1. About Us
This Privacy Policy explains how PreStartGo (Aust) Pty Ltd (ABN 50 685 228 497) ("PreStartGo", "we", "our", "us") collects, uses, discloses, and protects personal information in connection with our equipment compliance platform, including our website at prestartgo.com, web portal at admin.prestartgo.com, mobile application, and hardware interlock devices (collectively, the "Platform").
PreStartGo is an Australian registered company with operations in Australia, New Zealand, Canada, and the United States. We are committed to protecting your privacy in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as well as applicable privacy laws in the jurisdictions in which we operate.
2. Information We Collect
We collect the following categories of personal information:
Information you provide
- Account information: Name, email address, phone number, organisation name, job title, and billing address provided during account registration or when you are invited to join an organisation.
- Payment information: Credit card or payment details processed securely through our third-party payment processor, Stripe. We do not store full card numbers on our servers.
- Support inquiries: Information you provide when contacting our support team, including name, email, and the content of your inquiry.
Information collected through use of the Platform
- Inspection data: Pre-start inspection records including operator identity, timestamps, GPS coordinates, checklist responses, defect reports, and photographs captured during inspections.
- Device data: Hardware device identifiers (Interlock serial numbers), relay state changes, firmware versions, Bluetooth connection events, and engine runtime data.
- Location data: GPS coordinates captured during mobile inspections and site check-in, used for geofencing and compliance verification.
- Mobile app data: An identifier for each installation of the mobile app (its Firebase installation ID), your phone's platform and operating system version, the app version and build, and when the installation was first seen, last contacted our servers, was last opened, was signed out, or stopped receiving notifications. The app sends these with each request to our servers, including requests it makes in the background.
- Usage data: Log data, browser type, IP address, pages visited, feature interactions, and performance metrics collected when you access the Platform.
- Audit data: Immutable records of all actions performed within the Platform, including user identity, timestamps, and action details.
Information from third parties
- Authentication providers: When you sign in using Google or an enterprise identity provider (SAML/OIDC), we receive your name, email address, and profile information from that provider.
- Organisation administrators: Your employer or organisation administrator may provide your name, email, and phone number when inviting you to the Platform.
3. How We Use Your Information
We use the personal information we collect for the following purposes:
- Providing the Platform: Operating and maintaining the compliance platform, including processing inspections, managing equipment, generating reports, and enforcing interlock compliance.
- Account management: Creating and managing your account, authenticating your identity, and processing subscription billing.
- Operational notifications: Sending alerts and notifications related to inspections, defects, bypass events, service due dates, and other compliance-related activities.
- Customer support: Responding to your inquiries and providing technical assistance.
- Compliance and audit: Maintaining immutable audit trails as required for workplace safety compliance and regulatory reporting.
- Platform improvement: Analysing usage patterns to improve the Platform, fix defects, and develop new features.
- Legal obligations: Complying with applicable laws, regulations, legal processes, or enforceable governmental requests.
4. Legal Basis for Processing
We process personal information on the following bases:
- Contractual necessity: Processing required to fulfil our obligations under our Terms of Service and subscription agreements.
- Legitimate interests: Improving the Platform, preventing fraud, ensuring security, and maintaining audit trails for workplace safety compliance.
- Legal compliance: Processing required to comply with workplace health and safety legislation, tax obligations, and other applicable laws.
- Consent: Where required by applicable law, we obtain your consent before processing personal information for specific purposes such as marketing communications.
5. Data Storage, Security, and Transfers
Your data is stored on Google Cloud Platform (GCP) infrastructure in Australia (australia-southeast1).
We implement enterprise-grade security measures including:
- TLS 1.2+ encryption for all data in transit (TLS 1.3 negotiated where the client supports it)
- Encryption at rest for all stored data using Google-managed encryption keys
- AES-256-GCM encryption for mobile app local storage
- HMAC-SHA256 cryptographic signing of all hardware interlock commands
- Append-only audit logs that cannot be modified or deleted
- Multi-tenancy isolation — every database record is scoped by organisation ID
- HTTP-only, Secure session cookies that scripts running in your browser cannot read. Sign-in tokens are held in your browser’s per-tab session storage and are discarded when the tab closes — they are never written to persistent browser storage.
International data transfers
We support customers in Australia, New Zealand, Canada, and the United States, so personal information may be transferred between these jurisdictions even while primary data storage remains in Australia. When we transfer data outside of your home region, we rely on appropriate safeguards including our contractual arrangements with Google Cloud Platform and Stripe, which maintain data protection standards consistent with applicable privacy legislation.
