Privacy Policy

Waybill ("we", "us", "our") is committed to protecting your privacy. This policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using Waybill, you agree to the collection and use of information as described in this policy.

1. Information We Collect

We collect information you provide when creating an account, including your name, email address, organisation name, and payment information. We also collect operational data you enter into the platform (driver details, vehicle records, job information, passenger profiles). When you use the platform we automatically collect technical data such as IP address, device and browser information, and log data.

Where your organisation enables the public booking form, we collect the booking details a customer submits — such as their name, contact details, pickup and drop-off locations, travel times, and passenger information — in order to create the corresponding booking in your organisation's account. This information is collected on your organisation's behalf and made available to your organisation, and your organisation is responsible for how it is subsequently used.

2. Sensitive Information

Some information handled through Waybill — including NDIS participant details, health or disability information, and government identifiers — is "sensitive information" under the Privacy Act and is subject to stricter protections. Where your organisation enters such information about individuals (for example passengers or NDIS participants), your organisation is responsible for obtaining any consent required to collect and share that information with us. We collect and use sensitive information only to provide the service to your organisation, and only as permitted by law.

3. How We Use Your Information

We use your information to provide and improve our transport management services, process payments, send essential service communications, provide customer support, and meet our legal obligations. We do not sell your personal information to third parties. We never use the operational data you enter into the platform — such as driver, vehicle, job, passenger or NDIS participant records — for advertising of any kind. We do use limited information about visits to our public website and about new account sign-ups to measure how effective our own advertising is; this is explained in "Cookies, Analytics & Advertising Measurement" below.

4. Disclosure & Third-Party Service Providers

To operate the platform we share information with trusted service providers who process data on our behalf under contractual confidentiality and security obligations. These include cloud hosting infrastructure, our payment processor, SMS and email delivery providers, mapping and route-optimisation providers, and website analytics and advertising-measurement providers. We may also disclose information where required by law or to protect our legal rights.

If your account has fees that remain unpaid, we may disclose relevant account and billing information — such as the account owner's name, contact details, and the amount owed — to a debt collection agency or our legal advisers for the purpose of recovering the outstanding amount. We disclose only the information reasonably necessary for that purpose.

Where your organisation enables online fare payments through the public booking form, your customers' payment card details are collected and processed directly by your connected payment provider (for example, Stripe) as the merchant of record for those fares. Waybill does not collect or store your customers' full card details, and those fares are paid to your organisation rather than to Waybill. The payment provider handles that information under its own privacy policy and PCI-DSS obligations.

5. Overseas Disclosure

Some of our service providers store or process data outside Australia (for example, in the United States or the European Union). Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

6. Data Storage & Security

Your data is stored securely on enterprise-grade cloud infrastructure. We use industry-standard encryption for data in transit (TLS) and at rest. Payment processing is handled by a PCI-DSS Level 1 certified payment processor. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Organisation Data Isolation

Each organisation's data is logically isolated. Users can only access data belonging to their own organisation. Cross-organisation data access is not possible through the application.

8. Data Retention

We retain your data for as long as your account is active. Deleted records use soft-delete architecture, allowing recovery within 30 days. After permanent deletion, data is removed within 90 days from all systems including backups, except where we are required to retain it by law.

If your trial or subscription ends and you do not resubscribe, we retain your organisation's data for approximately 90 days from the date your account lapsed, after which it is permanently deleted. Before any deletion we send multiple email reminders to your account owner, giving you the opportunity to resubscribe or export a complete copy of your data through the platform. Records you are required to keep under your own regulatory obligations (for example, NDIS record-keeping requirements) should be exported before the retention period ends. Limited billing records are retained after deletion where required by law.

9. Cookies, Analytics & Advertising Measurement

We use essential cookies for authentication and session management. On our website we also use third-party analytics tools — Google Analytics and Microsoft Clarity — which set cookies and collect usage information (such as pages visited and interactions) to help us understand and improve the site.

We advertise Waybill online, and we use Google Ads conversion tracking to measure which of our ads lead to new account sign-ups. If you arrive at our website from one of our ads, Google adds a click identifier to the address, which is stored in a cookie on our own domain. If you then create an account, that identifier is read again so the sign-up can be attributed to the ad. We may also send Google a securely hashed (irreversible) version of the email address used at sign-up, so that a sign-up can be matched to an earlier ad click made in a different browser or on a different device. We do not send your name, phone number, organisation details, or any operational data for this purpose.

These advertising cookies and tags are used only on our public website and on our sign-up pages. They are not present inside the logged-in Waybill application, so your day-to-day use of the platform is not tracked for advertising.

You can control or disable cookies through your browser settings, though some features may not function correctly if you do. You can also manage how Google personalises advertising to you at myadcenter.google.com, and opt out of Google Analytics measurement using Google's browser opt-out add-on.

10. Your Rights

You have the right to access, correct, or delete your personal information. You can export your data at any time through the platform. To request access to or deletion of your personal information, contact us at [email protected].

11. Data Breach Notification

We maintain procedures to detect and respond to data breaches. Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

12. Complaints

If you believe we have breached the Australian Privacy Principles, please contact us at [email protected] and we will investigate. If you are not satisfied with our response, you may lodge a complaint with the OAIC at oaic.gov.au.

13. Changes to This Policy

We may update this policy from time to time. We will notify you of any material changes via email or through the platform. The "last updated" date above reflects the most recent revision.

14. Contact

For privacy-related enquiries, contact us at [email protected].