TransX Privacy Policy

1. Who we are

TransX is operated by Opal IQ Pty Ltd (ACN 700 989 742), Unit 606, 153 Parramatta Road, Homebush NSW 2140 ("we", "us"). This policy explains how we handle personal information in TransX: the web app, the driver app, customer portals and the admin console.

2. Our two roles

• Collector. For account and contact details (who you are, how to reach you, how you sign in) and for keeping TransX secure, we decide how the information is used. We use it only to run TransX.
• Service provider. Transport companies, shippers and their customers ("workspaces") use TransX to run their operations. For the operational records in a workspace (jobs, runs, stops, proof of delivery, documents, invoices), we hold and process the information on that workspace's behalf and under its instructions. The workspace is responsible for how it collects and uses those records. If your question is about operational records, start with the company you work with or for; we'll help them respond.

3. What we collect

Account and contact details (collector)

• Name (we keep a first name or nickname), email address, optional mobile number and job title.
• Your role in a workspace (for example owner, admin, operations, driver or customer user), and which customer you're linked to.
• Password, stored only as a one-way hash. Optional authenticator (TOTP) setup.
• For drivers: licence class, licence expiry date and medical assessment due date (see Driver information below).

Driver information

Carriers can add their drivers to TransX. For each driver, we hold their name, contact details, licence class, licence expiry date and medical assessment due date. Carriers use these to manage their drivers and to check a driver is fit and licensed to drive, including in an emergency.

The medical assessment due date is health information, which the Privacy Act treats as sensitive information (APP 3.3). We collect it only where the carrier confirms the driver has consented, and only where it is reasonably necessary for the carrier to manage driver safety. A driver can withdraw consent at any time by asking their carrier or emailing contact@opaliq.com.au. Health information is only shown to people the carrier authorises in its workspace. We do not use it for marketing or AI features, we do not put it in exports, and we do not share it with shippers.

Security and service records (collector)

• Sign-in, password-reset and invite attempts, with IP address and time, to block guessing and abuse.
• Essential cookies only, to keep you signed in. We don't use analytics, advertising or tracking cookies.
• Application error logs when something breaks, held by our hosting provider.
• Admin audit records of support actions by our staff.

Operational records (service provider for the workspace)

• Jobs, runs, stops, sites (including addresses and map coordinates), trucks, trailers, prestart checks (including odometer readings), defects and photos.
• Proof of delivery: receipt status, the name of the person who signed, signatures, docket and POD photos, scans and attachments.
• Comments, issues, notifications and an activity log recording who did what and when.
• Customers, contracts, rates, charges and invoices (business information, which may include accounts contact emails).
• AI-assisted features (when turned on for a workspace): AI features can be turned on or off for each workspace in Settings. When they are on, we send the workspace information needed to produce a suggestion (for example, the text of an order or the details of a job) to Anthropic PBC's Claude Haiku model, and we keep a log of each AI suggestion for review: the AI's output (which can include names and site addresses), any changes a person makes, the decision, and who made it and when. We keep only a fingerprint (hash) of what we sent, not the text itself. This information may be processed in the United States and other countries (see section 7).

AI-assisted features

• On or off per workspace. AI features can be turned on or off for each workspace in Settings. They run only while they are turned on.
• Suggestions only. Everything an AI feature produces is a suggestion. A person in the workspace reviews it and decides whether to accept, change or reject it. The AI doesn't make decisions about you by itself, and nothing it suggests is acted on until a person approves it.
• What is sent. Only the workspace information needed to produce the suggestion, which can include names and addresses in orders and jobs (the AI needs them to match sites) and photos attached to a job. Before sending, we automatically mask email addresses and Australian phone numbers. We send it directly to Anthropic PBC, with no other company in between. We don't send driver health information (see Driver information above).
• No training. Under Anthropic's commercial terms, Anthropic may not use the information we send to train its AI models.
• How long Anthropic keeps it. Anthropic's current policy is to delete the information we send, and the model's replies, within 30 days. It may keep them longer where the law requires, or to enforce its usage policy: if its automated safety systems flag a request, Anthropic may keep the request and reply for up to 2 years. See section 8.

We collect only what we need to run TransX (APP 3). You can't use TransX anonymously or under a pseudonym, because workspaces need to know who did a job.

4. How we collect it

• From you, when you sign up, accept an invite, use the app or contact us.
• From your workspace. An administrator may invite you (email, role, and optionally name, mobile, and for drivers licence class, licence expiry date and medical assessment due date) or import a team list. When this happens we notify you in the invite email (APP 5).
• Automatically, through sign-in, security and error records.

5. How we use it

To create and secure accounts; give the right people access to the right workspace; run the features workspaces use; send service emails (invites, password resets, notifications); provide support; fix faults; and meet legal obligations. We don't sell personal information. We don't use it for direct marketing without your consent, and every marketing message includes a way to unsubscribe (APP 7, Spam Act 2003).

6. Who we disclose it to

• Your workspace and people it authorises, and other workspaces it deliberately shares jobs with (for example, a shipper and its carrier).
• Our service providers, who host and run TransX for us under confidentiality obligations: hosting (Vercel), database and file storage (Supabase), AI processing for AI features (Anthropic PBC, Claude Haiku model, the United States and other countries), and email delivery once enabled, as listed in section 7.
• Authorities, when the law requires it.

7. Overseas disclosure (APP 8)

We use these providers to run TransX. Some may store or access personal information outside Australia:

We take reasonable steps to make sure these providers handle personal information consistently with the APPs.

8. How long we keep it

• Invites that aren't accepted: expire after 7 days; details deleted 30 days after the invite was sent.
• Guest accounts (people invited into a workspace): deleted 12 months after last activity.
• Other accounts (including paid workspaces): Kept while the account is active. Deleted within 90 days after a workspace closes, except billing and tax records, which we keep for 5 years as Australian law requires.
• Operational records: kept as the workspace instructs, and for as long as the law requires (for example tax records). Issued invoices aren't altered.
• Our AI log: we keep the log of AI suggestions (the AI's output, any human edits, the decision, and who made it and when) with the workspace's operational records, for as long as the workspace instructs, and delete it when those records are deleted. After deletion we keep only spending totals, which contain no personal information.
• At Anthropic (our AI provider): Anthropic deletes AI prompts and outputs within 30 days under its current policy. It may keep them for up to 2 years if its automated safety systems flag them, and longer where the law requires.
• Backups: Backups are kept for up to 30 days, then deleted.

When information is no longer needed, we delete or de-identify it (APP 11.2).

9. Security (APP 11)

Workspaces are isolated in the database (row-level security). Data is encrypted in transit. Passwords are hashed, and invite links are single-use, stored hashed and expire after 7 days. Sign-in attempts are rate-limited, optional authenticator codes are available, and file storage is private. Staff access is limited and audited. No system is perfectly secure; if a data breach is likely to cause serious harm, we'll notify you and the OAIC as the Notifiable Data Breaches scheme requires.

10. Access and correction (APPs 12 and 13)

You can see and update most of your account details in the app. To ask for a copy of your personal information or a correction, email contact@opaliq.com.au. We'll respond within 30 days and won't charge for the request. For operational records we hold for a workspace, we'll pass your request to that workspace or help it respond.

11. Complaints

Email contact@opaliq.com.au with details. We'll acknowledge it within 5 business days and respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992.

12. Changes

We'll post any update here with a new date, and tell account holders by email about material changes.

Last updated: 29 October 2026