Privacy Policy

This document is provided for information and does not constitute legal advice.

1. About this policy

This Privacy Policy explains how Modern DMS ("MDMS", "we", "us", "our"), based in Queensland, Australia, handles personal information in connection with the Modern Dealer Management System website and software-as-a-service platform (the "Service").

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle health, tax file number, or other sensitive information on behalf of a customer, we do so only as permitted by law and by our agreement with that customer.

2. Information we collect

• Account information — name, business name, email, phone, role, and authentication identifiers.
• Customer Data — records you upload into the Service (customers, equipment, parts, invoices, quotes, work orders, etc.). You control this data; we process it on your behalf.
• Billing information — ABN, billing address, plan, invoices. Card details are handled by our payment processor and not stored by us.
• Technical and usage data — IP address, device and browser data, log files, pages visited, feature usage.
• Diagnostic error logs — automatic technical records of faults you encounter in the Service, scrubbed of contact and financial identifiers before storage. See section 7.
• Trial usage monitoring — during a free trial only, additional records of pages visited and data exports/downloads, each with IP address and device, used to prevent trial abuse. See section 8.
• Communications — support tickets, sales enquiries, survey responses.
• Website chat messages — everything you type into the chat assistant on our website, the page you were on, and a scrambled (hashed) form of your IP address used to limit abuse, plus the name, email and company if you choose to give them.
• Cookies and similar technologies — see our Cookie Policy.

3. How we collect it

We collect information directly from you when you sign up, use the Service, or contact us; automatically through your use of the Service; and occasionally from third parties such as identity providers, referrers, or publicly available sources.

4. Why we use it (APP 6)

• Provide, maintain and improve the Service.
• Authenticate users and secure accounts.
• Process billing and manage subscriptions.
• Provide support and respond to enquiries.
• Send service notices and, with consent, product updates and marketing.
• Detect and prevent fraud, misuse and security incidents.
• Comply with legal obligations and enforce our terms.

5. Disclosure to third parties (APP 6 & APP 8)

We disclose personal information to trusted sub-processors who help us run the Service, including cloud hosting, database, email delivery, analytics and customer-support providers. We require them to handle information consistently with this policy.

We use Stripe, Inc. ("Stripe") to process payments and manage subscriptions. When you make a purchase, billing and payment information you provide at checkout is collected and processed by Stripe as an independent data controller in accordance with Stripe's Privacy Policy. We do not store full payment card details.

The database that holds the information you and your business enter into the Service is hosted by Supabase, Inc. in Sydney, Australia (AWS region ap-southeast-2).

Some of these providers operate, or process data, outside Australia (for example in the United States or the European Union). By using the Service you acknowledge that your information may be transferred to and processed in those jurisdictions. We take reasonable steps to ensure overseas recipients handle personal information in a way consistent with the APPs.

Our AI features use Anthropic, PBC and other AI providers named in section 5A. These providers may process information outside Australia, including in the United States, so a dealer using AI features should expect that text sent to the AI may be processed overseas.

We may also disclose information where required or authorised by law, including to law enforcement, regulators, courts or in connection with a sale or restructure of our business.

5A. Artificial intelligence (AI) features

We use AI models in three places. In each, the text sent to the AI provider is processed to produce a reply and is not used by us to train our own models.

MDMS AI (optional add-on inside the Service). When a user asks MDMS AI a question, we send the question and the information needed to answer it, limited to what that user's role is allowed to see, to Anthropic, PBC, whose Claude models write the reply. Before sending, we remove Australian tax file numbers and bank account numbers (BSB and account numbers) by pattern matching, which can miss unusual formats. We do not remove names, email addresses, phone numbers or other business details, so please do not type information into a question that you would not want sent to an AI provider. MDMS AI can look things up. It does not change records on its own: it prepares a change for the user to confirm, and the Service checks the user's role again before saving.

Help assistant and help search. Questions to the help assistant, and the help articles matched to them, may be processed by OpenRouter, a service that routes requests to AI model providers, and by Voyage AI, which matches questions to help articles. Before sending, email addresses, Australian phone numbers and long number strings are replaced with placeholders, and tax file and bank numbers are removed.

