Last updated: 31 August 2026
This Privacy Policy explains how NepCanora (“we”, “us”, or “our”) collects, uses, discloses, and manages your personal information in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).
NepCanora is an online platform connecting members of the Nepali community in Canberra, ACT, with Nepali-run businesses and service providers. The Platform includes a business directory, a community events board, business offers and promotions, and an AI-powered chat assistant. We are committed to handling your personal information in an open and transparent manner.
For any privacy-related questions or concerns, contact us at: nepcanoraofficial@gmail.com
This policy applies to all personal information we collect through the NepCanora platform, website, and associated services.
We may collect the following personal information:
This data is stored in our own database and is not linked to third-party advertising systems or used for targeted advertising.
This information is collected from publicly accessible sources (such as other business directories, Google Maps, social media pages, or business websites) to help build the NepCanora directory. Such listings are marked as “unclaimed.” Business owners can claim, correct, or request removal of their listing at any time.
We collect only the personal information that is reasonably necessary for the purposes described in this policy. Where information is optional, we will make this clear.
We collect personal information:
If we receive personal information about you that we did not solicit and that we could not have collected lawfully (unsolicited information), we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so (APP 4).
We collect personal information for the following primary purposes:
We will notify you at or before the time of collection of the purposes for which we collect your information.
We will only use or disclose your personal information for the primary purpose for which it was collected, or for a directly related secondary purpose, unless you consent to another use or disclosure, or an exception under the Privacy Act applies.
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
Approved business listings (name, suburb, phone, email, website, photos, hours, social links, services, and review data) are publicly visible on the Platform as part of the directory service. By submitting a business listing, you consent to this public display.
Approved community events (title, description, date, time, venue, suburb, pricing, and cover image) are publicly visible on the Platform. By submitting an event, you consent to this public display.
Approved business offers (title, description, expiry date, and image) are publicly visible on the Platform. By publishing an offer, the business owner consents to this public display.
We only send transactional emails related to your account or listing (e.g., email verification, listing approval or rejection). We do not send promotional or marketing emails without your explicit opt-in consent.
Every email we send includes an unsubscribe mechanism. You may also opt out by contacting us at nepcanoraofficial@gmail.com. We comply with the Spam Act 2003 (Cth).
Our service providers — Supabase, Vercel, Resend, and OpenAI — may process and store data on servers located outside Australia (including in the United States). By using the Platform, you acknowledge and consent to this overseas processing.
In particular, when you use NepCanora AI, your conversation messages are transmitted to OpenAI, Inc., which is based in the United States.
We take reasonable steps to ensure that overseas recipients handle your personal information in a manner consistent with the Australian Privacy Principles, including by relying on contractual protections and the privacy frameworks of those providers.
We do not collect Tax File Numbers, Medicare numbers, or other government-issued identifiers. The Australian Business Number (ABN) is an optional field on business listings. ABNs are publicly available information registered with the Australian Business Register and are not treated as sensitive identifiers.
We take reasonable steps to ensure your personal information is accurate, up-to-date, complete, and relevant. You can update your account information by contacting us or through your account settings.
We take reasonable technical and organisational measures to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure, including:
In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme (Part IIIC of the Privacy Act 1988 (Cth)).
You have the right to request access to the personal information we hold about you. To make a request, contact us at nepcanoraofficial@gmail.com. We will respond within 30 days. We may need to verify your identity before providing access.
We may decline access in limited circumstances permitted by the Privacy Act (for example, where providing access would pose a serious threat to the life or safety of another individual, or where access would be unlawful). If we decline, we will give you written reasons.
Self-service account deletion: You may delete your account at any time via the Profile page on the Platform. Business owners must first remove their business listing (via the Owner Dashboard) before deleting their account. Upon deletion, your account data, profile information, and reviews you have written are permanently removed. Some anonymised or aggregated data may be retained where required by law.
You have the right to request correction of personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading. You can update most information directly through your account. For other corrections, contact us at nepcanoraofficial@gmail.com. We will respond within 30 days.
We use session cookies to maintain your login session, managed by Supabase Authentication. These are strictly necessary cookies required for the Platform to function. You cannot opt out of these without losing the ability to log in.
We collect first-party page view and listing view events, which are stored directly in our own database (Supabase). This is separate from any server-level metrics collected by Vercel. We use this data to understand which pages and listings are most visited and to improve the Platform. This data is not shared with any advertising network and is not used for targeted advertising or profiling.
We do not use third-party advertising cookies, tracking pixels, or analytics services such as Google Analytics. Vercel (our hosting provider) may collect anonymous, aggregated infrastructure metrics (e.g., request counts) that cannot be used to identify you individually.
You can control cookies through your browser settings, but disabling cookies may prevent you from logging in or using key features of the Platform.
This section explains in detail how personal information is handled when you use NepCanora AI, our AI-powered chat assistant.
When you type a message into NepCanora AI, the text of your message is transmitted to OpenAI, Inc. (based in the United States), along with system context describing NepCanora's purpose and the current date. This allows OpenAI to generate a relevant response.
We do not send to OpenAI: your name, email address, user ID, account profile, review history, or any other account identifiers. Only the content of your typed message is transmitted.
OpenAI's API does not use conversation data to train its models by default. For full details of how OpenAI handles data received via its API, please review OpenAI's privacy policy at openai.com/privacy.
To enforce fair usage limits, we store your IP address and a daily query count in our own Supabase database. This record:
NepCanora AI is entirely optional. If you do not use it, no conversation data is transmitted to OpenAI and no rate-limiting record is created for your IP address.
If you choose to use NepCanora AI, you cannot opt out of the IP rate-limiting data being recorded, as it is technically required to enforce the fair usage policy and protect the service from abuse.
AI-generated responses are produced automatically and may be inaccurate, incomplete, or outdated. NepCanora does not warrant the accuracy of any AI-generated content. Nothing generated by NepCanora AI constitutes professional advice of any kind. Always verify important information independently and consult qualified professionals where appropriate.
The Platform is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at nepcanoraofficial@gmail.com and we will take steps to delete that information promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. We will notify you of material changes by email or in-app notice where reasonably practicable. The updated policy will be posted on this page with a revised “Last updated” date. Continued use of the Platform after any changes constitutes your acceptance of the revised policy.
If you have a concern or complaint about how we have handled your personal information, please contact us first at nepcanoraofficial@gmail.com. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
