Privacy Policy — DrivewayStay

DrivewayStay, operated by Jack O'Brien, ABN 72 317 847 421, trading as DrivewayStay (“we”, “us”, “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use the DrivewayStay platform, including our website and progressive web application (collectively, the “Platform”).

This Platform is operated in line with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). As a sole trader with an annual turnover currently below $3 million, we are not currently required by law to comply with the Privacy Act. However, we voluntarily adopt its principles because we believe your privacy matters and because we anticipate growth beyond this threshold.

Due to our identity verification requirements for bookings, we generally require identified accounts. You may browse public map features and listings without creating an account. However, making or accepting bookings, accessing community features, and using the chat system require a verified account.

By using the Platform, you consent to the practices described in this policy.

We collect personal information directly from you when you register, verify your identity, create a listing, make a booking, post content, or contact us; automatically when you use the Platform (such as technical and analytics information); and from our service providers where needed to deliver the Platform (for example, payment confirmations from Stripe).

• Account and identity information: Full name, email address, phone number, display name, profile photo, date of birth, and account role (guest or host).
• Identity verification information: Government-issued photo ID (driver's licence front and back), verification selfie, rego plate text and rego plate photo. These are collected to verify your identity before you can make or accept bookings.

We wish to draw your specific attention to the fact that driver's licence images and verification selfies may constitute sensitive information, including biometric information, under the Australian Privacy Act 1988. By submitting these documents through the Platform, you provide your explicit and specific consent to their collection, use, and storage solely for identity verification purposes as described in this policy. We do not use this information for any other purpose. At the point of verification collection within the app, a concise notice is provided explaining why we collect this information and linking to this policy.

• Vehicle information: Rego plate text and photo, vehicle fluid containment declaration, self-containment category, and travel style.
• Payment information: Payment card details are processed directly and solely by Stripe. We do not store, see, or have access to your full card details at any time. Host payout information including bank account details is managed exclusively through Stripe Connect and is governed by Stripe's privacy policy.
• Location information: Approximate suburb-level location used for listing placement on the map. GPS coordinates collected when you post Ranger Intel pins, Gatherings, or Notice Board posts, and when the Emergency SOS button is triggered. Your exact property address is never stored publicly — it is only revealed to a confirmed guest after the host manually chooses to share their location.
• Photos and listing content: Profile photos, listing and property photos, and listing descriptions you upload. GPS and EXIF metadata is automatically removed from all uploaded photos before storage.
• Community content: Ranger Intel pins, Gatherings, Notice Board posts, and reviews that you post on the Platform. Please be aware that this content, including any location data attached to pins or posts, is visible to other users of the Platform. You should not include personal information in community posts that you do not wish other users to see.
• Booking, transaction, and membership information: Booking dates, amounts, listing details, add-ons selected, booking status, cancellation records, payout history, and records of any paid membership or listing tier purchases.
• Merit and integrity information: Merit score, merit history, demerit reports, strike records, reviews given and received, and records we create to protect Platform integrity, such as fraud and safety flags (including checks of rego plate details against other accounts).
• Dispute information: Evidence and statements you submit through the in-app dispute system, including photos and descriptions.
• Communications: Messages sent through the in-app chat system between hosts and guests on active bookings, support emails sent to info@drivewaystay.com.au, and any other direct communications with DrivewayStay.
• Usage and analytics information: Pages visited, time spent on the Platform, approximate geographic location at country and region level, browser type, device type, and referral source — collected through Google Analytics 4 (Measurement ID: G-H49FSTZR4Y). This data does not personally identify you.
• Technical information: IP address, browser type, operating system, and cookies placed by Google Analytics.

