Effective 14 September 2026
Privacy Policy
Change note (v2.1, 3 September 2026): every reference to emotion, mood or emotional response has been removed. The computer-vision system does not estimate emotion; the legal wording now describes only what the system actually does (face detection, age-range and gender buckets, dwell and gaze time, aggregate impression counts). No other change.
Change note (v3.0, 13 September 2026): this version corrects the identity of the vendor that performs driver facial verification (AWS Rekognition, in Sydney — not RapidID, which verifies documents only); adds recipients that were processing Personal Information but were not listed (Deepgram, Sentry, Google Maps Platform, Cloudflare, the Australian Taxation Office) and removes two that no longer do (TinyMDM, OpenAI); describes the per-advertisement record the Player Tablet actually transmits; adds a section on automated decision-making; and restates the retention table against what our systems enforce today — where a stated retention target is not yet enforced by an automated job, the table says so.
Change note (v3.1, 14 September 2026): the correction note in clause 2.2 no longer says RapidID checks vehicle registration against the national vehicle register. RapidID verifies identity documents only. Vehicle registration is recorded from your declaration and checked by our team against the WA Department of Transport's public register; it is not sent to RapidID. No other change.
04 — Privacy Policy
Effective Date: 14 September 2026 Joint controllers: OZ Ride Pty Ltd (ABN 52 694 735 487) and OOHAi Media Pty Ltd as trustee for the OOHAi Media Unit Trust. Governing law: Western Australia, Australia. Defined terms: Capitalised terms not defined in this document have the meaning given in 00 — Definitions.
This Privacy Policy describes how OZ Ride and OOHAi Media (together referred to as "we" in this document, with the responsible entity identified per data flow where relevant) collect, hold, use, disclose, and protect Personal Information in connection with the Platform.
This Privacy Policy is written to comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APP) set out in Schedule 1 to that Act, the Spam Act 2003 (Cth), and the privacy and surveillance-devices legislation of Western Australia. It applies to Personal Information collected on or after the Effective Date.
1. Who we are and how to contact us
1.1 OZ Ride is the controller of Personal Information collected and used in connection with the Rideshare Service, the Taxi Service, the Driver App, the Rider App, the Phone Booking Service, and Driver-side payment flows.
1.2 OOHAi Media is the controller of Personal Information collected and used in connection with the Advertising Service, the Advertiser Portal, advertiser billing, and Audience Data.
1.3 Joint controllership. Where a single data flow is processed by both entities (notably, the Player Tablet operating in a Driver's Vehicle), the entities act as joint controllers and have apportioned responsibility according to function as set out in this Policy.
1.4 Privacy contacts.
- OZ Ride privacy:
privacy@oz-ride.com - OOHAi Media privacy:
privacy@oohai.com.au - General support:
support@oz-ride.com(rideshare/taxi);advertisers@oohai.com.au(advertising)
You may also write to OZ Ride at 224 Balcatta Road, Balcatta, Western Australia 6021, Australia.
2. The Personal Information we collect
2.1 From Riders
We collect Personal Information from Riders for the purpose of enabling Riders to request and complete Trips, to make and receive payments, to make use of Safety Features, and to receive support.
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Account | Name, mobile number, email, date of birth (where required for age verification), preferred language | You | Account creation, authentication, communication |
| Identifiers | Apple/Google account identifier where used for sign-in | Sign-in provider | Authentication |
| Payment | Payment method type, last 4 digits, expiry, billing postcode | You via Stripe Elements | Payment processing |
| Location | Pickup location, drop-off location, location updates while a Trip is open or being requested | Your device location services | Trip dispatch, navigation, fare calculation, Safety Features |
| Trip | Trip history, ratings given and received, comments, fare components | Platform | Service, support, abuse detection, ratings |
| Communications | SMS one-time-passwords; push notification delivery records; phone-call recordings and transcripts where you call the Phone Booking Service | Twilio, Deepgram, AWS SES, FCM, OZ Ride | Authentication, support, training, quality |
| Safety | Trusted contact details (name, mobile, optional relationship), trip-share recipients, SOS event records, route-deviation alert history | You; Platform telemetry | Safety Features |
| Device | Device model, OS version, app version, push token, IP address, crash and error diagnostics | App at use | Service, debugging, fraud prevention |
| Support | Support tickets, chat transcripts, attachments | You | Support |
2.2 From Drivers
We collect Personal Information from Drivers for the purpose of onboarding, Compliance Status maintenance, dispatch, payment, and support.
