Children’s Information, please contact our Privacy Officer at wegotyou@thehugapp.com.au or by writing to The Hug App Pty Ltd, Attn: Privacy Officer, Level 10, 369 Royal Parade, Parkville VIC 3052.

  2. We will aim to resolve your complaint within 30 days of receipt. If we need more time, we will let you know the reason for the delay and the expected timeframe for resolution. Complaints relating to child safety or the handling of Children’s Information will be prioritised.

  3. If you are not satisfied with our response, or if you consider that we have not handled your complaint appropriately, you may refer your complaint to the Office of the Australian Information Commissioner:

    1. Website: www.oaic.gov.au;

    2. Phone: 1300 363 992; and

    3. Post: GPO Box 5218, Sydney NSW 2001.

18. CHANGES TO THIS PRIVACY POLICY

  1. We reserve the right to amend this Privacy Policy at any time. Any changes will be effective when we post the revised Privacy Policy on the Platform with an updated effective date.

  2. Where the changes are material (including changes that affect the handling of Children’s Information), we will use reasonable endeavours to notify you by email (where we have your email address) or by posting a prominent notice on the Platform before the changes take effect.