Privacy policy

Vehivo Pty Ltd provides workshop management software to Australian heavy-diesel and plant-equipment workshops. This policy covers two groups of people, and the difference matters throughout.

• Our customers — the workshops that subscribe to Vehivo, and their staff who sign in and use it.
• Their customers — the vehicle owners and fleet operators whose details a workshop records in Vehivo. That data belongs to the workshop. We hold and process it on the workshop's behalf, and we do not use it for our own purposes.

Account and workshop data you give us directly:

• Name, email address and role of each user you invite.
• Your workshop's business details — trading name, ABN, locations, operating hours, labour rates.
• Billing contact details for the subscription.

Operational data your workshop records while using Vehivo:

• Customers and vehicles — names, contact numbers, addresses, registrations, service history.
• Jobs, bookings, quotes, invoices, purchase orders, parts and timesheets.
• Safety records — Take 5s, JSEAs and return-to-service approvals, including who signed them and when.
• Vehicle condition reports, including photographs taken by technicians and a customer's approval or decline of recommended work.

Technical data collected automatically:

• Sign-in events and session information, so we can keep accounts secure.
• An append-only audit log of significant actions — who created, changed, cancelled or deleted a record, when, and why.
• Standard server logs (IP address, browser, timestamps) for security and troubleshooting.

We do not sell data, we do not use it to train machine-learning models, and we do not run advertising or third-party tracking on the application.

• To run the product — showing your jobs, sending your invoices, generating your reports.
• To send transactional messages on your behalf: invoices and quote or inspection approval links by email and SMS to the customers you nominate.
• To bill your subscription and provide support when you ask for it.
• To keep the service secure and diagnose faults.
• To meet legal obligations, including the record-retention rules described below.

Support access to a workshop's data is limited to what is needed to resolve the issue you have raised, and it is logged.

Vehivo's database is hosted in Australia — Amazon Web Services' Sydney region (ap-southeast-2), operated through Neon. Your workshop's records, including your customers' details and your safety documents, are stored there at rest.

To be precise rather than reassuring: the application itself runs on Vercel's global platform, so an individual web request may be processed outside Australia in transit even though the stored data does not leave the Sydney region. All traffic is encrypted in transit and at rest.

Each workshop's data is isolated from every other workshop's at the database level.

We use a small number of service providers, each for one specific job:

• Neon (AWS Sydney) — database hosting and user authentication.
• Vercel — application hosting and delivery.
• Resend — sending transactional email such as invoices.
• Kudosity — sending and receiving SMS, such as inspection approval links.

If you connect Xero or your own Stripe account, data flows to those services under your own agreements with them. Vehivo never holds your customers' card details and never holds your funds — card payments go directly to your Stripe account.

Some records in Vehivo cannot be edited or deleted, by design and by law, and you should know which ones before you record them.

• Workplace safety records (Take 5, JSEA, return-to-service approvals) are permanent legal records under the Work Health and Safety Act 2011 and are retained for a minimum of five years. They can never be edited or deleted — a correction is recorded as a new document linked to the original.
• Vehicle condition reports are evidence of what a workshop told a customer about their vehicle and what the customer approved. They are retained for a minimum of seven years and cannot be edited once issued.
• Finalised invoices, recorded job costs and the audit log are likewise permanent. A finalised invoice is corrected with a credit note, never by changing the original.
• Everything else — bookings, draft quotes, customers, vehicles — can be cancelled or deleted, with a 30-day recovery window before permanent removal. The audit log entry recording that deletion survives.

If your workshop ends its subscription, you can export your data. We retain what the law requires us to retain and delete the rest.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you can ask for access to the personal information we hold about you, ask us to correct it, or make a complaint about how we have handled it. We will respond within 30 days.

If you are a vehicle owner whose details are in a workshop's Vehivo account, that workshop controls your data — please contact them first. If you cannot reach them, contact us and we will help.

Requests that conflict with the retention rules above are the one limit: we cannot delete a safety record or a finalised invoice, because we are not permitted to.

Privacy questions, access requests and complaints: support@vehivo.com.au.

If you are not satisfied with our response you can contact the Office of the Australian Information Commissioner.