Privacy
PRIVACY POLICY
Last updated 8 August 2026.
Under review. This describes how RideSpec actually handles information today — it was written from the system itself, not from a template. It has not yet been through a solicitor, so the wording may change. If anything on this page matters to a decision you are making, ask and we will confirm it in writing.
Who this is about
RideSpec is operated as an Australian sole trader, ABN 13 264 780 152, of Sunshine Coast, Queensland, Australia. That ABN identifies the entity accountable for the personal information described here, and the registered name behind it is public on the Australian Business Register.
It applies to this website and to the RideSpec platform: the operator console, the business dashboard, hosted showrooms at /showroom/… and the website embed.
We aim to handle personal information consistently with the Australian Privacy Principles in the Privacy Act 1988 (Cth), whether or not the small business exemption applies to us at a given time. That is a choice, not a concession — our customers are businesses whose own obligations flow through to us.
Whose customers, whose data
When a car owner uses a retailer’s showroom, that person is the retailer’s customer, not ours. The retailer decides what to collect and what to do with it; RideSpec holds and processes it on their behalf and under their instructions.
In practice that means two things. Enquiries and photographs belong to the business whose showroom they came through, and their own privacy policy governs what they then do with them. And RideSpec never contacts a retailer’s customers to sell them anything, never adds them to a mailing list, and never uses one retailer’s data for another’s benefit.
For the businesses who subscribe — and for anyone using this marketing site — RideSpec is the one making the decisions, and everything below applies to us directly.
What is collected
From a business
- Business details: trading and legal name, ABN, GST status, addresses, locations, contact numbers and email addresses, website.
- Staff accounts: name, email address, role and sign-in activity. Sign in is by emailed link — RideSpec stores no passwords.
- Catalogue content the business uploads: products, prices, photography and compatibility statements.
From a car owner using a showroom
- A photograph of their vehicle, and any details they type about it — make, model, year, variant, body style, and optionally a registration number.
- What they selected and what was previewed for them.
- Only if they send an enquiry: name, email address, phone number, postcode, preferred location, preferred contact method, timing, and whatever they write in the notes.
- A consent record, and — kept separately — whether they agreed to marketing. Those two are never treated as one answer.
Contact details are asked for at the point they are needed, when an enquiry is submitted or a checkout begins. Not before. A person can upload a photo, build a vehicle and see a preview without telling us who they are.
From a visitor to this website
- Whatever is typed into the contact form: business name, your name, email, and optionally phone, website, state and a message.
- Campaign parameters in the link you arrived on, if there were any.
Why
- To run the service a business is paying for.
- To generate a preview, which cannot be done without the photograph.
- To pass an enquiry to the business the customer sent it to, with enough context that they can answer it.
- To screen uploads for unlawful or unsafe content before they are stored or sent anywhere.
- To keep the service working and secure: metering usage, applying rate limits, and investigating abuse.
- To answer an enquiry sent to us through this site.
Customer photographs are never used to train an AI model — not by us, and not by the providers we send them to. We require that as a term of use, and it is a condition of any provider being used at all.
We do not sell personal information. We do not trade in it. We do not build profiles of car owners across businesses.
The vehicle photograph
This is the most personal thing the product handles, so it gets its own clause. A photograph of somebody’s car usually contains their driveway, sometimes their number plate, and occasionally other people.
- It is screened before it is stored. If the screening check cannot be performed, the upload is refused rather than accepted unchecked.
- It is re-encoded on the way in, which removes the location coordinates, timestamp and device identifiers a phone writes into the file.
- Number plates that are detected are covered with a substitute plate before the image is stored or sent anywhere. This is best effort, not a guarantee — the product says “where detected” and means it.
- It is sent to an image provider to generate the preview, and to a vision service for screening and plate detection. Both are overseas — see below.
- It is deleted on the schedule below, without anyone having to ask.
Who else sees it
RideSpec runs on other companies’ infrastructure. These are all of them, and what each one actually receives.
| Provider | What it is for | What it receives | Where |
|---|---|---|---|
| Supabase | Database and file storage | Everything the product stores | Sydney |
| Vercel | Application hosting | Requests, and whatever they carry | Sydney |
| Generating previews, screening uploads, detecting plates | The vehicle photograph and the product reference images | Overseas | |
| Cloudflare | Bot check on public forms and the preview trigger | A challenge token and IP address. No name, no photograph. | Overseas |
| Email provider | Sending notifications and confirmations | The recipient address and the content of that message | Overseas |
Nothing else. There are no advertising networks, no analytics trackers, no third-party fonts and no third-party icon libraries — a showroom embedded on a retailer’s website does not report back to anyone.
A business’s own data is disclosed to that business and to the staff they authorise. It is never disclosed to another business on the platform. A supplier sharing a catalogue can be read by the retailers they approve; the reverse is not true, and a supplier sees none of a retailer’s customers.
What leaves Australia
Everything RideSpec stores is stored in Sydney. Two things are sent overseas while they are being processed, and both involve the vehicle photograph:
- Generating a preview. The photograph and the product reference images go to the image provider, which returns the generated picture. The result is stored in Sydney.
- Screening an upload and detecting number plates. The photograph goes to a vision service, which returns a verdict and the coordinates of any plate.
These providers currently operate from the United States and other countries, and we cannot pin them to an Australian region. We use them under terms that do not permit training on the images we send. A business whose own obligations do not allow this should raise it before signing — it is a real constraint, not a formality, and we would rather say so here than have it discovered later.
Enquiry contact details, catalogue data and business records are not sent overseas, except that a notification email necessarily passes through the email provider.
How long it is kept
| What | Default |
|---|---|
| Anonymous showroom session | 30 days |
| The customer’s original photograph | 30 days |
| The generated preview | 90 days |
| Images attached to an enquiry | Set by the business |
| Enquiry and customer records | Kept by the business as their own record, subject to their retention setting |
| Enquiries sent to us through this website | Kept while the conversation is live and for our own records afterwards |
A scheduled sweep enforces the first four against the dates. They are defaults and a business can shorten or lengthen them for its own portal.
Access, correction and erasure
If you are a car owner
Ask the business whose showroom you used — they hold your enquiry and they decide what happens to it. If you want the build and the photograph removed sooner than the schedule above, the return link you were given identifies it, and that link is all we need. It is deliberately the only handle: we never asked you to create an account, so we have nothing else to match you on.
If you are a subscribing business
Your data is in your dashboard. Ask us for an export or a deletion and we will do it. Closing an account removes the portal immediately; tell us what you want done with the catalogue and the enquiry history.
If you contacted us through this site
Ask and we will remove the enquiry. There is nothing else attached to it.
Email info@ridespec.com.au, or use the contact form.
Security
Separation between businesses is enforced in the database itself — row-level security on every table that carries a business’s data, with membership resolved server-side and never taken from the browser. It is covered by a test suite that seeds several businesses and then tries, as each of them, to read the others.
Sign-in is by emailed link, so there is no password to be reused or leaked. Operator accounts are provisioned by hand, not self-registered. Uploaded images are re-encoded rather than stored as received. Outbound links are restricted to domains the business controls, and an embed can only be framed by domains the business has approved.
The technical detail is on the trust page, including the parts that are not finished.
No system is perfect. If you find a problem, please tell us before you tell anyone else, and we will work with you. info@ridespec.com.au.
Complaints
Tell us first and we will look into it and reply. If you are not satisfied with how we handled it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Email info@ridespec.com.au, or use the contact form.
Changes
If this policy changes in a way that affects how personal information is handled, the date at the top changes and subscribing businesses are told directly. We will not quietly broaden what we do with data already collected.