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Account | Name, mobile, email, date of birth, address | You | Identity, payments, communication |
| Identity documents | Driver's licence number and image, passport or ID image, photograph of you | You; RapidID | Identity verification, fraud prevention |
| Biometric verification | A live selfie (captured as a short burst of frames) compared against your licence photograph to confirm you are the person on file; a liveness check on the selfie (checks for open eyes, no sunglasses, image sharpness); an estimated age range from the same check | You; AWS Rekognition (image comparison and liveness) | Identity verification at onboarding and at periodic re-verification. See the Biometric / Facial Verification Notice for the full description of this processing, what is stored, and for how long |
| Authorisations | PTD number and status; PTV details; ODBS membership; National Police Certificate currency; insurance policy number, insurer, expiry; ABN and GST-registration status | You; WA Department of Transport (PTD/PTV/DVID); ABR (ABN) | Compliance Status; regulator obligations |
| Vehicle | Make, model, year, registration, photographs, fitness | You | Compliance, dispatch, brand standards |
| Payment | Stripe Express account identifier; bank account details (held by Stripe); tax-residency declarations | Stripe; you | Payouts, GST handling |
| Location | Real-time and aggregated location updates while online | Your device | Dispatch, fare calculation, safety |
| Trip | Trip history, ratings, cancellations, acceptance | Platform | Dispatch, ratings, support |
| Communications | SMS, push, in-app messages, phone-call recordings | Same as Riders | Same |
| Safety | SOS use, tamper events, complaints | Platform | Safety, trust |
| Device | Driver device model, OS, app version, push token, IP, BLE pairing identifier | App | Service, debugging |
| Education | Driver education quiz results, induction module completions, induction content version accepted, secondary-employment (other driving work) declaration | App; the driver induction training register (clause 6) | Compliance, training |
Correction (v3.0): the previous version of this Policy said the biometric match performed at onboarding produced a "biometric template generated by RapidID." That was incorrect. RapidID performs document verification (checking your identity document against the government Document Verification Service). Vehicle registration is recorded from your declaration and checked by our team against the WA Department of Transport's public register; it is not sent to RapidID. The one-to-one biometric face match — comparing your live selfie against your licence photo — is performed by AWS Rekognition, run in AWS's Sydney (
ap-southeast-2) region. RapidID never sees or scores your face. This is corrected throughout this Policy and is the subject of the dedicated Biometric / Facial Verification Notice.
2.3 From Advertisers and Advertiser Users
We collect Personal Information from Advertiser Users for the purpose of authenticating their access to the Advertiser Portal and enabling them to manage their Tenant.
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Account | Name, work email, role, mobile (optional) | You | Authentication, communication |
| Tenant | Business name, ABN, billing address, finance contact, agency designation | You | Onboarding, billing, contracting |
| Payment | Stripe Customer identifier; payment method last 4; billing postcode | Stripe | Billing |
| Activity | Login records, Audit Log entries for content approvals, campaign edits, billing actions | Platform | Audit, security, dispute resolution |
| Communications | Email; in-portal messages; support tickets | You; Platform | Support, account communication |
| Device | Browser, OS, IP, session identifier | Browser | Authentication, security |
2.4 From Player Tablet audience measurement
The Player Tablet runs an on-device computer-vision system that detects faces in the field of view and classifies them into non-identifying demographic buckets (age range, gender), and records dwell and gaze time. This system runs entirely on the Tablet using on-device machine-learning models. Raw video frames are processed only on the Tablet and are overwritten in device memory immediately after inference. No image, video, or biometric template of any person is ever transmitted off the Tablet.
