Privacy Policy | SkillSteer

SkillSteer Pty Ltd (ABN 37 700 510 158) (“SkillSteer”, “we”, “us”, “our”) respects your privacy. This Privacy Policy explains how we collect, use, store, and share personal information when you use skillsteer.com.au and the SkillSteer app (the “Platform”) as a learner (“Learner”) or driving instructor (“Instructor”). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy should be read alongside our Terms of Service.

1. About this policy

This policy covers information collected through the SkillSteer website and mobile app, including when you browse instructor listings, create an account, make or receive a Booking, contact support, or read our driving blog. It doesn’t cover the privacy practices of third-party sites we link to.

2. Information we collect

We collect the following categories of information:

Account & profile information: name, email address, phone number, profile photo, state/territory, and preferred language.
Booking information: lessons booked or taught, availability, suburb, transmission preference, and messages exchanged around a Booking.
Payment information: we don’t store your full card details — these are collected and processed directly by Stripe. We retain transaction records (amounts, dates, and Stripe reference IDs) and, for Instructors, payout account details managed through Stripe Connect.
Instructor compliance information: driver’s licence, driving instructor accreditation, Working With Children Check details, insurance, and vehicle information submitted during onboarding and verification — see Section 7.
Location & search data: the suburbs and search filters you use to find instructors or students.
Device & usage data: IP address, browser or device type, pages viewed, and similar diagnostic data collected automatically when you use the Platform.
Communications: messages you send us through support, and questions you ask our Concierge assistant, where available.

3. How we collect it

Most information is provided directly by you when you register, complete onboarding, or make a Booking. We also collect information automatically as you use the Platform (see Device & usage data above), and, if you sign in with Google, we receive your name, email, and profile photo from Google as part of that sign-in.

4. How we use it

We use personal information to:

Create and manage your account, and match Learners with Instructors;
Process Bookings, payments, refunds, and instructor payouts;
Verify Instructor identity, accreditation, and ongoing compliance so the Platform stays safe to use;
Send booking confirmations, reminders, receipts, and service updates;
Provide customer support and investigate disputes or cancellations;
Improve the Platform, including troubleshooting and understanding how features are used; and
Meet our legal and regulatory obligations, including tax and record-keeping requirements.

We share personal information only where necessary:

Between Learners and Instructors: to complete a Booking, we share the details each side reasonably needs — for example, a Learner’s first name and suburb with their Instructor, and an Instructor’s profile, accreditation status, and vehicle details with the Learner.
Service providers: Stripe (payments and payouts), Supabase (hosting, authentication, and database), Google (sign-in and optional calendar sync), Resend (email delivery), Sanity (our blog content system), and, where applicable, state Working With Children Check verification services, all acting on our instructions.
Legal & safety: where required by law, to enforce our Terms, or to protect the safety of a user or the public.
Business changes: if SkillSteer is involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction, subject to this policy.

We don’t sell personal information to third parties.

6. Overseas disclosure

Some of our service providers (including Stripe, Supabase, and Google) may store or process data on servers located outside Australia. Where this happens, we take reasonable steps to ensure those providers protect your information consistently with the Australian Privacy Principles, including through the provider’s own contractual and security commitments.

7. Instructor compliance documents

Documents Instructors submit for verification — such as a Working With Children Check or driver’s licence — can include sensitive information. We only use these documents to verify eligibility to be listed on the Platform, to monitor ongoing compliance (including expiry tracking), and to meet our own legal obligations. Access is restricted to our compliance review team, and we don’t share these documents with Learners or other Instructors — Learners only see the verification status (for example, “accreditation verified”), not the underlying documents.

8. Storage & security

Personal information is stored in Supabase (Postgres) with row-level security restricting who can access which records, and compliance documents are held in access-controlled storage. We use encryption in transit (HTTPS) and industry- standard access controls, but no online service can guarantee perfect security — if we become aware of a data breach affecting your information, we’ll notify you and the Office of the Australian Information Commissioner where required by the Notifiable Data Breaches scheme.

9. Cookies & tracking

We use essential cookies to keep you signed in and to remember things like your search preferences. We may also use privacy-conscious analytics to understand how the Platform is used and to improve it. You can control cookies through your browser settings, though disabling essential cookies may prevent parts of the Platform from working properly.

10. Marketing

We may send you booking-related and service emails (these aren’t optional while you have an active account, as they’re necessary to operate the Platform), and occasional marketing emails about new features, instructors, or blog content, which you can opt out of at any time using the unsubscribe link in the email or by contacting us.

11. Your rights

You can access and update most of your information directly in your account settings. Under the Privacy Act, you can also ask us to: provide a copy of the personal information we hold about you, correct information that’s inaccurate or out of date, or (subject to our legal and record-keeping obligations, such as transaction and tax records) delete your account and personal information. Send these requests to support@skillsteer.com.au — we’ll respond within a reasonable time and may need to verify your identity first.

12. Children & young people

SkillSteer accounts are for users aged 16 and over. Where a Learner is under 18, a parent or guardian is expected to be involved in the account and Booking as described in our Terms of Service. We don’t knowingly collect personal information directly from children under 16; if you believe a child has provided us information without appropriate consent, contact us at support@skillsteer.com.au and we’ll act on it.

13. Data retention

We keep personal information for as long as your account is active, and afterwards for as long as needed to meet legal, tax, and dispute-resolution obligations (for example, booking and payment records are typically kept for at least seven years to satisfy Australian tax record-keeping requirements). Instructor compliance documents are retained while your listing is active and for a reasonable period after, in line with our verification and audit obligations.

14. Changes to this policy

We may update this Privacy Policy as our practices or the law change. We’ll post the updated policy here with a new “Last updated” date, and for material changes we’ll make reasonable efforts to notify you before they take effect.

15. Contact us & complaints

Questions, requests, or complaints about how we handle your personal information can be sent to support@skillsteer.com.au. We’ll aim to resolve your complaint directly. If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.