Privacy Policy
In short
- We collect what's needed to run Opzo: accounts, school details, students, bookings and payments.
- For students' information, the driving school is in charge; we look after it on the school's behalf.
- We don't sell personal information or use it for advertising.
- Card details are handled by Stripe. We never see or store full card numbers.
- Data from Google (sign-in, Calendar, Business Profile) is used only for the feature you turned on, and you can disconnect at any time.
- Our servers are in Sydney, Australia.
- Who we are
- What we collect
- How we use it
- Information from Google
- Who we share it with
- Overseas disclosure
- Storage and security
- How long we keep it
- Cookies
- Learners under 18
- Access, correction and deletion
- Complaints
- Changes and contact
1. Who we are
Opzo Pty Ltd ("Opzo", "we", "us") provides online software for Australian businesses. This policy covers our website opzo.com.au, the Opzo Drive app at app.opzo.com.au, the websites we host for driving schools (at school-name.opzo.com.au or the school's own domain), and the Opzo Admin mobile app.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Schools and their students. When a driving school uses Opzo Drive, the school decides what information it collects about its students and trainers and why. For that information, the school is responsible to its students, and Opzo stores and processes it on the school's behalf and on its instructions. If you're a student, you can also contact your driving school directly about your information.
2. What we collect
| Who | Information |
|---|---|
| Everyone with an account | Name, email address, phone number, password (stored only as a one-way hash), and if you use "Continue with Google", your Google account ID, email and name. |
| Driving schools | Business name, ABN, address, contact details, website content and images, lessons, prices, branches and vehicles, settings, and bank details for payouts (collected and held by Stripe). |
| Trainers | Name, contact details, date of birth, licence and accreditation details, working-with-children check, availability, and pay settings entered by the school. |
| Students | Name, contact details, home and pickup addresses, date of birth, licence stage and number, logged hours, parent or guardian details, notes the school records, bookings, packages, payments, and reviews you choose to leave. |
| Website visitors | Messages you send through a contact or enquiry form, and basic technical information (see below). |
| Technical information | IP address, browser type, pages requested, and error reports, kept in server logs to run, secure and fix the service. |
We collect information from you directly, from the driving school you deal with, from Stripe (payment status), and from Google when you connect a Google service (section 4).
3. How we use it
- To provide the service: accounts, school websites, online booking, scheduling, reminders, payments, payouts, reports and support.
- To send messages about bookings and accounts, such as confirmations, changes, receipts and security notices. Booking emails are sent in the school's name, and replies go to the school.
- To keep Opzo secure: detecting abuse and fraud, signing people out after inactivity, and keeping audit records of important changes.
- To fix problems and improve Opzo, using aggregated or de-identified information where we can.
- To meet legal, tax and accounting obligations.
We don't sell personal information, and we don't use it for advertising.
4. Information from Google
Some features connect to Google, but only when you choose to use them:
| Feature | What we access and why |
|---|---|
| Continue with Google | Your Google account ID, email address and name, to sign you in. We never see your Google password. |
| Google Calendar (trainers) | We create, update and remove events for your lessons and time off on your calendar, and read your calendar's busy times and changes to those events, so that lessons aren't booked when you're busy and changes you make in Google are reflected in Opzo. |
| Google Business Profile (schools) | When a school owner connects the Google account that manages their business listing, we read that listing's name, address, reviews, average rating and review count, to show them in the school's dashboard and on its website. We don't post, edit or reply to reviews, and we don't change the listing. |
| Google reviews by search | For a listing a school finds by name, we read public information Google provides (name, address, rating and a selection of reviews) using the Google Places API. |
Limited use. Opzo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the feature you turned on.
- We don't transfer it to others, except as needed to provide that feature, to comply with the law, or as part of a merger or sale of our business with the same protections.
- We don't use it for advertising, and we don't sell it.
- We don't use it to develop or train artificial intelligence or machine-learning models.
- Our staff don't read it, unless you give us permission (for example, for support), it's needed for security or to investigate abuse, or the law requires it.
Google access tokens are stored encrypted. You can disconnect at any time: trainers from their Calendar page, schools from Admin → Reviews. You can also remove Opzo's access in your Google Account at myaccount.google.com/permissions. When a school disconnects Google Business Profile, we delete the reviews we stored and ask Google to cancel our access.
5. Who we share it with
We share personal information only as needed to run the service:
- The driving school you book with or work for, and its staff and trainers, as needed for your lessons.
- Service providers who process information for us under contract:
- Stripe (payments and payouts)
- Google (sign-in, Calendar, Business Profile and Maps services you choose to use)
- Resend (sending email)
- Kamatera (server hosting in Sydney)
- Authorities, when the law requires it or to protect people's safety.
- A buyer or successor of our business, under the same privacy protections.
6. Overseas disclosure
Our servers and database are in Sydney, Australia. Some of our service providers (Stripe, Google and Resend) may process information in other countries, including the United States. We use providers with strong privacy and security commitments, and share only what each needs to provide its service.
7. Storage and security
- All connections use encryption (HTTPS).
- Passwords are stored as one-way hashes, and secrets such as Google access tokens are encrypted.
- Each school's data is kept separate from every other school's, and access is limited by role.
- Databases are backed up daily.
- Signed-in sessions end after 15 minutes without activity.
No system is perfectly secure. If a data breach is likely to cause serious harm, we'll notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
8. How long we keep it
We keep information while an account or school is active, and as long as needed for legal, tax and accounting purposes, generally up to 7 years for financial records. When a school closes its account, its data can be deleted on request, apart from records we must keep. Backups are overwritten within 14 days. Reviews from Google are refreshed daily and deleted when a school disconnects Google.
9. Cookies
We use a small number of essential cookies and browser storage:
- to keep you signed in;
- to sign you out after inactivity;
- to remember simple preferences.
We don't use advertising or cross-site tracking cookies.
10. Learners under 18
Many learner drivers are under 18. Driving schools may record a parent's or guardian's details, and are responsible for any consent their students need. A parent or guardian can contact the school, or us, about a young person's information.
11. Access, correction and deletion
You can see and update much of your information in your account. You can also ask us for a copy of your personal information, or to correct or delete it. Email info@opzo.com.au; we'll respond within 30 days. If the information belongs to a driving school's records, we may refer you to the school, or act on its instructions. We may need to keep some information where the law requires it.
12. Complaints
If you have a privacy concern, email info@opzo.com.au and we'll respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
13. Changes and contact
We may update this policy as Opzo changes. We'll post the new version here with its effective date, and tell account holders about significant changes.
Questions: info@opzo.com.au