What is transmitted off-device, for each advertisement played, is a scene-level record: the Tablet's precise location and the time of the play, together with non-identifying aggregate estimates of who was in view at that moment (an estimated number of viewers, and the group's age-bucket and gender-bucket distribution, attention and dwell metrics). These records are held by OOHAi Media for advertising-effectiveness measurement and billing. They are not linked to any Rider or Driver account, and no facial image, video, or biometric identifier is included in them. Advertisers themselves only ever receive further-aggregated, de-identified reports that never include precise location or device identifiers (see clause 9.1 of the Computer Vision Privacy Disclosure).
The full technical description of this pipeline — what happens on the device, what leaves the device, why we do not treat this as identifying any specific individual, and your choices (including how to opt out as a passenger) — is set out in the Computer Vision Privacy Disclosure, which forms part of this Policy by reference.
2.5 From Website visitors
When you visit the Website, we collect:
- Server-log data (IP address, user agent, requested URL, timestamp) for security and operational purposes;
- Aggregated analytics (pages viewed, time on page, source) using a privacy-respecting analytics tool;
- Cookies as described in the Cookie Policy.
We do not use re-identifying analytics tools that connect your visit to other identities you may have on the open web.
2.6 From third parties
We may receive Personal Information about you from:
- The WA Department of Transport (PTD, PTV, DVID feed);
- The Document Verification Service (DVS) operated by the Australian Government (driver identity confirmations);
- RapidID (document-verification results — RapidID does not generate or hold a biometric template or biometric match score; see clause 2.2);
- AWS Rekognition, via our own systems (biometric one-to-one face-match results and liveness-check results — see the Biometric / Facial Verification Notice);
- Stripe (payment, payout, dispute, chargeback events);
- Twilio (call status, SMS delivery status);
- Deepgram (real-time transcription of Phone Booking Service calls);
- Apple, Google, Facebook (sign-in identifiers when you choose to sign in with those services);
- Australian Business Register (ABN status for Drivers and Advertisers);
- Trusted contacts you nominate (passively, by their phone responding to a confirmation prompt we send).
2.7 Location data — what we access and when
We treat Location as a sensitive category and limit our collection of it. The exact operating-system permissions we request, and the conditions under which Location is collected, differ between the Rider App and the Driver App, and between Android and iOS.
2.7.1 Rider App
| Platform | Permissions requested | When Location is collected |
|---|---|---|
| Android | ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION | Foreground only. Location is collected while the Rider App is in the foreground, in order to display your pickup point, set the pickup, show nearby Drivers, and render the live route during an active Trip. The Rider App on Android does not request background Location and stops Location collection as soon as you background the App or end the Trip. Trip Share live-ETA updates on Android occur only while the App is in the foreground. |
| iOS | NSLocationWhenInUseUsageDescription for foreground use; NSLocationAlwaysAndWhenInUseUsageDescription only while a Trip Share is active with one or more Trusted Contacts | Foreground use as above. Background use on iOS is limited to active Trip Share sessions, so a Trusted Contact's live ETA stays current while the Rider App is backgrounded. Background collection ends automatically when the Trip ends or the Trip Share is revoked. |
2.7.2 Driver App
| Platform | Permissions requested | When Location is collected |
|---|---|---|
| Android | ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, ACCESS_BACKGROUND_LOCATION, FOREGROUND_SERVICE_LOCATION (used together with a foregroundServiceType="location" foreground service) | While you are signed in and online to receive Trip requests, or while you are on an active Trip. Background Location is required so the Platform can match you to nearby Riders and so dispatch can complete when the Driver App is not in the foreground. While Location is being collected, a persistent system notification is shown by the foreground service so the collection is visible to you. Going offline ends the foreground service and stops Location collection. |
| iOS | NSLocationWhenInUseUsageDescription for foreground use; NSLocationAlwaysAndWhenInUseUsageDescription for background use while online or on an active Trip | Same triggers as Android. Going offline stops background Location collection. |
2.7.3 What we do, and do not, do with Location
We use Location strictly for the operational purposes set out in clause 5 of this Policy: Trip dispatch, navigation, fare and meter calculation, ETA rendering for Riders and their Trusted Contacts, route-deviation Safety Features, and fraud detection. We do not use Location for advertising, for building behavioural profiles outside the Platform, or for sale to third parties.