Website chat assistant. The chat on our public website is an AI assistant. It points visitors to feature pages, demo booking or the free trial, and can pass a message to our team. Your messages are processed by an AI model through OpenRouter and its model providers, which may keep a copy of requests for a period under their own terms. We store every chat in our database (hosted by Supabase in Sydney), including the page you were on and a hashed form of your IP address. If you give your name and email, we email them and the conversation to our customer support team through Resend so we can reply. Please do not share passwords, payment details or tax file numbers in the chat. Stored chats in our database are deleted after 180 days; copies emailed to our team are kept in our support mailbox until we delete them.

Reducing personal information sent to AI providers. Where a business turns on the matching setting, most of our AI features remove email addresses, phone numbers, street and postal addresses, card numbers, tax file numbers and bank numbers from the text sent to AI providers, and remove fields known to hold contact, address, bank, birth date, pay and location details from lookup results. Staff, leave, pay and commission lookups are not offered to the AI. Two features, card fill and the help-article assistant, use a narrower removal of email addresses, phone numbers, tax file numbers and bank numbers. A second setting replaces customer, contact and staff names in lookup results with stand-ins; the link between a stand-in and the real name is kept on our servers for the conversation and deleted with it. Names a person types, and names inside free-text notes, can still reach the provider, and stand-ins are still personal information. Some of our AI features ask the provider not to keep requests, but we cannot guarantee that they do not; the direct calls to Anthropic have no such arrangement. The business using MDMS is responsible for what its staff type and for telling its own customers and staff about its use of AI.

Overseas processing. These providers (Anthropic, OpenRouter and the model providers it routes to, Voyage AI and Resend) may process information outside Australia, including in the United States and the European Union. We do not promise that AI processing stays in Australia. Section 5 applies.

Accuracy. AI replies can be wrong. Check anything that matters before you act on it. AI features do not provide legal, tax or financial advice.

5B. Implementation portal

When we set up ModernDMS for a business, we may give named people at that business a personal link to a secure setup page. This section covers what that page collects. It is provided by Modern DMS, ABN 32 737 926 202.

What we collect. Your name, work email and role (given to us by your business or by you), the tasks you tick off, the comments you write, the documents you upload, and the name you type if you confirm a project plan. We also record technical details such as when the page was opened and your IP address in scrambled (hashed) form, to keep the page secure. We email a one-time code to your work email to check it is you before you upload, download or confirm anything.

What we do not take through it. Please do not send tax file numbers, bank or card details, identity documents or passwords through the page. You enter those directly into your own ModernDMS, and we will show you how. We cannot promise that the page will detect sensitive information in every file, so please do not rely on it to do so.

Why. We use this information only to set up and support your ModernDMS and to keep a record of what was agreed. We do not use it for marketing.

Where it is stored. Uploaded files and the records above are held in our Supabase database and storage, in Sydney, Australia (section 5). Uploaded files are private and are not publicly accessible. The one-time code email is sent through Resend, which may process it outside Australia (section 5).

How long we keep it. Uploaded files are deleted 90 days after your project closes, or within 7 days if a file is found to contain sensitive information. Records of plan confirmations are kept for longer so that we can show what was confirmed and when.

Your choices. To see or correct what we hold about you, ask us to remove your link, or make a complaint, contact customersupport@moderndms.com.au. Sections 10 and 16 explain how we respond.

6. Data security

We use industry-standard safeguards including encryption in transit (TLS) and at rest, role-based access controls, audit logging, network segregation, multi-factor authentication for staff, and regular vulnerability scanning. No system is completely secure, and we cannot guarantee absolute security.

7. Diagnostic error logs

When something goes wrong while you are using the Service, we automatically record a technical description of the fault so that we can find and fix it. This is the only purpose for which these records exist.

Identifiers are stripped before the record is stored. Error text is automatically scrubbed — on your device before it is sent to us, and again on our servers before it is written — to remove email addresses, phone numbers, payment card numbers, ABNs, TFNs, street addresses and authentication tokens. These are replaced with placeholders such as [email] and are never stored.

