Workshop Hub

Privacy Policy

Last updated 26 October 2026

This policy explains how Workshop Hub ("we", "us") handles personal information when you use workshophub.com.au, portal.workshophub.com.au, and related services. We design the product for Australian workshops and aim to handle information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

Who we are

Workshop Hub is a trading name of Driven Autocare Pty Ltd (ABN 50 677 682 996).

Workshop Hub is multi-tenant workshop software. Each shop (tenant) gets its own isolated workspace. For privacy questions, email support@workshophub.com.au.

What we collect

  • Account & billing: shop name, ABN (if provided), contact name, email, phone, plan, and Stripe customer / subscription identifiers. We do not store full card numbers — Stripe processes payments.
  • Workspace data you enter: customers, vehicles, bookings, job cards, quotes, invoices, parts lines, notes, photos you upload, staff logins / PINs, and shop settings (logo, labour rates, invoice headers, etc.).
  • Integrations you connect: for example accounting tokens and synced contacts/invoices/payments, supplier statement uploads, and Customer App invoice push details where configured.
  • Technical logs: IP address, browser/device type, approximate location from IP, and app usage logs needed to secure and debug the service.
  • Marketing site: basic analytics and cookies needed for the site to work; we do not sell personal information.
  • Live demo: when you open the public demo workshop we set a random session cookie (wd_demo_session) so we can see which workshop type people try, how long they stay, and whether they later start a free trial in the same browser. The cookie holds a random id only — no name, email or fingerprint. We also store coarse device type (phone / tablet / desktop), the page you entered from, and optional advertising campaign tags (UTM). You can clear site cookies in your browser to reset it. Demo traffic is never used for Meta ads events.
  • Advertising measurement (Meta Pixel): our website and sign-up page may use the Meta (Facebook) Pixel and Meta Conversions API to measure our ads. These set cookies (such as _fbp and _fbc) and send Meta page views and, when you create an account, a sign-up event with your IP address, browser details and your email and phone number in hashed (SHA-256) form, plus the ad campaign (UTM) details you arrived from. Meta Platforms, Inc. may use this under its own privacy policy. You can opt out of ad personalisation in your Meta ad preferences or by blocking third-party cookies. The pixel is never used inside the Workshop Hub apps or on workshop data pages.

How we collect it

  • Directly from you and your staff when you sign up, enter or import data, take photos, dictate voice notes, scan documents or connect an integration.
  • From your customers when they book online, approve quotes, pay invoices, message or call your shop.
  • From integrations you connect (for example accounting, supplier, review and social accounts) and from rego / vehicle lookups you run.
  • Automatically from your device and browser (technical logs, cookies) when you use the websites and apps.

Why we collect it

  • To provide the diary, job cards, invoices, mechanic app, status links, analytics and related features.
  • To bill subscriptions, prevent fraud, and provide support.
  • To improve reliability and security of the service.
  • To meet legal obligations (for example tax or law-enforcement requests where required by law).

AI features and third-party AI providers

Some optional features use third-party artificial-intelligence (AI) services. They are off until the shop owner or a manager chooses Allow in the AI data-sharing prompt (shown in the setup wizard or at the next owner/manager sign-in). Nothing is sent to an AI provider before that, and the choice can be withdrawn at any time in Settings → AI & privacy, which turns the AI features off.

What is sent: only what the feature you use needs — text you type or dictate (voice recordings), job notes, parts and labour lines, customer first names and vehicle details (make, model, rego) on the job, photos or documents you scan (supplier invoices, statements, rego papers), and review or message text you ask AI to reply to.

Who it is sent to:

  • OpenAI — AI assistant chat, voice-to-text for voice notes and voice parts, review and message reply drafts, and the optional AI phone receptionist.
  • Google (Gemini) — reading supplier invoices, statements and scanned documents, quote and job write-ups, parts suggestions, social captions, number-plate blurring and the website builder.
  • Perplexity — vehicle checks (recalls / common issues) and price estimates, using vehicle make, model and year only.
  • ElevenLabs — reading assistant answers aloud (the answer text only).
  • Requests are routed through Vercel AI Gateway (Vercel Inc.), our hosting provider.

How it is used: only to produce the result you asked for (for example a transcript, a draft reply or the lines read from an invoice), which is shown to you to review. Our agreements with these providers do not allow them to use your data to train their models, and they retain it only briefly for abuse monitoring where required. Each provider is contractually bound to protect personal information with security and confidentiality protections the same as or equal to those described in this policy and the Australian Privacy Principles.

How we store and share it

Data is hosted on reputable cloud providers (including Vercel for the app/marketing sites and a managed Postgres database). Tenant workspaces are logically isolated. We do not sell personal information.

We share information only with processors needed to run the product (for example Stripe for billing, the AI providers listed above if your shop allows AI features, email/SMS providers if you enable messaging, accounting software if you connect it, and hosting providers), or when the law requires it. Staff with support access may view workspace data only to help you when you ask.

Overseas disclosure

Some processors (hosting, Stripe, email) may store or process data in Australia and/or overseas. Where that happens we take reasonable steps so those parties handle information appropriately.