2.7.4 Retention specific to Location
Granular Location pings recorded during a Trip form part of the Trip Record and are retained for the period set out in clause 8 ("Trip records — 7 years from Trip date"). Location pings recorded while a Driver is online but not on an active Trip are retained for the same operational period under clause 8.
2.7.5 Permissions you can revoke at any time
You can revoke any Location permission via your device's system settings. Revoking foreground Location for the Driver App will prevent you from going online; revoking background Location for the Driver App will limit you to foreground-only operation, which is unlikely to be workable for sustained dispatch. Revoking foreground Location for the Rider App will prevent the App from showing your pickup point and nearby Drivers; the App will let you key in a pickup address manually as a fallback.
3. Sensitive Information
We do not generally seek Sensitive Information about you. Where we do collect it, we collect it only for the purpose stated at the point of collection:
- Biometric information — the one-to-one facial-verification match described in clause 2.2, performed by AWS Rekognition during Driver onboarding and periodic re-verification. This has its own dedicated notice and consent capture: see the Biometric / Facial Verification Notice. The record of each verification attempt, including the vendor's raw response, is currently retained without a defined deletion window; a retention window and an automated purge for these records are on our engineering list (not yet enforced automatically), and this clause will state the window once that work is live.
- Health information you may volunteer in a support ticket (for example, describing a medical condition relevant to a complaint) — used only to handle that ticket.
4. How we collect Personal Information
We collect Personal Information:
- Directly from you, when you create an account, complete onboarding, take a Trip, contact support, or call the Phone Booking Service;
- Automatically, from your device or browser, when you use the Apps or the Website;
- From third parties, as described in clause 2.6 above; and
- From the operation of the Platform (Trip records, ratings, chat content, audit-log events).
Where we collect Personal Information directly from you, we do so with your awareness, including by telling you the purposes at the time of collection. Where we collect indirectly, we do so only where the collection is reasonably necessary for the relevant purpose and is permitted by APP 3.
5. Why we use Personal Information
We use Personal Information for the following purposes:
| Purpose | What we use | Lawful basis |
|---|---|---|
| Provide the Platform (account, dispatch, navigation, fare, payment, ratings, support, Safety Features) | Account, payment, location, trip, communications | Performance of the contract with you under the Driver Service Agreement, Rider Terms of Service, or Advertiser Terms of Service; APP 6 |
| Verify identity and Compliance Status | Identity, biometric verification, authorisations | Necessary for the operation of a regulated passenger-transport service; explicit consent for biometric and DVS verification; APP 3, APP 6 |
| Process payments and payouts | Payment, account, transaction history | Performance of the contract; APP 6 |
| Detect, investigate, and prevent fraud, abuse, and safety risks | Trip, location, communications, audit log, device | Legitimate operational interest; safety; APP 6 |
| Maintain Audit Logs of administrative actions | Activity, account | Audit and accountability; APP 6 |
| Train and quality-control human and AI support agents | Support transcripts, call recordings (with disclosure at start of call) | With notice and to perform support contract; APP 6 |
| Send operational messages | Mobile, email, push token | Performance of the contract; APP 6 |
| Send marketing messages | Account, with marketing consent | With your consent (APP 7); Spam Act 2003 |
| Comply with regulatory obligations | Compliance Status, identity, Trip records | Legal obligation under WA passenger-transport law; APP 6 |
| Improve the Platform | Aggregated Trip and event data; technical telemetry | Legitimate operational interest; APP 6 |
5A. Automated decision-making
Some decisions that affect you are made, or substantially assisted, by computer programs using your Personal Information rather than being made by a person case-by-case. We describe the main ones here so you understand what data feeds them and what decisions they produce. This section will be maintained ahead of the Automated decision-making transparency amendments to APP 1, which take effect from 10 December 2026.