We use your personal information to:

• Create and manage your account
• Process and manage bookings and payments through Stripe
• Verify your identity before allowing bookings
• Display your listing on the map at an approximate suburb-level location to protect your exact address
• Enable the host to review your profile, rego plate, and verified status before accepting a booking
• Operate the merit and strike system to maintain community standards
• Detect and prevent fraud and misuse, including checking vehicle rego details against other accounts and preventing suspended or banned users from re-registering
• Facilitate in-app chat between hosts and guests on active bookings
• Send transactional emails via Resend including booking confirmations, welcome emails, and checkout reminders
• Send SMS notifications via Twilio for Emergency SOS alerts to our admin team
• Operate the Emergency SOS system and notify admins of safety alerts including GPS location and booking details
• Enforce the cancellation policy and process refunds through Stripe
• Analyse Platform usage through Google Analytics to improve the Platform and understand user behaviour
• Comply with our legal obligations under Australian law
• Investigate and resolve disputes between users
• Enforce our Terms of Service and community standards

We will not use your personal information for any purpose not listed above without first obtaining your consent, except where required by law.

Direct marketing: We do not use your personal information for direct marketing purposes. You will not receive unsolicited marketing communications from DrivewayStay. Any emails we send are transactional in nature — booking confirmations, welcome emails, checkout reminders, and platform announcements directly related to your use of the Platform. If this changes in the future, we will update this policy and provide you with an opt-out mechanism before sending any marketing communications.

We do not sell your personal information to third parties. We do not share your personal information with advertisers.

We share your information only in the following circumstances:

• With hosts: When you make a booking as a guest, the host can see your display name, profile photo, rego plate, vehicle fluid containment status, merit score, travel style, and verified status. Your exact location is never shared until the host manually chooses to share their own location to confirm the booking.
• With guests: When a host accepts a booking and shares their location, the confirmed guest receives the host's property address. The host's personal contact details beyond what appears on their public listing are not shared.
• With service providers: We use the following third-party service providers who may receive or process your personal information as part of delivering the Platform. Each provider is required to handle your data in accordance with applicable privacy law:
  • Stripe (Stripe Inc.) — payment processing and host payout management via Stripe Connect. stripe.com/privacy
  • Supabase (Supabase Inc.) — database and file storage infrastructure for all user data, photos, and documents. Data may be stored on servers located outside Australia.
  • Resend (Resend Inc.) — transactional email delivery service
  • Twilio (Twilio Inc.) — SMS delivery for Emergency SOS alerts
  • Google LLC — usage analytics via Google Analytics 4. policies.google.com/privacy
  • Lovable — website hosting and deployment infrastructure for the Platform
  • OpenStreetMap / Nominatim — address search, geocoding, and map data. When you type an address into an address search field on the Platform, your search query is sent to this service to return address suggestions. Map data is provided by OpenStreetMap contributors.
• Artificial intelligence services: We do not currently send your personal information or your photos to any third-party artificial intelligence service. If we introduce optional features that do (such as the AI Sketchify cover photo feature described in our Terms of Service), we will name the provider in this policy and obtain your opt-in consent before any of your content is sent to that provider.
• Third-party links: The Platform may contain links to third-party websites and services, including the OAIC website, Stripe's privacy policy, and Google's privacy policy. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information to them.
• For legal reasons: We may disclose your information if required by law, court order, or government authority, or where we reasonably believe disclosure is necessary to protect the safety of any person, prevent fraud, or comply with a legal obligation.
• Business transfer: In the event DrivewayStay is sold, merged, or transferred to another entity, your personal information may be transferred as part of that transaction. We will notify you via email or in-app announcement before any such transfer occurs and you will have the option to delete your account if you do not consent.

Some of our third-party service providers, including Supabase, Stripe, Resend, Twilio, Google, and Lovable, are based outside Australia and may store or process your data on servers located overseas, including in the United States. You acknowledge that overseas recipients may not be subject to the Australian Privacy Act 1988, and that if an overseas recipient mishandles your information, you may not have remedies available under Australian law. By using the Platform, you expressly consent to your personal information being transferred to and processed in countries outside Australia on this basis. We take reasonable steps to ensure that overseas recipients handle your information in a manner consistent with the Australian Privacy Principles, including by relying on standard contractual protections where available.