Retention

We keep workspace data while your account is active. After you cancel, a 30-day wind-down period lets you reactivate or resolve billing questions. Ninety (90) days after the workspace is closed we permanently delete operational data (customers, vehicles, jobs, invoices, quotes, photos, staff logins, messages and integration tokens), keeping only minimal billing/tax records we must retain. About 14 days before that deletion we email the owner a warning with a secure export link. You can request earlier deletion where practicable.

Security monitoring and abuse prevention

To protect the service and your workspace we log security-relevant events (such as sign-in attempts, IP address, the type of request and how often it is made) and use automated checks to spot unusual activity such as very high request rates, repeated failed logins, or large automated exports. When something looks abusive we may record an internal "abuse event", notify our administrators, throttle requests, or suspend access. This information is used only to keep the service secure, enforce our Terms, and meet legal obligations.

Automated access and AI training

Our websites, software and content are not licensed for scraping, bulk automated collection, or use to train artificial intelligence or machine-learning models. Our robots.txt asks AI-training crawlers not to collect content from our sites, while normal search-engine crawlers remain welcome on the marketing site. If your shop allows the built-in AI features, the data needed to produce the result is sent to the AI providers named in the "AI features and third-party AI providers" section above.

Google user data

This section explains how Driven Autocare Pty Ltd (trading as Workshop Hub, ABN 50 677 682 996) accesses, uses, stores and deletes data from Google when a workshop chooses to connect its Google Business Profile. Connecting Google is optional.

  • What we access: with your permission (the Google Business Profile scope https://www.googleapis.com/auth/business.manage) we access the Business Profile accounts and locations you manage (account and location names and ids), the Google reviews for those locations (reviewer display name, star rating, review text, date and any existing reply), and we publish review replies and "What's new" posts that you write or approve in Workshop Hub.
  • Why we use it: only to show your workshop's Google reviews in your Workshop Hub account, to post the replies you write to those reviews, and to publish the Business Profile posts you create in Workshop Hub. We do not use Google data for any other purpose.
  • How we store it: we store an OAuth refresh token and access token, and your Business Profile account and location names and ids, in your workshop's isolated workspace in our managed cloud database, encrypted in transit (TLS) and at rest by our hosting providers. Reviews are fetched from Google when you view them. We never receive or store your Google password.
  • Sharing: we do not sell Google user data, do not use it for advertising, and do not share it with anyone except the hosting providers that process it for us to run the service, or where required by law. No humans read your Google data unless you ask us to for support, it is needed for security or to comply with law.
  • Deletion: disconnect Google any time in Settings, then Integrations (or Reviews), which deletes the stored Google tokens and account and location details straight away. Deleting your workshop account also deletes them. You can also remove Workshop Hub's access at myaccount.google.com/permissions, or email support@workshophub.com.au and we will delete it within 30 days.
  • Limited Use: Workshop Hub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised AI or machine learning models.

Facebook

If a workshop connects a Facebook Page, we receive the Page name, Page id, and a token so we can list that Page's recommendations and ratings and post a reply the workshop writes. We store those reviews in that workshop's account. We do not post to the Page, read the workshop's private messages, or sell this information. Disconnecting Facebook in Settings, or deleting the account, removes the connection and the reviews we stored from it. Instructions are at workshophub.com.au/data-deletion.

Instagram

If you connect an Instagram professional account, Workshop Hub uses Instagram Login and the permissions you approve (instagram_business_basic and instagram_business_content_publish) to show your account name and profile picture and to publish the photo posts you choose to your account. We only publish when you press Publish. If we later add features such as replying to comments or direct messages, we will ask for those permissions separately and update this page first.

We store an access token, your Instagram user id and your username for your workshop only, so the connection keeps working. We do not store your Instagram password. We keep the token until you disconnect Instagram or delete your account. We do not sell this data, use it for advertising, or share it with anyone other than our hosting providers who process it for us. You can disconnect at any time in Settings, then Integrations, which deletes the stored token. Instructions are at workshophub.com.au/data-deletion.

The Workshop Hub app for iPhone and iPad

The Workshop Hub app lets a workshop's owner, managers, service advisors and mechanics use Workshop Hub on iPhone and iPad. It shows the same account and data as the website. We do not sell personal information, we do not show advertising, and we do not track you across other companies' apps or websites.