| System | Data used | Decision produced | Human involvement |
|---|---|---|---|
| Trip matching | Driver and Rider location, Driver availability, vehicle category | Which Driver is offered a Trip request | Automated; Drivers and Riders may decline/cancel within the applicable terms |
| Fare calculation | Trip distance/time, location, applicable pricing schedule or (for taxi) the WA Department of Transport's regulated fare schedule | The Fare charged for a Trip | Automated calculation; disputes go to a human via the Complaints Handling process |
| Fraud and anti-abuse gates (for example, the taxi end-of-trip distance check) | Trip and device location, Trip state | Whether a Trip action (such as ending a taxi Trip) is permitted automatically or requires manual verification | Automated gate; a blocked action can be escalated to a human via support |
| Driver deactivation / suspension triggers | Compliance Status, conduct reports, safety events, fraud-detection signals | Whether a Driver's account is flagged for review, or placed under an interim suspension | Automated flagging, and in some cases an automated interim suspension; the decision to end a Driver's access is made by a person, and Drivers have a right to respond — see the Suspension & Deactivation Policy |
| Fatigue-limit enforcement | Driver online/driving hours | Whether a Driver is temporarily blocked from going online for exceeding a driving-hours limit | Automated; the rule and the limits are fixed and published in advance |
We are building a complete inventory of automated-decision systems ahead of the December 2026 deadline; if that work identifies additional systems reasonably expected to significantly affect your rights or interests, we will add them here.
6. Disclosure to third parties
We disclose Personal Information to the following categories of third parties for the purposes shown:
| Recipient | Information | Purpose | Location |
|---|---|---|---|
| Stripe Payments Australia Pty Ltd | Payment, payout, customer identifier, transaction | Payment processing, payouts, billing, dispute handling | Australia / United States |
| Twilio Inc | Mobile number, message content, call audio | SMS, voice, OTP delivery; call recording | United States (SOC 2 attested) |
| Deepgram Inc | Call audio (real-time stream) | Speech-to-text transcription supporting the Phone Operator AI Agent | United States |
| ElevenLabs Inc | Text strings to be voiced | Voice synthesis for the Phone Operator AI Agent | United States |
| Anthropic PBC | Conversation transcripts and tool calls during AI interactions; Creative media submitted for content-suitability assessment | Claude large-language-model inference for the Phone Operator AI Agent, other AI agents, and advertising content-suitability review | United States |
| Amazon Web Services Inc | Substantially all data described above (storage, compute); driver selfie/licence images (transient, for the biometric match); Website server logs | Hosting, database (RDS), object storage (S3), transactional email (SES), biometric face-match and liveness check (Rekognition), log monitoring (CloudWatch), hosting and edge delivery of the Website at web.oz-ride.com (Amplify) | Sydney (ap-southeast-2) for the core platform, database, primary storage, and biometric matching. The agent@oz-ride.com support mailbox (AWS WorkMail) and automated system-health alert emails run in the United States (us-east-1) and may hold rider/driver support correspondence sent to that address |
| Cloudflare Inc | Driver identity-document files (stored as ciphertext only — each file is individually encrypted before upload, and image metadata such as GPS/EXIF data is stripped beforehand); advertising creative media files; app-update packages | Object storage (R2); hosting of the driver induction training register (Workers and D1 — see the next row) | Cloudflare's global network — identity-document files are encrypted before upload, so Cloudflare holds ciphertext only; the induction register holds the fields listed in the next row in clear |