We retain your personal information for as long as necessary to provide the Platform and comply with our legal obligations. Specific retention periods apply as follows:

• Verification selfies and driver licence images: Scheduled for deletion within 48 hours of upload. Where a booking is active or a dispute is open, relevant verification data is retained until 30 days after checkout or until the dispute is resolved, whichever is later. Only your verified status is retained after deletion.
• Vehicle and rego plate information: Retained for the life of your account, so that hosts can view your verified vehicle details and so that we can detect duplicate or fraudulent accounts. Where an account has been suspended or banned, rego plate details, together with the name, phone number, and email address associated with that account, are retained indefinitely to prevent suspended or banned users from re-registering and to protect the safety of other users. Where a vehicle has genuinely changed ownership since the ban, the new owner may contact us with proof of purchase (such as a transfer of registration or bill of sale) to have that vehicle's rego record reviewed and, where appropriate, cleared.
• GPS and EXIF metadata in uploaded photos: Automatically stripped from all photos before storage. Not retained at any point.
• Profile, listing, and property photos: Retained until you remove them or delete your listing or account.
• Chat messages: Retained for the duration of the booking plus 90 days after checkout, then deleted unless flagged for a dispute or legal matter.
• Dispute evidence: Retained until the dispute is resolved and for 12 months afterwards for legal purposes.
• Merit history: Retained for the life of the account and for 12 months after account deletion to protect the integrity of the Platform, detect fraud, and maintain safety records. Merit data is anonymised after account deletion so it cannot be linked back to a specific individual.
• Legal acknowledgements (Terms acceptance records): Retained indefinitely for legal compliance purposes.
• Booking, payment, and membership records: Retained for 7 years for tax and legal compliance purposes in accordance with ATO requirements.
• Account data: Retained until account deletion, after which personal identifiers are removed within 30 days, subject to applicable legal retention requirements and to the retention of suspended or banned account details described above.
• Google Analytics data: Retained according to Google's data retention settings, currently configured for 14 months.
• Encrypted infrastructure backups: Our database and storage provider retains encrypted backups for up to 7 days for disaster-recovery purposes. Data that has been deleted from the live Platform (including identity documents purged under the schedule above) may still exist inside these encrypted backups until they roll off, after which it is permanently removed. Backups are not accessed for any purpose other than restoring the Platform after an incident.

DrivewayStay uses Google Analytics 4 to collect anonymous usage data about how visitors interact with the Platform. Google Analytics places cookies on your device to collect this information. The data collected includes pages visited, time spent on the Platform, approximate geographic location at country and region level, browser and device type, and referral source.

This data is used solely to improve the Platform and understand user behaviour. It does not personally identify you and is not linked to your DrivewayStay account.

You can opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout or by adjusting your browser's cookie settings to block third-party cookies. By continuing to use the Platform, you consent to the use of Google Analytics as described in this section.

Essential device storage: The Platform also stores small amounts of data on your device that are necessary for it to work properly. This includes your login session, your chosen theme and experience mode, your text size and accessibility settings, your language preference, and one-time flags such as whether you have already seen our welcome and mission messages. This storage is essential to the operation of the Platform, does not track you across other websites, and is not shared with third parties.

Beyond Google Analytics and the essential device storage described above, we do not use any other cookies, tracking pixels, or third-party advertising technologies on the Platform. As Australian privacy law evolves, we may implement a cookie consent mechanism to provide you with more granular control over tracking technologies. Any such changes will be reflected in an updated version of this policy.

We take reasonable steps to protect your personal information from unauthorised access, disclosure, alteration, or destruction. Security measures include:

• Encrypted data transmission (HTTPS/TLS)
• Role-based access controls limiting access to personal data
• Row-level security policies on our database preventing unauthorised data access
• Sensitive database fields accessible only through controlled server-side functions
• Automatic removal of GPS and EXIF metadata from all uploaded photos before storage
• Scheduled deletion of sensitive identity documents as described in Section 6

No method of transmission over the internet is completely secure. While we implement these measures, we cannot guarantee absolute security.

