Privacy Policy — DriveLog

Overview

DriveLog is a record-keeping and audit compliance platform built for Australian driving schools. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).

This policy applies to all users of DriveLog — including driving instructors who manage the platform, and learner drivers who submit registration details through a school's registration link.

Who We Are

DriveLog is operated by Drive Log Australia, based in New South Wales, Australia.

Website: drivelog.com.au
Email: support@drivelog.com.au
Jurisdiction: New South Wales, Australia

If you are a learner driver with KS Driving School St Marys. Drive Log Australia and KS Driving School St Marys are registered business names of the same business — ABN 61 647 089 416. Your details being held in DriveLog is that one business keeping its own records, not a disclosure to another company. The policy that governs your details as a learner is the KS Driving School St Marys Privacy Notice, and privacy enquiries about your learner record go to info@ksdrivingschool.com.au. This page describes the DriveLog platform itself; where the two differ, the KS Privacy Notice governs your learner record.

What We Collect

We collect only the information necessary to provide driving school management and compliance services.

Category	Data Collected	Who Provides It
Identity	Full name, date of birth	Learner driver
Contact	Mobile number, email address, residential address	Learner driver
Licence	NSW licence number, licence expiry date, licence class	Learner driver (via OCR scan or manual entry)
Booking	Test date, test time, test centre, package selected	Learner driver
Booking Confirmation	Screenshot/photo of official RMS/Service NSW test booking confirmation	Learner driver (uploaded image)
AI Assistant Conversations	The messages you type to the optional AI assistant on our booking page, and the replies it gives you	Learner driver (only if you choose to use the assistant)
Lesson Records	Lesson dates, durations, notes, payment status	Driving instructor
Account	Instructor name, email, Google account (for login)	Driving instructor
WhatsApp Business Platform	WhatsApp Business Account ID, phone number ID, display phone number, customer phone numbers, WhatsApp profile name where provided, message IDs, message timestamps, message content, message type, delivery/read/error status, webhook event metadata, template/message audit logs, and onboarding/session records needed to connect an authorised WhatsApp Business account	Driving school/business account owner, Meta/WhatsApp Business Platform, and WhatsApp users who message the connected business
Consent	Timestamp and version of privacy policy accepted	Automatically recorded at registration

If you use the AI assistant on the booking page. Our booking page offers an optional AI assistant that answers questions about the times available, the kinds of lesson and test booking offered, and how paying works. It does not quote prices or fees — it will offer to check with the school instead. If you use it, the messages you type and the replies you are given are stored, along with the booking session they belong to and, once you have registered, a link to your learner record. We store them so that a later question or complaint about what you were told can be answered from the actual exchange, so we can check the assistant's answers were accurate, and so the school keeps a record of what it told you. Your message, along with a small amount of context about you, is sent to the AI service that produces the reply — see Sharing & Disclosure for exactly what it is given. Stored conversations are kept for 90 days from the last message in that conversation and are then deleted automatically — see Data Retention. They are readable only by DriveLog administrators through our secure back end: no browser sign-in — yours, another learner's, or an instructor's — can open a stored conversation. Using the assistant is entirely optional, the booking page works the same way without it, and nothing you type there is used for marketing. The rights set out in Your Rights apply to these conversations: you can ask for a copy of what is held, ask for it to be corrected, or ask for it to be deleted. If your learner record is deleted, the messages recorded against it are deleted with it. Messages you sent before you registered become part of that record as soon as you ask the assistant something else after registering. If you only ever use the assistant before registering, those messages are not filed against your learner record — though the booking session they belong to may still connect them to you — and they are removed at the end of the 90-day period.

