This is a draft prepared by the development team for internal use. It has not been reviewed by a lawyer and must not be relied on or published as final. It is written to be reviewed: the reasoning behind each clause is set out in the notes at the end.
Version 2026-08-25
This policy explains what personal information the FreightNotice workspace at my.freightnotice.com collects, where it is stored and hosted, and what we do — and will not do — with it. It sits alongside the Terms of use and the Contribution licence.
1. What this workspace is, and is not
1.1 The workspace has been prepared for internal use — it was built to run our own freight buying — and is made available to other freight buyers as it stands.
1.2 It is not a paid service. There are no fees, no subscriptions and no advertising in this version, and we earn nothing from the data you record.
1.3 Your data is not sold to third parties. Not your personal information, not your freight records, not the emails you forward. Clause 6 sets this out in full.
2. What we collect
2.1 Account details. Your email address, and your name if you provide one. If you sign in with Microsoft or Google, we receive the name, email address and profile picture that provider supplies. We hold no passwords, because there are none — sign-in is by emailed link or single sign-on.
2.2 Business details. Your Australian Business Number, the registered entity name returned when we check it, your own description of what your business does, and the names and addresses of the sites you dispatch from.
2.3 Freight records. The carriers, lanes, rates, minimum charges, fuel levy notices, accessorial charges, toll rules and pallet specifications you record. These are mostly facts about businesses rather than people, but the names and contact details of carrier staff can appear in them.
2.4 Forwarded email, only if you turn email ingestion on. Messages sent to your forwarding address — sender, date, subject and text — together with the raw original, kept as the evidence behind any rate or levy recorded from them. We only ever see messages sent to that address. We do not connect to, and cannot read, your mailbox.
2.5 Technical records. Each sign-in session records the IP address and browser identification it was created from, so that unexpected access has a trace. Our hosting providers keep routine, short-lived request logs.
2.6 Acceptance records. Which version of the terms you accepted, and when.
3. Where your data is stored and hosted
3.1 Everything you record is held in a single database hosted in Sydney, Australia, including the raw originals of forwarded emails. Nothing you record is stored at rest anywhere else.
3.2 The application runs on third-party cloud infrastructure, with its server functions pinned to Sydney. Your requests are served from Australia, not routed through another continent.
3.3 Email in both directions passes through our email provider's network. An inbound message is handed to our processing function and written straight to our database; the provider does not keep a copy. Sign-in links are sent out the same way.
3.4 Our hosting and email providers are United States–owned companies operating global networks. The data you record stays at rest in Sydney, but operational metadata — request logs, DNS queries, email delivery records — may be processed outside Australia in the ordinary running of those networks. This policy does not name the providers, so that changing one does not require changing the policy; we will tell you who they are if you ask.
3.5 The public diesel price series shown against your figures is fetched by our servers from freightnotice.com. No personal information is sent with that request.
4. What we use it for
We use the information in clause 2 to:
- (a) operate the workspace and calculate your own freight figures;
- (b) sign you in, by emailing you a link;
- (c) verify your ABN against the Australian Business Register, and keep the
- register's response as evidence of the check;
- (d) hold the notices you forward as evidence, so that when a carrier disputes
- a levy, the notice they sent is the argument;
- (e) keep the service secure, which is what the session records in 2.5 exist
- for.
We use it for nothing else. There is no advertising to target and no profile built about you.
5. Who can see it
5.1 You, and the members of your organisation. No other user can see your data — access is enforced in the database itself, not only in the application, and is covered by automated tests.
5.2 The service providers in clause 3 host and transmit it as part of running the workspace. They act on our instructions and have no right to use your data for their own purposes.
5.3 The Australian Business Register receives your ABN when we check it.
5.4 Microsoft or Google know you signed in — but only if you chose to sign in with them.
5.5 A court, regulator or law may require disclosure. We would disclose the minimum required.
6. What we do not do
6.1 We do not sell your personal information or the data you record, to anyone.
6.2 We do not share your data with third parties for their marketing, and we do not disclose it in any form that identifies you or your business except as clause 5 says.
6.3 We do not use your data to train machine-learning models.
6.4 We do not show any user a figure derived from another user's data. There is no aggregation layer in this version. The only commercial use the Contribution licence would ever permit is de-identified aggregate derived outputs drawing on at least five separate contributors — and none are produced. Personal information is never part of that licence at all.
6.5 We do not run analytics scripts, advertising trackers or tracking pixels. See clause 7.
7. Cookies
The workspace sets one kind of cookie: the session that keeps you signed in. There are no advertising cookies, no third-party analytics cookies and no cross-site tracking of any kind.
8. Access, correction and export
8.1 Most of what we hold about you is visible on your settings screen, and you can correct it there.
8.2 You may export everything you have recorded at any time, in full, in a machine-readable form, at no cost and without asking us.
8.3 For anything not shown on a screen, write to us at the address in clause 12 and we will provide or correct it promptly.
9. Retention and deletion
9.1 We keep your data while your account is open. Forwarded originals are kept for as long as the account is, because they are the evidence.
9.2 If you close your account we will delete your data within 30 days, except where we are required to keep it. Export first.
9.3 Deleted data can persist briefly in database restore snapshots, which expire on a rolling window.
10. Security
- No passwords are stored anywhere, because none exist to store.
- Every tenant's rows are isolated by row-level security enforced in the
- database itself, and the application connects under a restricted role that
- cannot bypass it. Automated tests prove the isolation on every build.
- Data is encrypted in transit, and the database provider encrypts storage at
- rest.
11. Data breaches
If we suspect a breach involving personal information we will assess it, and where it is likely to result in serious harm we will notify the affected people and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) requires, without unreasonable delay.
12. Questions and complaints
Write to privacy@freightnotice.com. If you are not satisfied with our answer, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.
13. Changes to this policy
We may change this policy. For material changes we will give at least 30 days' notice. Each version carries its date at the top, so you can always see what you are reading.
Notes for the reviewing solicitor
Not part of the policy.
- Operating entity. As with clause 10.1 of the terms, "we" is a placeholder
- pending instructions on the operating entity.
- Clause 1. The internal-use and not-a-paid-service declarations are
- deliberate: the workspace is free, carries no advertising, and no personal
- information is bought or sold, which we understand bears on whether the
- operator is an APP entity at all under the small business operator provisions
- (s 6D). The policy is drafted to meet the APPs regardless. Please confirm the
- declarations do what we intend, and whether the position holds as third-party
- businesses take up the workspace.
- Clause 2.4. Forwarded carrier emails contain third-party personal
- information — carrier staff names, addresses and direct numbers. APP 5 notice
- cannot practically be given to those individuals; clause 5.5 of the terms
- places the right to forward on the user. Please advise whether more is
- needed.
- Clause 3 (cross-border, and unnamed providers). Recorded data is at rest
- in Sydney; the providers' operational metadata is processed globally. The
- providers are deliberately not named: the country disclosure is the point,
- and naming them would turn an infrastructure change into a policy change.
- Their names are given on request under 3.4. Please advise the APP 8 position,
- and whether disclosing the country but not the recipients satisfies APP 1.4.
- Clause 9.3. The database provider retains point-in-time restore
- snapshots on a rolling window. We would rather disclose this than imply
- deletion is instantaneous everywhere.
- Clause 12. privacy@freightnotice.com does not exist yet. It must be live
- before this policy is published.