Privacy Policy

1. Introduction

eRideList is a platform for Australian members to buy, sell, hire or service e-rides, electric vehicles and EV-related services. It is operated by eRideList (ABN 14 218 299 030), registered under the business name ERIDELIST and based in New South Wales, Australia.

We respect your privacy and are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to everyone who uses the site — whether you hold an account, post an ad, or simply browse.

Businesses with an annual turnover of $3 million or less are generally exempt from the Privacy Act. Whether or not that exemption currently applies to us, we have chosen to handle personal information in accordance with the APPs and we hold ourselves to this policy.

2. Personal information we collect

We collect only what the marketplace actually needs to work:

• Account information — your name, email address and password. Passwords are stored only as a one-way hash, never in readable form.
• Profile and contact details — your suburb or postcode, and optionally a phone number, business name, shop address and website if you list as a business.
• Listing content — everything you enter when you post an ad, including photos, descriptions, prices, vehicle details and the general location of the item.
• Messages — enquiries and replies sent between buyers and sellers through the site. If you press "Suggest replies" while writing one, the recent messages in that chat are sent to our AI provider to draft the suggestions — see section 13.
• Ratings and reviews you leave for, or receive from, other members.
• Support enquiries — what you send us through the contact form or by email, and our replies.
• Technical information — IP address, browser and device type, pages visited, and approximate location derived from your IP address, collected automatically through server logs and cookies.

We do not collect sensitive information — health, racial or ethnic origin, political or religious beliefs, sexual orientation, criminal record or biometric data — and we ask that you do not put it in an ad, a review or a message. If you send it to us anyway, we will delete it once we have dealt with your enquiry.

We never see your payment details. We do not process payments, hold deposits or charge fees, so we never collect or store card or bank account numbers.

3. How we collect it

Almost everything we hold comes directly from you — when you create an account, post or edit an ad, message another member, leave a review, change your account settings, or contact support.

If you choose to sign in with Google or Facebook, we receive your name and email address from that provider so we can create or match your account. We do not receive your password, your contacts, or anything you post there, and we do not post anything on your behalf. That provider's own privacy policy governs what they do with the fact that you signed in.

Technical information is collected automatically as you use the site. Occasionally we receive information about you from someone else — for example when another member reports one of your ads.

4. How we use it

• To create and administer your account and keep you signed in.
• To publish your ads and let buyers find and contact you about them.
• To deliver messages between buyers and sellers.
• To review ads before they go live, and to enforce our Terms and Conditions — including removing unsafe, unlawful, fraudulent or non-compliant ads.
• To send you transactional email you have asked for or would expect: listing approval and rejection notices, expiry and renewal reminders, new-message notifications, password resets, and replies to your support enquiries.
• To detect, investigate and prevent scams, fraud, abuse and misuse of the site.
• To keep the site secure and available, and to understand how it is used so we can improve it.
• To comply with our legal obligations and respond to lawful requests.

We do not use your personal information for any purpose that you would not reasonably expect from the list above, unless you agree or the law requires it.

5. Who can see your information

Other members

A published ad is public. Anyone on the internet can see the ad content, photos, the suburb or region you selected, your display name and your seller rating. Search engines can index it.

Reviews you receive are public. A seller's page shows their average rating, and anyone can open the full list of reviews behind it: the stars, the written comment, the date and which listing the trade was about. A review is not shown with the name of the person who wrote it. So a review you leave becomes publicly readable, but is not publicly attributed to you — though the person you reviewed sees your name on it in the chat where you left it, as they always have.

Your phone number and email address are not shown publicly by default. They appear on your ads only if you deliberately turn on "Show my phone and email on my ads" in your account settings. If you leave that off, buyers reach you through in-app messaging instead. Anything you write into an ad description or a message is visible to whoever reads it, so please think before publishing personal details there.

Our staff and your chats

Your chats on eRideList are private between you and the other member. Our staff do not browse them. An eRideList administrator may open a chat, and the messages and photos in it, only when that is needed to investigate a report, a complaint or dispute between members, or suspected scams, fraud or other unlawful activity, or to respond to a lawful request from police, a regulator or a court. This is a use of your information for a purpose related to running the marketplace, and one you would reasonably expect for those reasons (APP 6). Each time a chat is opened, the administrator, the member, the reason and the time are recorded in an access log. Administrator accounts are limited to the people who need them. Chats on WhatsApp are not on our systems and we cannot see them.