How We Use It

Personal information collected through DriveLog is used solely for the following purposes:

Creating and managing student records for the driving school
Scheduling and tracking driving lessons and test bookings
Generating audit-ready compliance reports required by transport authorities
Sending notification emails to instructors when a new student registers
Verifying test booking details against the uploaded confirmation screenshot
Saving student contact details to the instructor's Google Contacts for easy access
Creating calendar events for lessons and tests in the instructor's Google Calendar
Answering questions asked through the optional AI assistant on the booking page, and reviewing those conversations afterwards to handle support enquiries and complaints, check the quality and accuracy of the answers given, and keep a record of what a learner was told
Connecting an authorised driving school's WhatsApp Business account to DriveLog
Receiving WhatsApp customer enquiries inside DriveLog
Organising WhatsApp conversations as leads, students, bookings, or support records
Sending booking, test-preparation, reminder, and support replies through the WhatsApp Business Platform
Recording message delivery/status events and audit logs for troubleshooting and compliance
Supporting WhatsApp Business App / Cloud API coexistence where enabled by Meta and authorised by the business

        DriveLog does not sell WhatsApp or Meta Platform Data, share it with advertisers, or use it for unrelated advertising, profiling, or unrelated marketing.
      

        We do not use personal information for marketing, advertising, or any purpose beyond driving school management.
      

Google Services

DriveLog integrates with Google services when an instructor logs in using their Google account. The following Google APIs are used:

Google Service	Purpose	Data Accessed
Google Calendar	Create and read lesson and test appointments	Instructor's calendar events
Google Contacts	Save student contact details for easy lookup	Instructor's contact list
Licence OCR	Extract details from uploaded licence photos automatically	Image content only — not stored by Google

Google API access is granted by the instructor at login and is used exclusively on their behalf. DriveLog does not access, read, or store any Google data beyond what is explicitly described above.

DriveLog's use of Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

WhatsApp Business Platform

DriveLog may integrate with the WhatsApp Business Platform to help driving schools manage customer conversations and booking enquiries.

When a business connects its WhatsApp Business account, DriveLog may receive and process WhatsApp Business Platform data, including WhatsApp Business Account IDs, business phone number IDs, customer phone numbers, WhatsApp profile names where provided, message IDs, message content, timestamps, message type, delivery/read/error statuses, template activity, webhook event metadata, and related audit logs.

DriveLog uses this data only to provide WhatsApp messaging, lead-management, booking-support, customer-service, troubleshooting, security, and audit functions for the authorised driving school.

DriveLog may use Meta Embedded Signup or related Meta Business tools to allow an authorised business owner to connect their WhatsApp Business assets. Any tokens or credentials used to access WhatsApp Business Platform APIs are stored server-side and are not exposed in the browser.

Where WhatsApp Business App and Cloud API coexistence is enabled, DriveLog may receive webhook events such as message history, contact sync events, message echoes, and account update events. These events are used only to display, store, audit, or synchronise the business's own WhatsApp conversations and related contact records inside DriveLog.

DriveLog does not:

sell WhatsApp or Meta Platform Data
use WhatsApp message content for unrelated advertising
share WhatsApp message content with advertisers or data brokers
use WhatsApp data to build unrelated user profiles
access WhatsApp data unless authorised by the connected business account owner

Customers who message a driving school through WhatsApp should understand that their messages may be processed by DriveLog on behalf of that driving school for customer service, booking, and record-keeping purposes.

Booking Confirmation Screenshots

When a learner selects a test package, they may upload a screenshot or photo of their official RMS / Service NSW test booking confirmation. This image is:

Stored securely in a private Supabase Storage bucket — not publicly accessible
Linked to the learner's profile in the driving school's records
Accessible only by the instructor associated with that school
Used to verify and audit the test date, time, and centre details entered during registration
Retained for 6 years in accordance with Australian business record-keeping obligations

        Purpose: The screenshot serves as the source of truth for test bookings. In the event of a dispute or discrepancy between the entered date and the official booking, the stored screenshot is the authoritative record.
      

Data Storage & Security Infrastructure

All DriveLog data is stored using Supabase, a secure cloud database platform. Key protections include:

The learner-record database is hosted in the ap-southeast-2 (Sydney, Australia) region. This is a statement about where the database sits — it is not a claim that every service DriveLog uses stores or processes data only in Australia. See Sharing & Disclosure and the published provider disclosure.
Row-Level Security (RLS) — each driving school can only access its own data
All data transmitted over HTTPS/TLS encryption
Storage buckets are set to private — no public URL access to uploaded files
Automatic inactivity logout after 30 minutes (APP 11 compliance)
Access logging on sensitive student profile views

Sharing & Disclosure

DriveLog does not sell, rent, or trade personal information. Information is shared only in the following limited circumstances:

