Privacy Policy

This Privacy Policy explains how MechOS Pty Ltd (ABN 80 698 552 706) (“MechOS”, “we”, “our”, or “us”) collects, uses, stores and protects personal information when you use the MechOS platform.

We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and other applicable Australian laws.

By using MechOS, you acknowledge this Privacy Policy.

We collect information in two categories.

Customer Data is information you choose to store within MechOS while operating your business.

This may include:

• Business name
• ABN
• Business addresses
• Contact details
• Staff names and roles
• Customer names
• Phone numbers
• Email addresses
• Vehicle information
• Registration numbers
• Service history
• Job notes
• Estimates
• Invoices
• Payments
• Expenses
• Inventory
• Photos and inspection reports
• Other workshop records created by your organisation

You remain the owner of this information.

We also collect information required to operate and secure your account, including:

• Name
• Email address
• Encrypted password
• Login history
• IP addresses used for authentication
• Device and browser information
• Subscription status
• Payment references or tokens supplied by our payment providers
• Audit logs relating to account activity

We do not store your payment card numbers.

We use personal information to:

• provide and operate the MechOS platform;
• authenticate users and secure accounts;
• deliver customer support;
• process subscriptions and billing;
• send operational emails such as password resets, invoices and service notifications;
• improve system performance, reliability and security;
• investigate suspected fraud or security incidents;
• comply with legal and regulatory obligations.

We do not sell Customer Data or personal information.

We do not use Customer Data for advertising, behavioural profiling or marketing to your customers.

Where you store information relating to your own customers, employees or contractors within MechOS, you remain responsible for ensuring you have the legal authority to collect that information and provide it to us for processing on your behalf.

You are also responsible for complying with your own obligations under applicable privacy laws.

We use carefully selected third-party providers to operate MechOS. These providers may assist with services including:

• cloud hosting;
• database hosting;
• authentication;
• email delivery;
• payment processing;
• artificial intelligence features;
• mapping and location services;
• error monitoring;
• infrastructure monitoring;
• analytics;
• customer communications.

Some providers store or process information outside Australia. At present those countries are Japan and the United States; some providers also operate global edge networks. The Trust page names each provider and the region it operates in.

Where personal information is transferred overseas, we take reasonable steps to ensure those providers maintain appropriate privacy and security protections consistent with Australian privacy obligations.

Current service providers are available upon request and may change from time to time as our infrastructure evolves.

We use commercially reasonable technical and organisational safeguards designed to protect information against unauthorised access, loss, misuse or disclosure.

These measures include, where appropriate:

• industry-standard encryption in transit and at rest;
• authenticated user access;
• role-based permissions;
• audit logging;
• monitored infrastructure;
• regular backups;
• disaster recovery procedures;
• security monitoring and alerting.

While we take security seriously, no internet-based service can guarantee absolute security.

If we become aware of a data breach involving personal information, we will promptly investigate the incident, take reasonable steps to contain and remediate the issue, and assess whether notification is required under Australian law.

Where required by the Notifiable Data Breaches Scheme, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

You may request to:

• access your personal information;
• correct inaccurate information;
• export your Customer Data;
• delete your organisation and associated Customer Data;
• make a privacy complaint.

Most information can be managed directly within MechOS.

Requests may also be sent to privacy@getmechos.com.au.

Customer Data is retained while your subscription remains active.

If you delete your organisation:

Immediately

• access to the organisation is disabled;
• users lose access to workshop data;
• subscription cancellation is scheduled according to your billing cycle.

During the 30-day recovery period

Your organisation remains recoverable by the account owner.

The information is retained solely to allow restoration if requested.

After 30 days

Customer Data is securely deleted or permanently de-identified from our active systems unless we are legally required to retain particular records.

Disaster recovery backups may temporarily retain encrypted copies for a limited period before being automatically overwritten.

Some limited information may be retained where necessary for:

• legal compliance;
• taxation;
• fraud prevention;
• security investigations;
• maintaining system audit records.

We may also retain anonymous, aggregated statistics that cannot identify any individual or organisation.

We recommend exporting your data before requesting deletion.

Subscription payments are processed by authorised third-party payment providers.

We do not receive or store your payment card numbers.

Payment providers maintain their own security standards and privacy practices.

MechOS uses essential cookies required for authentication, security and operation of the Service. These are necessary for the Service to function and cannot be turned off.

Some features that rely on third-party services — such as embedded maps and address lookup (Google Maps) — may set their own cookies or collect limited technical data, subject to the privacy policy of that provider.

We do not use third-party advertising cookies.

Website visitor statistics

Our public website (getmechos.com.au) uses Vercel Web Analytics to count visits to its pages. It does not use cookies to recognise you: a visitor is counted using a code created from the request, which is discarded after 24 hours. For each page view it records the page, the website you came from, campaign tags in the link, your approximate location (country, region and city), and your browser, operating system and type of device. These records are anonymous and are not tied to you or your IP address.

We use these statistics only in aggregate, to see how people find and use the website. They are not collected inside the MechOS app, or on pages a workshop sends to its customers, such as quotes, invoices and booking pages.

We may disclose information where required to do so by law, court order, lawful regulatory request or to protect the rights, property or safety of MechOS, our customers or others.

MechOS is designed for business use by automotive workshops.

We do not knowingly collect personal information directly from children under the age of 16.

We may update this Privacy Policy from time to time.

Where changes are material, we will provide reasonable notice through the Service or by email before the updated policy takes effect.

The latest version will always be available on our website.

Privacy enquiries

privacy@getmechos.com.au

Legal notices

legal@getmechos.com.au

If you believe we have mishandled your personal information, please contact us first so we can investigate and attempt to resolve your concerns.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) — oaic.gov.au.