For Australian customers, cross-border disclosures are made in accordance with Australian Privacy Principle 8. For Canadian customers, transfers comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). For United States customers in applicable states, transfers comply with state privacy laws including the California Consumer Privacy Act (CCPA).
6. Disclosure of Personal Information
We do not sell, rent, or trade your personal information. We may disclose personal information to the following categories of recipients:
- Cloud infrastructure: Google Cloud Platform for hosting, data storage, and computing services.
- Payment processing: Stripe for subscription billing and payment processing.
- Authentication: Google Identity Platform (Firebase Authentication) for secure sign-in and identity verification.
- Error monitoring: Sentry for application error tracking and performance monitoring. Personally identifiable information is redacted from error reports.
- Your organisation: Organisation administrators and managers within your PreStartGo account can access inspection records, audit logs, and user activity as permitted by their role. If you hold a current operator licence with an organisation, people with access to its console can also see whether you are signed in to the mobile app and on how many devices, your phone's platform (iOS or Android), the app version and build you use, when you last opened the app, when the app last contacted our servers (which it also does in the background), and whether it may have been uninstalled. Times are shown to the minute. That reflects your use of the app for any organisation: if you work for more than one, it may come from your work for another. It never shows which organisation the activity was for, what you did or where, or your phone's identifier or operating system version. It is shown on screen only, is not included in exports, and an organisation can have it turned off.
- Legal requirements: Law enforcement, regulatory authorities, or other parties when required by law, court order, or to protect our rights, property, or safety.
7. Data Retention
- Compliance data: Inspection records, audit logs, bypass records, defect transitions, and service records are retained for the duration of your subscription plus a minimum of seven (7) years, or longer if required by applicable workplace health and safety legislation in your jurisdiction.
- Account data: Account and profile information is retained for the duration of the subscription. On account closure, data is available for export for ninety (90) days before deletion.
- Mobile app data: Installation details are deleted 365 days after that installation last contacted our servers.
- Payment records: Transaction records are retained as required by Australian taxation law (minimum five years) and applicable laws in other jurisdictions.
- Usage and analytics data: Aggregated and anonymised usage data may be retained indefinitely for product improvement purposes.
8. Multi-Tenancy and Data Isolation
PreStartGo is a multi-tenant platform. Every database record is scoped by organisation ID. API middleware validates tenancy on every request. Attempts to access another organisation's data return a 404 (not found) response to prevent information leakage. Your data is logically isolated from all other customers at the application layer. One deliberate exception is the mobile app status described in section 6, which an organisation sees for the people it currently licenses, whichever organisation their app activity was for.
9. Your Rights
All users
You have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate or incomplete personal information
- Request deletion of your personal information, subject to legal retention requirements
- Request a copy of your personal information in a portable format
- Withdraw consent where processing is based on consent
- Lodge a complaint with the relevant supervisory authority in your jurisdiction
Australian residents
Under the Privacy Act 1988 (Cth), you may request access to and correction of your personal information. You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
New Zealand residents
Under the Privacy Act 2020 (NZ), you have the right to access and correct your personal information. Complaints may be directed to the Office of the Privacy Commissioner at privacy.org.nz.
Canadian residents
Under PIPEDA and applicable provincial privacy legislation, you have the right to access, correct, and challenge the accuracy of your personal information. You may lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.
United States residents
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information. Residents of other US states with applicable privacy laws (including Virginia, Colorado, Connecticut, and others) may exercise similar rights under their respective state laws.
Exercising your rights
To exercise any of these rights, contact us at privacy@prestartgo.com. We will respond within the timeframe required by applicable law (generally 30 days for Australian and Canadian requests, 45 days for US requests).
Note that compliance and audit trail data may be subject to mandatory retention requirements under workplace health and safety legislation. Where a legal obligation requires us to retain data, we will inform you of the specific obligation and the applicable retention period.
10. Children's Privacy
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us and we will take steps to delete the information.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or by email to account administrators. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Platform after changes constitutes acceptance of the revised policy.
12. Contact Us
If you have questions about this Privacy Policy or how we handle your personal information, contact us:
- Entity: PreStartGo (Aust) Pty Ltd
- ABN: 50 685 228 497
- Privacy inquiries: privacy@prestartgo.com
- General inquiries: sales@prestartgo.com