| Driver induction training register | On each induction completion: your driver identifier; your PTD authorisation number; the induction content version you acknowledged; your answer to the secondary-employment (other driving work) question; and your fatigue status at that moment (hours online in the preceding 24 hours, whether you are currently blocked from going online, and until when) | Holding the authoritative record of Driver induction completions for compliance and audit — OZ Ride's onboarding delivers the induction, and a completion is only recognised once this separate register has accepted it | A separate system operated on OZ Ride's behalf, hosted on Cloudflare Workers (Cloudflare's global network) |
| Sentry (Functional Software, Inc.) | Crash reports, stack traces, device model, OS/app version, IP address as captured by Sentry, in-app diagnostic breadcrumbs | Application error and crash monitoring across the Rider App, Driver App, Player Tablet software, and Companion app | United States |
| Google LLC (Google Maps Platform) | Pickup, drop-off, and route coordinates; address search text | Address autocomplete, geocoding, directions/ETA, map tile rendering | United States |
| Mapbox Inc | Pickup, drop-off, route coordinates | Directions/ETA (secondary provider), map tiles | United States |
| WA Department of Transport | Driver name, identity, PTD; vehicle, PTV; identity verification request | Authorisation lookups, DVID continuous monitoring, DVS lookups, PTSS submissions | Western Australia |
| RapidID | Identity-document images, photographs | Document identity verification (RapidID does not perform the biometric face match — see clause 2.2) | Australia |
| Australian Business Register (ABR) | ABN | ABN status verification for Drivers and Advertisers | Australia |
| Australian Taxation Office (ATO) | Driver identity, ABN, and Trip payment totals | Reporting under the Sharing Economy Reporting Regime (see clause 13.5 of the Payment Terms); remittance of no-ABN withholding | Australia |
| Apple Inc, Google LLC, Meta Platforms Inc | Account identifier where you choose to sign in with these providers | Authentication | United States |
| Insurer of OZ Ride | Limited Trip and incident data, on a need-to-know basis | Insurance claims handling | Australia |
| Auditor and professional advisers | Limited business records as required for audit, tax, or legal advice | Statutory and professional obligations | Australia |
| Successor entity | All categories of data on assignment under clause 20 of the relevant agreement | Business continuity | As applicable |
Removed in v3.0: TinyMDM (Cibox / GROUP HOLDING SAS) — this vendor was decommissioned as our Player Tablet device-management provider on 2026-06-13 and replaced with a first-party management system; it no longer receives any data. OpenAI L.L.C. — we do not operate any outbound integration that sends your Personal Information to OpenAI; a legacy inbound, public-data-only integration exists for a third-party ChatGPT "Custom GPT" listing but it does not receive or transmit Personal Information, so it is not listed here.
7. Cross-border disclosure (APP 8)
Several of the recipients listed in clause 6 are located outside Australia, principally in the United States. Where we disclose Personal Information to a recipient outside Australia, we take reasonable steps to ensure that the recipient handles the Personal Information in a way that is consistent with the Australian Privacy Principles, including by entering into contractual data-protection terms (for example, Stripe, Twilio, and Anthropic standard data-processing agreements). Where a recipient operates a globally distributed service (for example, Cloudflare's storage network), the Personal Information we place with it is encrypted before it leaves our systems.
You consent to the cross-border disclosures described in clause 6 by accepting this Privacy Policy and the relevant agreement applicable to your use of the Platform.
8. Data minimisation and retention
We retain Personal Information for the minimum period necessary for the purpose for which it was collected, subject to legal and audit requirements. The table below states our actual retention practice as at the Effective Date. Where our stated target differs from what our systems currently enforce, we say so — marked "not yet enforced automatically" — rather than describe a protection that is not yet built.