Each record is linked to the user account and business it came from, and keeps technical context such as the screen, the error code and the software build. We need that link to know who is affected and to tell you when a fault is fixed — so these records are treated as personal information under this policy, not as anonymous data.

Because some error messages are written by hand by our software, we cannot promise that an incidental reference to a person is never captured in the text of an error. We do not rely on scrubbing alone: access to these records is restricted to authorised MDMS personnel, and they are never readable from within your account or by any other customer.

We never sell these records and never share them externally. They are not visible to any other customer, are never used for advertising, marketing, profiling, or to train third-party services, and are not sent to any analytics or error-reporting provider. The only parties that hold them are MDMS and the infrastructure providers that host the Service on our behalf (section 5), and the only other circumstance in which we would disclose them is where we are required to by law. They are used solely by MDMS to diagnose faults and improve the Service for the people who use it, and they do not give us a route into your Customer Data.

Diagnostic error records are automatically and permanently deleted 90 days after the error last occurred.

8. Trial usage monitoring

During a free trial, and only during a free trial, we automatically record how the trial account uses the Service — the pages visited, and actions that take data out of the Service such as exports, downloads, generated PDFs, printed labels and opened documents. The purpose is security and the prevention of trial abuse: for example, an account created to systematically copy the Service or to bulk-export data.

Each record includes the IP address and device/browser (user-agent) the action came from, together with the user account and business, the action, and the time. We keep the IP address in full because it is the signal that lets us recognise automated scraping and multiple trial accounts operated from one source.

This monitoring applies only while an account is on a free trial (including an expired trial that has not subscribed). When you subscribe to a paid plan it stops, and we do not apply it to paying customers' everyday use of the Service.

These records are restricted to authorised MDMS personnel and are never readable from within your account or by any other customer. We never sell them, never share them externally, and never use them for advertising, marketing, profiling, or to train third-party services. The only parties that hold them are MDMS and the infrastructure providers that host the Service on our behalf (section 5). Because each record is linked to the user and business it came from, we treat it as personal information under this policy.

Trial usage records are automatically and permanently deleted 90 days after they are created, and are deleted sooner if the trial's data is deleted (section 9).

9. Data retention

We retain Customer Data while your account is active and for a reasonable period afterwards to allow data export and to meet our legal, accounting and tax obligations. After that period we securely delete or de-identify the information unless we are required to retain it by law. Diagnostic error records are deleted on the 90-day cycle described in section 7.

Free trials that are not converted to a paid subscription: if your trial ends and you do not subscribe, we keep the data from your trial for 60 days after the trial end date, then permanently delete it along with the associated user accounts. We tell you the exact deletion date when your trial ends, and remind you again roughly 14 days and 3 days beforehand. Subscribing at any point before that date keeps your data intact. If you would like a copy of your trial data before it is deleted, contact us at customersupport@moderndms.com.au and we will provide it. This 60-day rule applies only to trials that never became paid subscriptions.

10. Your rights (APPs 12 & 13)

You may request access to, or correction of, personal information we hold about you by contacting customersupport@moderndms.com.au. We will respond within a reasonable time (generally within 30 days) and will not charge for reasonable requests.

11. Direct marketing and the Spam Act

Where we send marketing communications we comply with the Spam Act 2003 (Cth). Every commercial email includes an unsubscribe link, and you can opt out at any time by using it or by contacting us.

12. Notifiable Data Breaches scheme

If we suffer a data breach that is likely to result in serious harm to an individual whose personal information is involved, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required by Part IIIC of the Privacy Act.

13. Cookies and analytics

We use a small number of essential and analytics cookies. See our Cookie Policy for details.

14. Children

The Service is intended for business users aged 18 and over. We do not knowingly collect personal information from children.

15. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the Service or by email. The "Last updated" date above always reflects the current version.

16. Complaints and contact

If you have a privacy concern, contact us first at customersupport@moderndms.com.au and we will investigate and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Modern DMS
Queensland, Australia
customersupport@moderndms.com.au