Privacy Policy

1. Introduction

Welcome to SupplyRobot. In this Privacy Policy, "we", "us", and "our" refer to SupplyRobot (ABN 47 355 838 689), a sole trader based in South Australia, Australia. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

SupplyRobot is a business service used by transport companies (our "customers") to manage their fleets, drivers, and deliveries. Our customers decide which staff and drivers they add to SupplyRobot and what records they keep in it, and we handle that information to provide the service to them. If you are a driver or staff member of one of our customers, your employer is usually the first point of contact for questions about your records, and we will help them respond.

2. Information We Collect

Account holders

When a company registers, we collect the name, email address, and company details of the person setting up the account and of any team members they invite. We also hold the operational information our customers enter, such as deliveries, sites, vehicles, and maintenance records.

Billing

Subscriptions are paid through Stripe. Card details are entered on Stripe-hosted pages and processed by Stripe; we do not receive or store full card numbers. We keep a record of each customer's subscription plan and billing status.

Driver records

Our customers may enter driver details such as name, contact details, date of birth, address, emergency contact, and driver licence number, class, state, and expiry. Drivers using the driver app also create records of their work, including rosters, clock-in and clock-out times, work and rest hours used for fatigue management, messages with dispatchers, fault and incident reports, and delivery records.

Photos and signatures

Drivers and staff may upload photos and signatures, such as proof-of-delivery photos, recipient signatures, and photos of vehicle faults or incidents.

Driver location and trip journeys

If a driver enables location tracking and acknowledges the in-app notice, the driver PWA may collect precise device location at most once every five seconds during an actual commenced shift. Collection stops when the shift ends or tracking is turned off. The latest position is used for current operational visibility; during an active route run, accepted samples may also form a trip journey for dispatch history, safety, incident review, and service support. Browser or device suspension can create gaps, which SupplyRobot does not infer or reconstruct.

Live-position documents carry a 24-hour safety expiry and are normally overwritten or deleted earlier. Trip journey segments are retained for up to 90 days and are deleted earlier when an approved driver erasure request applies. Location may be available to authorised members of the driver's company and to service providers that host or display the SupplyRobot service, including Firebase and the configured map provider. SupplyRobot does not sell driver location data.

Technical information

When you use SupplyRobot, our hosting provider records technical information such as your IP address, browser type, and the pages requested, for security and troubleshooting. We also keep crash reports and a security log of significant account actions, such as changes to users, subscriptions, and data deletions.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our services.
• Help our customers meet their fatigue-management, record-keeping, and chain-of-responsibility obligations.
• Process your transactions and manage your subscription.
• Improve, personalize, and expand our services.
• Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the website, and for marketing and promotional purposes.
• Send you emails.
• Find and prevent fraud.

4. Who We Share Information With

We do not sell personal information. Information in a customer's account is available to that customer's authorised users. We use the following service providers to run SupplyRobot, and each receives only the information it needs to provide its service:

• Google Cloud and Firebase for hosting, database, sign-in, and file storage. This covers all information held in SupplyRobot.
• Stripe for subscription billing. This covers billing contact details and subscription status.
• Resend for sending emails such as invitations and notifications. This covers the recipient's email address and the email content.
• Google Maps Platform for maps, address lookup, and travel-time estimates. This covers site addresses and location coordinates.

We may also disclose information where the law requires it, such as to a regulator or under a court order, or where it is needed to protect someone's safety.

5. Information Stored or Accessed Outside Australia

Our main database and uploaded files are stored in Google Cloud's Sydney region. Some processing happens overseas: the servers that run the SupplyRobot application are located in the United States, Stripe and Resend process data in the United States, and Google Maps Platform may process location data in any country where Google operates. We use providers that hold independent security certifications, such as SOC 2 Type II, and we take reasonable steps to ensure they handle personal information consistently with the APPs.

6. How Long We Keep Information

• Live driver location: only the latest position is kept. It is deleted when tracking stops, with a 24-hour automatic expiry as a backstop.
• Trip journeys, driver activity events, and crash reports: 90 days.
• Messages between drivers and dispatchers, and in-app notifications: 12 months.
• Rosters, work-diary, and fatigue records: at least three years, because heavy vehicle laws require these records to be kept.
• Deliveries, proof-of-delivery photos, signatures, and fault and incident reports: kept in the customer's account until the customer deletes them.
• Security logs: at least 400 days.
• Database backups: 7 days, so deleted information can remain in a backup for up to 7 days.

Automatic deletion can take up to three days after these periods end. If a customer closes its account, it can contact us to arrange a copy or deletion of its data. Records that the law requires to be kept may be retained for the required period.

7. Accessing, Correcting, and Deleting Your Information

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it by emailing info@supplyrobot.com.au. We will need to confirm your identity first. We aim to respond within 30 days, and there is no charge for making a request. If we refuse a request, we will tell you why and how you can complain.

Much of the information in a customer's account is controlled by that customer, so drivers and staff can also ask their employer, who can correct most records directly in SupplyRobot.

When a driver leaves, their employer can request that the driver's personal data be erased. This deletes the driver's login, live location, trip journeys, messages, and driver profile. Rosters, work-diary and fatigue records, delivery records, proof-of-delivery photos and signatures, and fault and incident reports are kept, because they are business records the employer may need to meet its legal obligations, including heavy vehicle fatigue and chain-of-responsibility laws. Driver activity events are still deleted automatically after 90 days.

8. Security of Your Information

Each customer's data is kept separate and is accessible only to that customer's authorised users. Our hosting providers encrypt data in transit and at rest.

We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse.

9. Data Breaches

If we become aware of a data breach that may cause serious harm, we will assess it promptly, and within 30 days at most. Where required, we will notify the affected people and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

10. Cookies and Browser Storage

SupplyRobot does not use advertising cookies, analytics cookies, or third-party tracking.

We use your browser's storage only for things the service needs to work: keeping you signed in, remembering your display theme, and, in the driver app, remembering your location-tracking and screen-awake settings and that you have seen the location notice. If you clear this storage, you will be signed out and these settings will reset.

When a page shows a Google map, Google may set its own cookies. These are covered by Google's Privacy Policy.

11. Complaints

If you have a concern about how we have handled your personal information, please contact us first at info@supplyrobot.com.au. We aim to respond within 30 days. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.

12. Changes to This Policy

We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will let account owners know by email or in the app.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at info@supplyrobot.com.au.