| Category | Retention |
|---|---|
| Account record after a deletion request | 30 days from your deletion request (a grace period during which you may reverse the deletion by reactivating your account), then erasure, except as required for legal/audit retention below |
| Trip records | 7 years from Trip date (consistent with WA passenger-transport recordkeeping and ATO recordkeeping) |
| Driver identity-document images (once verified) | Target: deleted 7 days after successful verification (not yet enforced automatically — the deletion job exists but has not been switched on, so images are currently retained until it is). The fact that verification occurred, and the compliance/audit record of it, is retained for the duration of the Driver's account plus 7 years after termination (see next row) — only the image itself is scheduled for deletion at 7 days |
| Identity-verification records (document-verification results, compliance/audit metadata) | Duration of Driver account + 7 years after termination |
| Biometric verification records (selfie-match attempts, including the vendor's raw response data) | No defined retention window is currently enforced — records are kept without an automated purge (not yet enforced automatically). See clause 3 and the Biometric / Facial Verification Notice |
| Payment records (Stripe) | Per Stripe's payment-processing retention policies and 7 years for our financial records |
| Driver compliance records (PTD, PTV, ODBS, NPC, insurance certificates) | Duration of Driver account + 7 years after termination |
| Phone-call recordings and call transcripts | Target: 12 months from the call, unless extended for an open dispute or investigation. Current practice: no automated deletion mechanism exists yet for Twilio-held recordings or platform-held transcripts — they are retained without an automated purge until that mechanism is switched on (not yet enforced automatically) |
| In-app messages between Riders and Drivers | Target: moved to an archive 90 days after being sent, with the originals deleted at that point, and the archive purged 12 months after the message was sent (not yet enforced automatically — the archiving job exists but has not been switched on and no archive purge has been built, so messages are currently retained until they are) |
| SOS event records | 7 years from event |
| Trip-share links | A share link you create in the Rider App expires 24 hours after it is created, or when you revoke it, whichever happens first. Target: expiry as soon as the Trip is marked complete (not yet enforced automatically). A share link created for you by the Phone Booking Service does not currently expire on a timer (automatic expiry not yet enforced); contact support to have it ended |
| Audit Logs | 7 years from event |
| DVS Consent Logs | 7 years from consent or revocation |
| Audience Data (Advertising Service) — fully aggregated campaign analytics | Retained indefinitely (contains no location, timestamp, or individual-level detail) |
| Audience Data (Advertising Service) — per-ad-play scene-level event records (see clause 2.4) | Target: 25 months for billing reconciliation, then further aggregation. Current practice: no automated purge is in place for these records (not yet enforced automatically) |
| Marketing-list membership | Until you opt out; opt-out evidence retained 12 months |
| Server logs / web analytics | Target: 90 days (not yet confirmed as enforced automatically) |
Deletion of records subject to a litigation hold, regulator request, or open investigation is paused until the matter is resolved.
9. Your rights
9.1 Access (APP 12)
You may request access to the Personal Information we hold about you. We will respond within 30 days. Where access cannot be granted in full (for example, because giving access would unreasonably impact the privacy of another person, or because the information is privileged or subject to legal hold), we will explain the reason and offer an alternative where possible.
9.2 Correction (APP 13)
You may ask us to correct Personal Information that is inaccurate, out of date, incomplete, irrelevant, or misleading. You may correct most account information directly in the Driver App, Rider App, or Advertiser Portal. For corrections you cannot make yourself, write to the relevant privacy contact in clause 1.4.
9.3 Deletion
You may request deletion of your account and the associated Personal Information by writing to the relevant privacy contact, or by using the in-app account-deletion function where available. We action deletion 30 days after your request (see clause 8), subject to the retention exceptions in that clause. Trip records, payment records, and compliance records are subject to statutory retention periods and cannot be deleted on request before those periods expire.
9.4 Withdrawal of consent
Where we rely on your consent (notably, biometric verification consent, DVS consent for identity verification, marketing consent, or trusted-contact consent), you may withdraw consent at any time. Withdrawal of biometric or DVS consent will result in your Compliance Status becoming non-compliant and your Driver account being placed in suspension; this is described in the Driver Service Agreement and the Biometric / Facial Verification Notice.
9.5 Marketing opt-out
You may opt out of marketing messages at any time by following the unsubscribe link in any message, or by adjusting your preferences in the Driver App, Rider App, or Advertiser Portal.
