Privacy Policy

1. Introduction

eRideList is a platform for Australian users to buy, sell, rent or service e-rides, electric vehicles and EV-related services. It is operated by Kok Kiong Lau trading as eRideList (ABN 14 218 299 030), registered under the business name ERIDELIST and based in New South Wales, Australia.

We respect your privacy and are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to everyone who uses the site — whether you hold an account, post a listing, or simply browse.

Businesses with an annual turnover of $3 million or less are generally exempt from the Privacy Act. Whether or not that exemption currently applies to us, we have chosen to handle personal information in accordance with the APPs and we hold ourselves to this policy.

2. Personal information we collect

We collect only what the marketplace actually needs to work:

• Account information — your name, email address and password. Passwords are stored only as a one-way hash, never in readable form.
• Profile and contact details — your suburb or postcode, and optionally a phone number, business name, shop address and website if you list as a business.
• Listing content — everything you enter when you post an ad, including photos, descriptions, prices, vehicle details and the general location of the item.
• Messages — enquiries and replies sent between buyers and sellers through the site.
• Ratings and reviews you leave for, or receive from, other users.
• Support enquiries — what you send us through the contact form or by email, and our replies.
• Technical information — IP address, browser and device type, pages visited, and approximate location derived from your IP address, collected automatically through server logs and cookies.

We do not collect sensitive information — health, racial or ethnic origin, political or religious beliefs, sexual orientation, criminal record or biometric data — and we ask that you do not put it in a listing, a review or a message. If you send it to us anyway, we will delete it once we have dealt with your enquiry.

We never see your payment details. We do not process payments, hold deposits or charge fees, so we never collect or store card or bank account numbers.

3. How we collect it

Almost everything we hold comes directly from you — when you create an account, post or edit a listing, message another user, leave a review, change your account settings, or contact support.

If you choose to sign in with Google or Facebook, we receive your name and email address from that provider so we can create or match your account. We do not receive your password, your contacts, or anything you post there, and we do not post anything on your behalf. That provider's own privacy policy governs what they do with the fact that you signed in.

Technical information is collected automatically as you use the site. Occasionally we receive information about you from someone else — for example when another user reports one of your listings.

4. How we use it

• To create and administer your account and keep you signed in.
• To publish your listings and let buyers find and contact you about them.
• To deliver messages between buyers and sellers.
• To review listings before they go live, and to enforce our Terms and Conditions — including removing unsafe, unlawful, fraudulent or non-compliant listings.
• To send you transactional email you have asked for or would expect: listing approval and rejection notices, expiry and renewal reminders, new-message notifications, password resets, and replies to your support enquiries.
• To detect, investigate and prevent scams, fraud, abuse and misuse of the site.
• To keep the site secure and available, and to understand how it is used so we can improve it.
• To comply with our legal obligations and respond to lawful requests.

We do not use your personal information for any purpose that you would not reasonably expect from the list above, unless you agree or the law requires it.

5. Who can see your information

Other users

A published listing is public. Anyone on the internet can see the listing content, photos, the suburb or region you selected, your display name and your seller rating. Search engines can index it.

Your phone number and email address are not shown publicly by default. They appear on your listings only if you deliberately turn on "Show my phone and email on my listings" in your account settings. If you leave that off, buyers reach you through in-app messaging instead. Anything you write into a listing description or a message is visible to whoever reads it, so please think before publishing personal details there.

Service providers

We use a small number of providers to run the site:

• Supabase — database, file storage for listing photos, and account authentication.
• Resend — delivery of transactional email.
• Google and Facebook — only if you choose to sign in with one of them.
• Our hosting provider — serving the website itself.

These providers may only handle your information to provide their service to us. We do not sell, rent or trade your personal information, and we do not disclose it to anyone for their own marketing.

No advertising or analytics trackers

We run no third-party analytics and no advertising trackers — no Google Analytics, no advertising pixels, no cross-site profiling. Nobody is building a picture of you from your use of this site. See our Cookie Policy for the small number of cookies we do set.

Others

We may disclose information where we are required or permitted by law — for example to police or a regulator in response to a lawful request, to the ACCC or a state fair trading body, where disclosure is necessary to investigate suspected fraud, or to prevent a serious threat to someone's life, health or safety.

6. Sending information overseas

Some of our providers store or process information outside Australia. The countries in which recipients are likely to be located are:

• Database, authentication and photo storage — Australia (Supabase, AWS ap-southeast-2 Sydney region).
• Email delivery — United States (Resend, transactional email delivery).

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through our contracts with them, and we remain accountable to you for how they handle it.

