Privacy Policy

1. Who this policy applies to

This policy applies to users of the Cabhelm website and platform. Cabhelm is operated in Australia and is intended for transport and fleet operations users.

2. What we collect

Depending on how you use Cabhelm, we process:

• Account data such as name, email, business details, and role.
• Platform usage and diagnostic data such as timestamps, request metadata, and device/browser details.
• Operational data entered by customers such as fleet, compliance, and workflow records.
• Session and preference data stored via cookies or browser storage.

3. Why we process personal information

• To provide account access, authentication, and core platform functionality.
• To run security controls, fraud prevention, and abuse detection.
• To support operations, troubleshooting, and product improvement.
• To meet legal and regulatory obligations where applicable.

4. Legal and regulatory basis

Cabhelm is designed for Australian operations and aligns with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs). Nothing in this page is legal advice. Customers remain responsible for their own legal and regulatory compliance obligations. Where applicable, Cabhelm acts as a data processor and complies with your instructions regarding personal information handling.

5. Cookies and tracking technologies

Cabhelm uses essential cookies for authentication/session handling and may use analytics cookies depending on environment configuration. You can manage consent through the cookie banner and review details in the Cookie Policy.

6. Sharing and disclosures

We do not sell personal information. We may disclose data to:

• Service providers that support hosting, security, identity management, payment processing, analytics, or operational workflows, including:
  • Stripe (payment processing)
  • Keycloak (identity and authentication)
  • OpenReplay (optional session replay where enabled)
  • Cloud infrastructure and hosting providers
  • Security and monitoring service providers
• Authorities or regulators when required by law or legal process.
• Professional advisers, auditors, and legal representatives under confidentiality controls.

7. Data location and retention

Data may be processed in Australia and, depending on service configuration, in other jurisdictions under supplier controls. Retention periods are set by operational need, legal requirements, and security policies. We delete or de-identify data when no longer required.

8. Security controls

• Role-based access control and authenticated session handling via Keycloak SSO.
• Encryption in transit using HTTPS/TLS with certificates from trusted authorities.
• Encryption at rest where applicable for sensitive data.
• Secrets management using HashiCorp Vault for secure credential storage.
• Comprehensive audit logging and incident response processes.
• Regular security assessments and vulnerability management.

9. Your rights

Subject to applicable law, you may request access, correction, or deletion of personal information.

If you are located in an Australian state or territory, you may also contact your local consumer or privacy authority where relevant, or the Office of the Australian Information Commissioner.

10. Sub-processor disclosures

Where Cabhelm acts as a data processor, we maintain a current list of sub-processors. For the most up-to-date list of sub-processors, contact our privacy team via the Contact page. Changes to sub-processors are communicated in accordance with applicable data protection legislation.

11. Contact

For privacy requests, feedback, or concerns, contact support using the channels listed on the Contact page and include enough detail for us to verify and action your request safely. For privacy-specific inquiries, you can also request to speak directly with our privacy team.