9.6 Complaints
If you believe we have breached this Privacy Policy or the Australian Privacy Principles, you may complain to the relevant privacy contact in clause 1.4, or follow the process in the Complaints Handling Procedure. We will acknowledge your complaint within 5 Business Days and respond substantively within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by phone on 1300 363 992.
10. Security
We take reasonable steps to protect Personal Information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include:
- TLS encryption for data in transit;
- Per-document envelope encryption for Driver identity documents, with image location/camera metadata (EXIF/GPS/XMP/IPTC) stripped before the file is encrypted, and access to the decrypted content restricted to a break-glass administrative process.
- Encryption at rest for payment data (held by Stripe);
- AWS-managed encryption-at-rest for RDS, S3, and EBS;
- Role-based access control with least-privilege principles for OZ Ride and OOHAi Media personnel;
- Audit logging of administrative actions;
- Multi-factor authentication for administrative access;
- WebAuthn-based 2FA for the most sensitive admin roles;
- Network segmentation between the monolith and the Advertising Service;
- Monitoring with CloudWatch + Sentry, with alarms for anomalous activity;
- Regular dependency, secret, and code-quality scans.
No security measure is perfect. We commit to detecting, responding to, and notifying you of any eligible data breach in accordance with the Notifiable Data Breaches scheme set out in Part IIIC of the Privacy Act 1988 (Cth).
10.1 Data breach notification
Where we experience a data breach that we suspect may be an eligible data breach, we assess it within 30 days. Where we conclude an eligible data breach has occurred (that is, unauthorised access to or disclosure of Personal Information likely to result in serious harm, which we cannot adequately remediate), we will notify the OAIC with a statement covering our identity and contact details, a description of the breach, the kinds of information involved, and our recommended steps for you, and we will notify affected individuals as soon as practicable, as required by the Notifiable Data Breaches scheme. The procedure our personnel follow is published as the Data Breach Response Plan.
11. Cookies and tracking
The Cookie Policy describes the cookies and similar technologies we use on the Website. The Apps do not use third-party tracking cookies; they use device-level identifiers and the OS-provided push-notification tokens for the operational purposes described in this Policy.
12. Children
The Platform is not directed at children under 18. Riders under 18 must travel only when accompanied by an adult. We do not knowingly collect Personal Information from a child under 13. If we discover that we have collected such information without verifiable parental consent, we will delete it.
13. Recordings and surveillance disclosure
Phone calls to and from the Phone Booking Service are recorded and transcribed for support, training, and quality purposes. We disclose this fact at the start of the call. You may at any time request that the call be transferred to a human operator. The use of any in-Vehicle audio or video recording device by a Driver is regulated by the Surveillance Devices Act 1998 (WA) and the Driver is responsible for compliance, including posting required notices. The separate audience-measurement cameras in Player Tablets do not record — see the Computer Vision Privacy Disclosure.
14. AI use
The Platform uses artificial-intelligence systems for: the Phone Operator AI Agent ("Alex") on inbound calls to the Phone Booking Service; the support AI agents in the admin console; the content-suitability assessment of advertising Creatives. Where you interact with an AI system, you are notified at the start of the interaction. AI systems may pass your interaction text and limited related context to the third-party LLM provider listed in clause 6 (Anthropic). The Phone Operator AI Agent is constrained by server/services/FinancialGuard.ts and may not, on its own authority, complete financial transactions.
15. Changes to this Policy
We may amend this Privacy Policy from time to time. The Effective Date at the head of this document will reflect the date of the most recent material change. Where the change materially affects your rights, we will notify you in advance by in-app message and email at least 14 days before the change takes effect. The current version of this Policy is always available at web.oz-ride.com/legal/privacy.
16. Contact and complaints
For any privacy-related question, request, or complaint, contact:
- OZ Ride privacy:
privacy@oz-ride.com, or by post to OZ Ride Pty Ltd, Privacy Officer, 224 Balcatta Road, Balcatta WA 6021, Australia. - OOHAi Media privacy:
privacy@oohai.com.au. - OAIC:
oaic.gov.au, 1300 363 992.
End of Privacy Policy.