WhatsApp, if you choose to offer it

A seller can optionally tick WhatsApp as a Contact Channel on their own ad. Doing so is their choice to make their phone number reachable by that specific channel — it does not turn on the general "Show my phone and email on my ads" setting described above, and their number still is not printed as text anywhere on the ad page; it is only used to build the "Use WhatsApp" button a buyer can choose to click.

This works in both directions inside a chat. If you tick WhatsApp in your account settings and save a phone number there, the person on the other side of a chat you are already in gets the same button for you — so a seller you have messaged can reach you on WhatsApp, not only the other way round. The same protections apply: your number is never printed as text, only used to build the button, and only someone you are already in a chat with ever sees it. Unticking WhatsApp in your account settings, or clearing the number there, removes the button.

Once you (buyer or seller) follow that button into WhatsApp, you've left eRideList: that chat, and any phone number or other information exchanged there, is handled under WhatsApp's own privacy policy, not this one. We keep no copy of it and cannot see, store or act on anything sent there.

Service providers

We use a small number of providers to run the site:

• Supabase — database, file storage for ad photos, and account authentication.
• Resend — delivery of transactional email.
• Groq — the AI model behind the optional "suggest" buttons described in section 13. It receives only the text needed for the suggestion at the moment you press the button, and only then.
• Google and Facebook — only if you choose to sign in with one of them.
• Our hosting provider — serving the website itself.

These providers may only handle your information to provide their service to us. We do not sell, rent or trade your personal information, and we do not disclose it to anyone for their own marketing.

No advertising or analytics trackers

We run no third-party analytics and no advertising trackers — no Google Analytics, no advertising pixels, no cross-site profiling. Nobody is building a picture of you from your use of this site. See our Cookie Policy for the small number of cookies we do set.

Others

We may disclose information where we are required or permitted by law — for example to police or a regulator in response to a lawful request, to the ACCC or a state fair trading body, where disclosure is necessary to investigate suspected fraud, or to prevent a serious threat to someone's life, health or safety.

6. Sending information overseas

Some of our providers store or process information outside Australia. The countries in which recipients are likely to be located are:

• Database, authentication and photo storage — Australia (Supabase, AWS ap-southeast-2 Sydney region).
• Email delivery — United States (Resend, transactional email delivery).
• AI suggestions — United States (Groq, the optional “suggest” features).

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through our contracts with them, and we remain accountable to you for how they handle it.

7. Email and direct marketing

Most email we send is transactional — it tells you something about your own account or ads. You cannot opt out of essential messages such as a rejection notice, an expiry reminder or a password reset while you hold an account, because they are how the service works.

Optional notifications, such as an email when you receive a new message, are controlled from your account settings and can be switched off at any time. A single chat can also be muted from your inbox, which stops the emails for that one thread without changing the setting for everything else.

Read receipts. When you open a chat, the messages waiting in it are marked as read, and the person who sent the most recent one sees "Seen" against it. There is no way to turn this off short of not opening the message.

If we ever send promotional email, it will identify us clearly and include a working unsubscribe link that keeps working for at least 30 days after the message is sent. We action unsubscribe requests within 5 working days, at no cost to you, as required by the Spam Act 2003 (Cth). You can also opt out at any time by emailing support@eridelist.com.au.

8. Cookies

We use cookies and similar browser storage to keep you signed in and to remember your preferences. We do not use them to track you across other websites. Details are in our Cookie Policy.

9. Security

Information is transmitted over encrypted connections and stored in access-controlled systems. Passwords are stored as one-way hashes. Access to the production database is limited to those who need it to run the site.

No online service can promise perfect security, and we do not. We take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure, as APP 11 requires.

10. How long we keep it

We keep your account, ads and messages for as long as your account is open. We do not automatically delete inactive accounts.

After an account is closed, or an ad comes down, we may retain records — including ads, messages, reviews, moderation decisions and complaint records — for up to six years. That is the limitation period for contract and negligence claims in New South Wales, and keeping those records is how we are able to respond to a dispute between members, a safety or fraud investigation, or a lawful request from police or a regulator. We rely on that reason, not on a general preference to keep things: APP 11.2 requires us to destroy or de-identify personal information once we genuinely no longer need it, and we do.

