PRIVACY
Privacy Policy
Who this policy is for
This policy explains how Power OPE Pty Ltd (ABN 87 692 598 486) (“PowerOPE”, “we”, “us”) handles personal information when you use the PowerOPE website at www.powerope.ai, the PowerOPE dealer application, and PowerOPE Central. We are an Australian business. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It covers people who visit our website, people at a dealership who have a PowerOPE user account (including people who sign in with Google or Microsoft), and people who contact us about the service. Dealerships also store their own customers’ information in PowerOPE. For that information, the dealership decides why it is collected and how it is used. PowerOPE stores and processes it so the dealership can run the service. A dealership customer who wants to access or correct their information should contact the dealership. We help the dealership respond.
Information we collect
Website. If you browse www.powerope.ai, we may collect technical data such as your IP address, browser type, and pages viewed, and anything you send us through a contact form (name, email, phone, and your message). Staff accounts. When a dealership creates a user, or when you sign in, we collect and store the details needed to run the account: name, email address, a hashed password if you use one, phone number if provided, profile image, timezone, locale, role and permissions, sign-in history, and security events such as failed sign-in attempts. Session records include a hashed refresh token, IP address, and user agent.
Sign in with Google. If you choose Sign in with Google, we request only the OpenID Connect scopes openid, email, and profile. From Google we receive your Google account identifier, email address, name, and profile photo if Google provides one, and whether Google has verified the email. We use that information to find your existing PowerOPE user and sign you in, or to create a user when a dealership administrator has turned on automatic account creation. We store the Google account identifier against your user so later sign-ins match the same person. We do not ask Google for access to your Gmail, Drive, Calendar, or contacts. Google user data received this way is used only to provide and secure sign-in to PowerOPE. We do not sell it, use it for advertising, or use it to train generalised artificial intelligence or machine learning models. We do not share it with third parties except the service providers listed below, and only so they can host and protect the service. This use is limited to the practices described in the Google API Services User Data Policy, including the Limited Use requirements.
Sign in with Microsoft works the same way for a Microsoft account: identifier, email, and name, used only to sign you in.
Dealership business records. The application stores whatever the dealership enters: customer and supplier contacts, staff profiles, workshop jobs, invoices, payments metadata, product images, and messages the dealership sends. Payment card numbers are collected by the dealership’s payment provider (Square or Stripe), not stored by PowerOPE as card data. Support and diagnostics. If error reporting is enabled, we may receive technical logs (such as through Sentry) to fix faults. We do not use those logs to build advertising profiles.
How we use it
We use personal information to provide the service, authenticate users, remember sessions, send transactional email the dealership triggers, look up and validate addresses, take payments through the dealership’s connected provider, secure the service, bill the dealership for its subscription, and respond to support requests. We use website enquiries to answer them. We do not sell personal information.
Who we share it with
We share information with service providers who process it on our instructions: DigitalOcean for application hosting, database, and file storage; Google for sign-in and address lookup when enabled; Microsoft for sign-in when enabled; Mailgun for email delivery; Square and Stripe for in-person and online payments for the dealership; AddressFinder for Australian address lookup when enabled; and Sentry for error diagnostics when enabled.
PowerOPE Central, our control plane, provisions each dealership’s application and can read health and metrics. It does not hold the dealership’s customer database. During Google or Microsoft sign-in, the browser passes through Central and is sent back to the dealership’s site. Central does not exchange the sign-in code or store the dealership’s tokens. A dealership’s staff can see the records their permissions allow. We may also disclose information if the law requires it, or to protect the security of the service. Some providers store data outside Australia, including in the United States. We take reasonable steps to see that overseas recipients handle personal information consistently with the Australian Privacy Principles.
Access and correction
You can ask us for the personal information we hold about you, and ask us to correct it, by emailing privacy@powerope.ai. We may need to confirm you are the person the information is about. If we refuse a request, we will explain why, except where the law allows us not to. If your information is in a dealership’s PowerOPE site because you are that dealership’s customer, contact the dealership first. We will assist them. You can also complain to the Office of the Australian Information Commissioner at oic.gov.au if you are not satisfied with our response.
How long we keep it
We keep staff account and dealership records for as long as the dealership’s subscription is active, and for a limited period after it ends so we can restore a site on request, meet tax and audit duties, and resolve disputes. We then delete or de-identify the information. Server logs and session records are kept for a shorter period. Hashed passwords and sign-in tokens are kept only while the account or session needs them.
Security
Each dealership has its own database. Access to the application is limited by user roles. Payment-provider tokens and similar secrets are encrypted. Sign-in sessions use short-lived access tokens and rotating refresh tokens stored as hashes. No method of transmission or storage is perfectly secure.
Changes
We will post updates on this page and change the date at the top. If a change is material, we will give dealership administrators reasonable notice in the product or by email.
Contact
Power OPE Pty Ltd · Email: privacy@powerope.ai