We comply with the Notifiable Data Breaches scheme under the Privacy Act 1988. If we suspect that a data breach may have occurred, we will assess it promptly and in any event within 30 days. If a data breach is likely to result in serious harm to any individual, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, including a description of the breach, the information involved, and recommendations about the steps you should take in response.

Under the Australian Privacy Act 1988 and the Australian Privacy Principles, you have the following rights:

• Access: Request access to the personal information we hold about you by contacting info@drivewaystay.com.au. We will respond within 30 days at no charge.
• Correction: Request correction of personal information that is inaccurate, incomplete, or out of date.
• Deletion: Request deletion of your account and associated personal data through the in-app settings or by contacting us. Note that some data may be retained for legal compliance purposes as described in Section 6.
• Opt out of analytics: Opt out of Google Analytics tracking as described in Section 7.
• Withdraw consent: Where we rely on your consent to process personal information, including your explicit consent to the collection of sensitive identity verification information, you may withdraw that consent at any time by contacting info@drivewaystay.com.au. Withdrawal of consent may mean we are unable to provide certain services, including booking functionality.
• Direct marketing opt-out: As stated in Section 3, we do not currently send direct marketing communications. If this changes, you will have the right to opt out at any time.
• Complain: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992 if you believe your privacy rights have been breached. We encourage you to contact us first so we can attempt to resolve your concern directly.

To protect your information, we may need to verify your identity before actioning an access, correction, or deletion request. If we refuse an access or correction request, we will give you written reasons for the refusal and information about how you can complain about that decision.

The Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has created an account, we will immediately terminate the account and delete associated personal data within 30 days. If you believe a person under 18 has provided us with personal information, please contact us at info@drivewaystay.com.au and we will investigate and delete it.

We may update this Privacy Policy at any time, including changes to how we collect, use, store, or share your personal information. Where changes are material, we will provide at least 14 days notice via email or in-app announcement before the changes take effect. For non-material changes including minor clarifications or administrative updates, the updated policy takes effect immediately upon posting at drivewaystay.com.au/privacy.

Continued use of the Platform after any changes constitutes acceptance of the updated Privacy Policy. If you do not agree to an updated policy, you must stop using the Platform and may delete your account through the in-app settings.

For privacy-related questions, requests, access requests, correction requests, or complaints, contact us at:

Jack O'Brien, ABN 72 317 847 421, trading as DrivewayStay

info@drivewaystay.com.au

drivewaystay.com.au/privacy

We will acknowledge privacy complaints promptly and aim to resolve them within 30 days.

If you are not satisfied with our response to a privacy complaint, you have the right to contact the Office of the Australian Information Commissioner (OAIC):

Website: oaic.gov.au

Phone: 1300 363 992

Jack O'Brien, ABN 72 317 847 421, trading as DrivewayStay

drivewaystay.com.au

DrivewayStay is built to be usable by as many people as possible, and we're continuing to improve it over time.

What's built in today:

• Adjustable text size, including a larger "Super" size option, so the app is easier to read for people with low vision or anyone who prefers bigger text
• A choice of theme and experience mode, so you can set the app up in a way that's comfortable for you
• A saved language preference

Our approach:

• We don't claim to meet every accessibility standard yet — we're a small, actively-developing platform, and accessibility is an ongoing commitment, not a one-off checkbox. If something on DrivewayStay is hard to use because of a disability, impairment, or any other access need, we genuinely want to hear about it.

Get in touch:

• If you run into an accessibility barrier anywhere on the platform, email us at info@drivewaystay.com.au and let us know what happened and what device/browser you were using. We'll look into it.

This is a plain-English summary. Section 7 of the Privacy Policy (Cookies, Analytics, and Device Storage) covers the technical detail of what's stored on your device and why.