Separately, records that tax or corporations law requires us to keep are kept for as long as that law requires — generally five years for records explaining a business transaction, and seven years for a company's financial records. These are our own financial records, not your messages.

Sign-in security records. To protect accounts, we record failed and blocked sign-in attempts (the email address tried, the IP address and the time) and delete these records after 90 days.

Sold ads come off the site automatically at the end of their 30-day window and their photos are deleted, so an ad that has served its purpose does not sit on the site indefinitely.

11. Data breaches

If we suspect a data breach we assess it within 30 days. If a breach is likely to result in serious harm to anyone whose information we hold, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in line with the Notifiable Data Breaches scheme.

12. Your rights: access, correction and deletion

You can see and change most of your information yourself at any time from your account settings, My Ads and Inbox pages.

• Access. You can ask what personal information we hold about you and get a copy of it. There is no charge for making a request. We respond within 30 days, and may need to verify your identity first.
• Correction. If something we hold is inaccurate, out of date, incomplete, irrelevant or misleading, tell us and we will fix it.
• Deletion. There is no self-service delete button. To have your account or your data deleted, email support and we will handle it as a request. We will close your account and remove your ads, but we reserve the right to retain your ad history, messages and moderation records for up to six years on the basis set out in section 10 — so that we can still answer a dispute, an investigation or a lawful request that concerns dealings you were part of. If we keep something, we will tell you what and why.
• Anonymity. You can browse the site without an account, and without telling us who you are.

Send any request to support@eridelist.com.au. If we refuse a request we will tell you why in writing and explain how to complain about that decision.

13. Automated decisions

Decisions that affect you are made by a person, not a machine. Every ad is reviewed by a human before it is published, and every rejection, suspension or account closure is a human decision that you can ask us to explain.

Some routine housekeeping is automated, and none of it involves any judgement about you: listings expire 30 days after approval, renewal reminders go out three days before that, and sold ads are removed at the end of their window. Nothing about a person's account is decided or deleted automatically.

We do not use profiling, scoring or artificial intelligence to make decisions about you. Nothing about your account, your ads or your access to the site is decided by a machine. If that ever changes we will update this policy to say what is decided automatically and what information is used, as required by the automated decision-making transparency obligation that applies from 10 December 2026.

We do use AI in one narrow way, and only when you ask for it. Several places on the site have an optional "suggest" button — for a reply in a chat, for the wording of a review, for an ad description. Pressing one sends the text that suggestion needs to Groq, an AI provider in the United States:

• For a suggested reply, the recent messages in that one chat, plus the ad's title.
• For a suggested review, the ad's title and the star rating you picked — not your identity, and not the other person's.
• For a suggested ad description, what you have typed so far.

What comes back is a draft shown only to you, which you can use, edit or ignore — nothing is sent to anyone else, published, or acted on until you press send or save yourself. Nothing is sent to Groq unless you press one of those buttons: if you never use them, none of your messages ever leave the site this way. We do not send your name, email address or phone number.

14. Children and young people

Accounts are for people aged 18 and over. You must be 18 to register, post an ad or send a message. Anyone may browse the public ads.

We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it and close any account.

15. Complaints

If you think we have mishandled your personal information, email support@eridelist.com.au with "Privacy complaint" in the subject line and tell us what happened. We will acknowledge your complaint, investigate it, and give you a written response within 30 days.

If you are not satisfied with our response, or we do not respond in time, you can escalate to the Office of the Australian Information Commissioner at oaic.gov.au. The OAIC's enquiries line is 1300 363 992. The OAIC normally expects you to raise the issue with us first and give us a reasonable time — usually 30 days — to respond.

16. Changes to this policy

We may update this policy as the site or the law changes. The date at the top shows when it was last revised. If a change materially affects how we handle your information, we will tell you by email or with a notice on the site before it takes effect.

17. Contact us

For any privacy question or request, email support@eridelist.com.au. General support runs through the contact form, which needs an account — a privacy request deliberately does not, because the person making one may be asking us to delete the very account they would otherwise have to sign in to. This address reaches us either way. We do not operate a phone line. If you need a postal address — to serve a document, or because you would rather write to us — ask by email and we will provide one.