Privacy policy

Last updated 27 October 2026. What OutreachPortal collects, why, who sees it and how to have it removed.

1. Who this is about

OutreachPortal is made by BotBuilders Robotics (“we”, “us”). This policy covers the website at outreachportal.app, the app on app.outreachportal.app and on organisations’ own addresses, our API, and the connector for AI assistants.

There are two roles. For your account (your sign-in and billing details) we decide how information is used. For an organisation’s record (its members, activities, hours, notes and files) the organisation decides what goes in and who sees it, and we hold and process it on its behalf. If you are in a team, questions about what your team has recorded about you are best asked of your team’s admins first.

2. What we collect

• Account: your email address, a salted hash of your password (never the password), your permission level, and the preferences you set. If you turn on two-step sign-in, the secrets for your authenticator app and the public keys of your passkeys (encrypted at rest) and hashes of your recovery codes.
• Your organisation’s record: what the organisation enters. That is typically members’ names and roles, teams, outreach activities with dates, hours, places, people reached and notes, goals and risks, and uploaded files such as photos, letters and documents. Members may be students. We ask organisations to enter only what they need and have permission to record.
• Billing: your plan, subscription status and a Stripe customer reference. Card details go straight to Stripe and never touch our servers.
• Technical information: a session cookie when you are signed in; your IP address, which we use to limit repeated sign-in attempts and note when an API key was last used; your browser’s push-notification address and browser type if you turn on desktop notifications; and ordinary server logs.
• Locations: the places an organisation types for its activities and teams are looked up to put them on the map (see section 5).

We do not run advertising, we do not sell personal information, and the app and this website use no analytics or tracking scripts.

3. How we use it

• To provide the service: sign you in, keep the record, show it to the people the organisation has given access to, and send the emails and notifications the portal needs to (invitations, password resets, sign-in codes, and the reminders you ask for).
• To take payment and keep plans in step with Stripe.
• To keep the service secure and working: preventing abuse, fixing faults, and keeping each organisation’s record separate from every other’s.
• To answer you when you write to us.

We do not read an organisation’s record except where needed to support it at its request, to keep the service secure, or where the law requires.

4. AI assistants

If a person connects an AI assistant such as Claude, the assistant can read what that person is allowed to read and, if they may edit, can log or change activities for review. Information the assistant reads is sent to the assistant’s provider (for example Anthropic for Claude), and is then handled under that provider’s terms and privacy policy, which you accepted when you chose it. We do not send an organisation’s record to any assistant on our own. A connection ends when it is disconnected, or when the account is deleted or its password changes. See the connector documentation.

5. Who else handles it

We use these providers to run the service, and share only what each needs:

• DigitalOcean hosts the app, its database and uploaded files.
• Cloudflare serves this website and our DNS, and sends the portal’s email.
• Stripe processes payments and holds card details.
• LocationIQ turns the place names an organisation types into map positions, and suggests places as you type.
• FIRST is asked for public details of a team (its name, avatar, events and awards) when someone looks up a team number.
• OpenFreeMap and OpenStreetMap supply the map’s tiles to your browser when you open the map.
• Browser push services run by Google, Apple, Mozilla and Microsoft deliver desktop notifications if you turn them on. We send only a short, generic line.

Some of these providers are outside Australia, so information may be processed overseas. We may also disclose information where the law requires it, or to protect people’s safety.

Some features create links that anyone holding them can open, by design: a pit display’s link, a calendar subscription link and an upload link. Treat those like passwords and replace them from the portal if one gets out.

6. How long we keep it

We keep an organisation’s record for as long as the organisation has an account, so that it can show a multi-year history. Removing an item removes it from the service; copies in our backups are overwritten on a rolling schedule. Billing records are kept as long as tax and accounting law requires. Sign-in throttling records and logs are short-lived.

A person’s account can be removed by their organisation’s admins. To have an entire organisation, or your own information, deleted, email support@outreachportal.app from the account’s address and we will act within 30 days.

7. Security

Connections use HTTPS. Passwords are stored as hashes, two-step secrets are encrypted, every request is checked against the signed-in person’s organisation and permission level, and payment details never reach us. No system is perfectly secure; if we learn that personal information has been exposed in a way that is likely to cause harm, we will tell the people affected and the regulator as the law requires. To report a weakness, see our security policy.

8. Cookies

The app sets one cookie, a sign-in session, because the service cannot work without it. It is not used to track you across sites. This website remembers in your browser (local storage) whether you were signed in last time, so it can show the right buttons, and nothing else.

9. Your choices and rights

You can ask to see, correct or delete the personal information we hold about you, and object to how it is used. In the portal you can change your details, turn off notifications, end connected assistants and turn two-step sign-in on or off. For anything else, email support@outreachportal.app. We may need to confirm who you are first. We follow Australia’s Privacy Act 1988 and the Australian Privacy Principles, and respect equivalent rights where you live. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Young people

Robotics teams include students. Accounts are created by invitation from an organisation’s admins, who are responsible for having permission to record information about the young people in the record, and we do not knowingly allow children to open an organisation on their own. If you think we hold information about a child that should not be there, tell us and we will remove it.

11. Changes and contact

If we change this policy in a way that matters, we will say so in the portal or by email, and the date above will change. Questions: BotBuilders Robotics · support@outreachportal.app