Within the school: Student data is accessible only to the instructor(s) of the driving school the student registered with
Email notifications: Student registration details are sent via Resend (email delivery service) to the instructor's email address
Review alerts: When a registration is waiting for review, the reviewer is alerted by email so they can sign in to DriveLog and review it.
WhatsApp Business Platform / Meta: Where a driving school connects WhatsApp to DriveLog, WhatsApp message and account event data may be exchanged with Meta/WhatsApp Business Platform to send, receive, deliver, and audit messages. DriveLog uses this data only to provide the messaging service requested by the connected business. Where WhatsApp is used for a review or notification alert, the message may include learner details relevant to that alert — such as name, email, phone, test date/time, licence type, and the package or lesson selected — see WhatsApp Business Platform for what is collected and how it is used.
AI assistant: If you use the optional assistant on the booking page, your message and the recent part of that conversation are sent to the AI service that generates its replies, together with a small amount of context so the reply makes sense: your first name, your licence stage, and whether you have chosen a time yet. It is operated for DriveLog for that purpose and is given nothing else about you — not your address, phone number, email, licence details, booking history or payments.
Payments: Where a learner pays by card, card details are entered directly into Stripe's own hosted payment element and are sent to Stripe, not to DriveLog's servers. DriveLog receives only the payment outcome (success/failure) and a Stripe reference, not the card number.
Legal obligation: We may disclose information where required by Australian law or a court order

Third-party services used by DriveLog (Supabase, Resend, Google, Meta/WhatsApp Business Platform, Stripe) have their own privacy policies and are bound by data processing agreements.

Overseas storage and processing. DriveLog's learner-record database is hosted in Australia. Some other providers, or their authorised subprocessors, store or process information outside Australia — including in the United States and in other countries where those providers operate. We do not claim that all data stays in Australia. Where overseas processing occurs we take reasonable steps to select appropriate providers, limit what is disclosed to them, and protect it through contractual, technical and access controls.

Data Retention

Data Type	Retention Period
Student records & lesson logs	6 years (Australian tax & business records obligation)
Booking confirmation screenshots	6 years
Consent logs	6 years
Instructor account data	Duration of active account + 2 years
AI assistant conversations	90 days from the last message in that conversation
Error & access logs	90 days
WhatsApp messages and conversation records	Retained for the duration of the connected business account plus up to 6 years where required for business records, audit, dispute handling, or legal obligations
WhatsApp webhook/security/error logs	Normally retained for up to 90 days unless needed for security, troubleshooting, audit, or legal reasons
WhatsApp onboarding/session records	Retained while the integration is active plus a reasonable period for audit, support, and security

Upon written request, we will delete personal information earlier where there is no legal obligation to retain it.

Your Rights

Under the Australian Privacy Act 1988, you have the right to:

Access — request a copy of the personal information we hold about you
Correction — request correction of inaccurate or outdated information
Deletion — request deletion of your personal information (subject to legal retention requirements)
Complaint — lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy rights have been breached

To exercise any of these rights, contact us at support@drivelog.com.au. We will respond within 30 days.

Businesses may request disconnection of their WhatsApp Business integration at any time by contacting support@drivelog.com.au. Individuals may request access, correction, or deletion of their personal information, including WhatsApp-related records, subject to legal retention requirements.

Data Deletion Requests

To request deletion of DriveLog account data, learner data, or WhatsApp-related records, contact support@drivelog.com.au with enough information to identify the relevant account or record.

Where legally permitted, DriveLog will delete or de-identify the requested information. Some records may be retained where required for business records, audit, dispute handling, fraud prevention, security, or legal compliance.

For Meta App Review and platform compliance, this page serves as DriveLog's public data deletion instructions.

Security

We take reasonable steps under APP 11 to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Measures include:

Encrypted data transmission (HTTPS/TLS)
Private, access-controlled file storage
Automatic session expiry after 30 minutes of inactivity
Audit logging of all access to sensitive student profiles
School-level data isolation — no cross-school data access

If you become aware of any security concern relating to your data, please contact us immediately at support@drivelog.com.au.

Contact Us

For any privacy-related questions, requests, or complaints:

✉️

Privacy Contact — DriveLog

support@drivelog.com.au