  • Information we handle: account details for workshop staff (name, email, phone, role, and the sign-in PIN or password in hashed form); information the workshop enters about its own customers and vehicles (names, contact details, addresses, registration numbers, service history, quotes and invoices); photos taken or chosen in the app and attached to jobs and inspections; voice notes recorded in the app to add job lines; messages the workshop sends to its customers by SMS or email; and technical data such as error and performance reports, which are tied to your account and device type, used only to keep the service working.
  • Data types the app collects (as declared in our App Store privacy details): all of it is linked to the workshop account it belongs to and is used only to run the app's features (App Functionality). It is not used for tracking or advertising.
    • Contact info: name, email address, phone number and physical address (staff, and the workshop's customers).
    • Financial info: job prices, quotes, invoices and supplier costs entered by the workshop. We do not collect card numbers; card payments are handled by Stripe.
    • User content: photos and videos attached to jobs, inspections and vehicles; audio data (voice notes sent for transcription); and other user content such as job notes, checklists and messages to customers.
    • Identifiers: user ID (your workshop login and session) and device ID (the notification token, if you turn notifications on).
    • Diagnostics: crash data, performance data and other diagnostic data (error and performance reports).
    We do not collect location, contacts, browsing or search history, health data, or usage data for analytics in the app.
  • Camera and photo library: used only when you tap a button such as "Take photo" or "Add photo". The photos you take or pick are uploaded to the job in your workshop's account. You can turn access off at any time in the iPhone or iPad Settings app.
  • Microphone: used only when you tap a microphone button, to record a voice note for a job or to ask the Workshop assistant a question by voice. The recording is sent securely to our AI voice-note transcription provider to turn it into text.
  • On your device: the app can show widgets, a job timer on the Lock Screen, Siri shortcuts, Spotlight results and (if the owner or manager switches it on) customer names when they call. These lists are stored on your iPhone only, are removed when you sign out or switch them off, and are not sent anywhere new. If you turn on Face ID lock, Face ID is handled by iOS; we never receive face data.
  • Push notifications: if you turn notifications on (office, manager and owner logins only), we store your device's notification token so we can send alerts such as a new booking request, a job marked done, or a customer reply. We use it for nothing else. You can switch notifications off in Settings, then Account, then Notifications, or in the iPhone or iPad Settings app. The token is removed when you sign out, delete your login, or Apple tells us it is no longer valid.
  • Staff deleting their own login: any staff member can delete their own login in the app and confirm with their PIN: Settings, then Account, then Delete my login (managers and owners), More, then Delete my login (office logins), or the Delete my login link on the Mechanic screen (mechanics). Sign-in stops immediately, and their name, email, phone, address, photo, pay details, PIN, shifts, leave and notification token are erased. The workshop keeps its own business records (jobs, notes, time entries and invoices), which then show the person as "Former staff member".
  • Owner deleting the workshop: the workshop owner can delete the whole workshop account in the app or on the website under Settings, then Account, then Delete account. An owner login cannot be removed on its own because it controls the workshop.
  • Who processes it for us: our hosting and database providers, Stripe (workshop subscription billing and card payments by a workshop's customers), SMS and email delivery providers, AI providers that transcribe voice notes (AI voice-note transcription) or suggest job lines, Apple (to deliver notifications), and an error and performance monitoring provider. They may only use the data to provide their service to us.
  • Help and requests: see our Support page or email support@workshophub.com.au.

The Workshop Hub app for Android

The Workshop Hub app for Android phones and tablets shows the same account and data as the website. We do not sell personal information, we do not show advertising, and we do not track you across other companies' apps or websites. The app has no sign-up and no in-app purchases: your workshop owner creates your login.

  • Information we handle: the same information as described for the mobile app above: staff account details (name, email, phone, role, and the sign-in PIN or password in hashed form), the workshop's own customer, vehicle, job, quote and invoice records, photos you take or choose, voice notes you record, messages the workshop sends to its customers, and error and performance reports. It is all linked to the workshop account it belongs to and used only to run the app's features. It is encrypted in transit (HTTPS).
  • Camera, microphone and fingerprint or face unlock: used only when you tap a button that needs them (Take photo, a microphone button, or if you switch on app lock). Photos are chosen with the Android photo picker, so the app does not read your gallery. Fingerprint and face data are handled by Android; we never receive them. You can turn each permission off in Android Settings, Apps, Workshop Hub.
  • Deleting your data: any staff member can delete their own login in the app (Settings, then Account, then Delete my login; office logins: More, then Delete my login; mechanics: the Delete my login link on the Mechanic screen). Workshop owners can delete the whole workshop account in the app or on the website under Settings, then Account, then Delete account. You can also ask us to delete your data without signing in: see workshophub.com.au/data-deletion or email support@workshophub.com.au.

Access, correction and deletion

You can update most shop data inside the product. Workshop owners can delete their account in-app or on the website under Settings → Account (Account & billing on the website) → Delete account, and any staff member can delete their own login in the app under Settings → Account → Delete my login (office logins: More → Delete my login). That cancels any Stripe subscription, disables login, and soft-deletes the workspace; data is retained briefly for backups and legal requirements, then deleted or de-identified. For a copy of your workspace data, a correction we cannot make in-app, or help with deletion, email support@workshophub.com.au. We will respond within a reasonable time. If you believe we have mishandled your information you may contact the Office of the Australian Information Commissioner (OAIC).

Security

We use HTTPS, access controls, and tenant isolation. No method of transmission or storage is perfectly secure; please use strong passwords / PINs and limit staff access.

Children

The service is for business use by workshops. It is not directed at children under 16.

Changes

We may update this policy from time to time. The "Last updated" date above will change when we do. Continued use of the service after a material update means you accept the revised policy.

Contact

Privacy requests: support@workshophub.com.au

This policy is provided for transparency. It is not legal advice. Have a qualified lawyer review it before you rely on it for regulated or high-risk use.