7. Email and direct marketing

Most email we send is transactional — it tells you something about your own account or listings. You cannot opt out of essential messages such as a rejection notice, an expiry reminder or a password reset while you hold an account, because they are how the service works.

Optional notifications, such as an email when you receive a new message, are controlled from your account settings and can be switched off at any time.

If we ever send promotional email, it will identify us clearly and include a working unsubscribe link that keeps working for at least 30 days after the message is sent. We action unsubscribe requests within 5 working days, at no cost to you, as required by the Spam Act 2003 (Cth). You can also opt out at any time by emailing support@eridelist.com.au.

8. Cookies

We use cookies and similar browser storage to keep you signed in and to remember your preferences. We do not use them to track you across other websites. Details are in our Cookie Policy.

9. Security

Information is transmitted over encrypted connections and stored in access-controlled systems. Passwords are stored as one-way hashes. Access to the production database is limited to those who need it to run the site.

No online service can promise perfect security, and we do not. We take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure, as APP 11 requires.

10. How long we keep it

We keep your account, listings and messages for as long as your account is open. We do not automatically delete inactive accounts.

After an account is closed, or a listing comes down, we may retain records — including listings, messages, reviews, moderation decisions and complaint records — for up to six years. That is the limitation period for contract and negligence claims in New South Wales, and keeping those records is how we are able to respond to a dispute between users, a safety or fraud investigation, or a lawful request from police or a regulator. We rely on that reason, not on a general preference to keep things: APP 11.2 requires us to destroy or de-identify personal information once we genuinely no longer need it, and we do.

Separately, records that tax or corporations law requires us to keep are kept for as long as that law requires — generally five years for records explaining a business transaction, and seven years for a company's financial records. These are our own financial records, not your messages.

Sold listings come off the site automatically at the end of their 30-day window and their photos are deleted, so an ad that has served its purpose does not sit on the site indefinitely.

11. Data breaches

If we suspect a data breach we assess it within 30 days. If a breach is likely to result in serious harm to anyone whose information we hold, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in line with the Notifiable Data Breaches scheme.

12. Your rights: access, correction and deletion

You can see and change most of your information yourself at any time from your account settings, My Ads and Inbox pages.

• Access. You can ask what personal information we hold about you and get a copy of it. There is no charge for making a request. We respond within 30 days, and may need to verify your identity first.
• Correction. If something we hold is inaccurate, out of date, incomplete, irrelevant or misleading, tell us and we will fix it.
• Deletion. There is no self-service delete button. To have your account or your data deleted, email support and we will handle it as a request. We will close your account and remove your listings, but we reserve the right to retain your listing history, messages and moderation records for up to six years on the basis set out in section 10 — so that we can still answer a dispute, an investigation or a lawful request that concerns dealings you were part of. If we keep something, we will tell you what and why.
• Anonymity. You can browse the site without an account, and without telling us who you are.

Send any request to support@eridelist.com.au. If we refuse a request we will tell you why in writing and explain how to complain about that decision.

13. Automated decisions

Decisions that affect you are made by a person, not a machine. Every listing is reviewed by a human before it is published, and every rejection, suspension or account closure is a human decision that you can ask us to explain.

Some routine housekeeping is automated, and none of it involves any judgement about you: listings expire 30 days after approval, renewal reminders go out seven days before that, and sold listings are removed at the end of their window. Nothing about a person's account is decided or deleted automatically.

We do not use profiling, scoring or artificial intelligence to make decisions about you. If that ever changes we will update this policy to say what is decided automatically and what information is used, as required by the automated decision-making transparency obligation that applies from 10 December 2026.

14. Children and young people

Accounts are for people aged 18 and over. You must be 18 to register, post a listing or send a message. Anyone may browse the public listings.

We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it and close any account.

15. Complaints

If you think we have mishandled your personal information, email support@eridelist.com.au with "Privacy complaint" in the subject line and tell us what happened. We will acknowledge your complaint, investigate it, and give you a written response within 30 days.

If you are not satisfied with our response, or we do not respond in time, you can escalate to the Office of the Australian Information Commissioner at oaic.gov.au. The OAIC's enquiries line is 1300 363 992. The OAIC normally expects you to raise the issue with us first and give us a reasonable time — usually 30 days — to respond.

16. Changes to this policy

We may update this policy as the site or the law changes. The date at the top shows when it was last revised. If a change materially affects how we handle your information, we will tell you by email or with a notice on the site before it takes effect.

17. Contact us

For any privacy question or request, email support@eridelist.com.au. We handle support by email only and do not operate a phone line. If you need a postal address — to serve a document, or because you would rather write to us — ask by email and we will provide one.