Skip to content
RIDESPECAU
Sign inRequest a demo

Trust and data

PUT YOUR NAME ON IT WITH YOUR EYES OPEN

A RideSpec portal wears your branding, so to your customer it is you. This page is what you are standing behind when you put it on your website: where the data sits, what happens to a photograph, and the things this product deliberately refuses to say.

Where it lives

STORED IN AUSTRALIA, AND WE SAY WHERE IT TRAVELS

Everything RideSpec stores is stored in Sydney. That is a configuration, checked in, not a preference. But generating a preview means sending the photograph to an image provider, and that provider is overseas — so the honest version of this section is a list of both.

Database and file storageSydney · ap-southeast-2
Application functionsSydney · syd1
Fonts and iconsSelf-hosted
Generating a previewSent overseas
Screening an upload · masking a plateSent overseas

The two marked rows are the honest part. A preview cannot be generated without sending the photograph to an image provider, and ours is not in Australia. It is sent for that job, it is not kept there, and it is not used to train anything. The privacy policy names every provider and what each one receives.

Self-hosted fonts matter more than they look, too. An embed that pulls a font or an icon set from somebody else’s server tells that server which of your pages a visitor is on. Ours does not.

The photograph

THE MOST PERSONAL THING IN THE PRODUCT

A customer photographs their own car, usually in their own driveway. That picture has more in it than a vehicle, and it is treated as though it does.

Checked before it is stored

Every uploaded image passes a moderation gate on the way in. If the check is unavailable the upload is refused rather than waved through — it fails closed.

Re-encoded, which strips the metadata

Phones write GPS coordinates, a timestamp and a device identifier into a photograph. Re-encoding removes all of it, because none of it is needed to draw a wheel.

Number plates covered where detected

A plate is the one piece of personal information a vehicle photo is guaranteed to carry. Detected plates are replaced with a RideSpec plate at the door — before storage, before any provider, before any download — on customer uploads and product reference shots alike. It is best effort and the wording in the product says so: where detected, not always.

Nothing personal leaves in an event

The embed tells your website that a preview finished. It does not tell it who, from where, or what they uploaded.

How long

NOTHING IS KEPT FOREVER

These are the defaults, and they can be shortened or lengthened per business. A sweep runs against them — the dates are not decoration.

A customer who wants their data removed sooner gives you the link their build lives at, which is the handle that identifies them without ever having asked them to create an account.

Anonymous session30 days
The customer’s original photo30 days
The generated preview90 days
Images attached to an enquiryYour setting
Separation

ONE RETAILER CANNOT READ ANOTHER

This is the part of a multi-tenant product that is either right from the first day or never right at all. It was built before any feature was.

  • A portal is private until the business opens it. Until then only its own signed-in staff can see the catalogue, the prices or the photographs — not anyone who guesses the address.
  • Every table carrying a business's data has row-level security enabled and forced — including for the roles that own it.
  • Which organisation a person belongs to is resolved inside the database, never taken from the browser.
  • A visitor to a showroom holds no privilege on any table. Public pages read through named functions that decide what a guest may see.
  • The rules are covered by a SQL test suite that seeds several businesses and then tries, as each of them, to read the others.
  • Checkout links are restricted to domains the business controls, enforced when the product is saved rather than when the link is clicked.
  • Only the domains a business approves may frame its embed, enforced by the server on every request.
What we do not claim

THE FOUR THINGS IT WOULD BE EASY TO IMPLY

Australian Consumer Law does not care whether an overstatement was deliberate, and neither does a customer whose bar does not bolt on.

We do not verify fitment

RideSpec holds no fitment dataset and calculates nothing mechanical. Your catalogue states which vehicles a product suits, and the showroom presents that as your statement, attributed to you by name. Getting this wrong damages a customer's vehicle, and the expertise and the liability both sit with the retailer — so the claim does too.

A preview is a picture, not a measurement

Every preview is reviewed against the product it is meant to show before the customer sees it, and one that fails review gets a corrected attempt. That is a check on whether the right part was drawn, not a measurement of it. Accessory previews are labelled conceptual and not dimensionally exact, wrap colours carry an accuracy note, and a tint preview carries no legal-compliance claim of any kind. Every render surface says which of these it is.

RideSpec is not the seller

The business is the merchant of record and the supplier or installer. Payment happens on your website. RideSpec does not process it, does not take a cut of it and does not represent itself as supplying or fitting anything.

Demonstration data is labelled as such

Fictional businesses and fictional stock are marked as fictional wherever they appear, including in the demonstration portal we show you on a call.

Still being built

AND THE PARTS THAT ARE NOT FINISHED

A trust page that only lists strengths is an advertisement. These are the gaps a business should know about before signing anything, and they are the ones being worked on.

Enquiry emails are recorded, not yet delivered

Every notification is composed and stored against the enquiry, and marked as not sent with the reason. Enquiries appear in your queue immediately. Delivery is waiting on a mail provider, and nothing is ever recorded as sent when it was not.

Card payment is not built

Checkout is a tracked link to your own website. That is the design for now, not a temporary shim — but if you were expecting to take payment inside the portal, you cannot yet.

Suppliers do not administer their own grants

Access is granted and withdrawn by us on the supplier’s instruction, same day. The self-service version is not there.

ASK THE AWKWARD ONES

If something on this page matters to your business and the answer is not specific enough, say so on the first call. A vague answer about where your customers’ photographs live is not a good enough reason to sign.

Get in touchBack to the overview

This page describes how the product is built. It is not legal advice, and it is not a substitute for the agreement between us — ask for that before you sign.