How we handleyour information.

Uplex is a Melbourne airport-transfer and chauffeur service, a business name of Greenmotion Ventures Pty Ltd (ABN 64 694 230 825), which also trades as ME CABS. In this policy, “Uplex”, “we” and “us” mean that business. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and this policy explains what personal information we collect, why, who we share it with, and the choices you have.

If anything here is unclear, write to us at hey@uplex.com.au. A person in Melbourne reads it.

We collect only what a booking needs, and we say so at the point we ask for it.

To make and run a booking

• Your name, mobile number and email address.
• The journey: pickup and drop-off addresses, any stops, the date and time, the length of an hourly hire, and the vehicle class you choose.
• For airport transfers, your flight number, so we can follow the flight and move the pickup with it.
• When you book for someone else, the passenger's name and mobile number, and the name to show on the board at arrivals.
• Notes you leave for the chauffeur, and any return journey you add.
• A one-time code we send to your mobile or email to confirm it is yours, before a booking without an account is accepted.

If you create an account

• Your name, email and mobile number, and a password (stored only as a one-way hash), or the name and email Google gives us if you sign in with Google.
• Places you choose to save — Home, Work, the usual airport — with their addresses and map coordinates.
• Your booking history.

To take payment

• Card payments are taken by Stripe. Your card number goes to Stripe directly and never touches our servers; we receive a payment reference, the card's brand and its last four digits.
• If you pay the chauffeur at the end of the journey, we hold no payment details at all.

Technical information

• The information a browser sends with any request — your IP address, browser and device type, and the pages you visit — kept in short-lived server logs for security and to keep the service running.
• Cookies that keep you signed in and protect forms from forgery. We set no advertising cookies.
• On our public pages and booking pages, Google Tag Manager and Google Analytics measure how the site is used: the pages visited, how you arrived and your browser and device type. When you book, they record the kind of trip, the car class, the fare and how you paid. They set their own cookies. We never send them your name, contact details, addresses or booking codes, and they do not load on your account, sign-in or booking-management pages when you open those directly.
• Your device's location only when you tap “Use my current location” in an address field, and only with your browser's permission, to fill that field once. We never track your location in the background.

We use your information to:

• Price, confirm and carry out your journey, and assign a chauffeur to it.
• Follow your flight and adjust the pickup when it is early, late or diverted.
• Send you what the booking needs: the confirmation, the chauffeur's details before pickup, changes on the day, and your receipt — by SMS and email.
• Confirm that a mobile number or email address is yours.
• Take payment, issue refunds, and keep the records Australian tax and business law requires.
• Run your account and remember your saved places.
• Answer your questions, resolve a complaint, and handle a lost item.
• Keep the service safe: preventing fraud and misuse, and meeting our legal obligations, including to the transport regulator.
• Understand how the service is used so we can improve it — from our own records, not from advertising trackers.

We send marketing only if you have agreed to it, and every message tells you how to stop. Booking messages — your confirmation, the chauffeur’s details, a change to the pickup — are part of the service and are not marketing.

We do not sell personal information. We share it only with the people and providers who need it to do the work.

• Your chauffeur. The name of the passenger, the mobile number to reach them on the day, the addresses, the time, the flight number and any notes you left. Nothing else.
• Stripe, for card payments and refunds. It handles your payment details under its own privacy policy.
• Twilio, which delivers our SMS messages, and Brevo, which delivers our email.
• Google: its Maps Platform finds and maps addresses as you type them; if you choose it, Google Sign-In tells us your name and email; and Google Tag Manager and Google Analytics measure visits to our public and booking pages.
• Our hosting providers. The service runs on DigitalOcean infrastructure, and encrypted backups are kept in Microsoft Azure in Australia (Australia East).
• Professional advisers, insurers and regulators where the law requires it, and the police where a lawful request is made.

Overseas disclosure

Some of these providers process information outside Australia — Stripe, Twilio, Brevo and Google operate in the United States and elsewhere. We choose providers that commit to standards consistent with the Australian Privacy Principles, and we send them only what their task needs.

• Everything between your browser and our service travels over TLS.
• Card numbers never reach us: they go to Stripe, which is certified to the payment industry's security standard.
• Passwords are stored as one-way hashes. Sign-in links and verification codes expire quickly and work once.
• Access to production systems is limited to the people who run them, and backups are encrypted before they leave the server.

No system is perfect. If a breach is likely to cause serious harm, we will tell you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

• Booking and payment records are kept for as long as Australian tax and business record-keeping law requires, then deleted or de-identified.
• Verification codes and sign-in links are deleted once used or expired.
• Server logs are kept for a short period for security, then discarded.
• An account and its saved places are kept until you delete the account or ask us to; the booking records it holds are kept for the period above.

• You can book without an account. An account is a convenience, never a condition.
• You can see and change your details and saved places in your account, and see your bookings there.
• You can ask us for a copy of the personal information we hold about you, and ask us to correct it. We answer within 30 days, and we do not charge for it.
• You can ask us to delete your account. We will, keeping only the booking records the law requires us to hold.
• You can stop marketing at any time, using the link in the message or by writing to us. Booking messages continue for as long as you have a booking.
• You can use the site without giving your location; type an address instead.

To exercise any of these, email hey@uplex.com.au from the address on your account or booking.

Bookings must be made by someone aged 18 or over. A child may travel as a passenger on a booking made by an adult, and we hold only the details that booking needs.

If you think we have mishandled your information, write to us first at hey@uplex.com.au. We will acknowledge your complaint within seven days and aim to resolve it within 30.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

When the service changes in a way that affects your information — a new provider, a new kind of data — we update this page and the date at the top before the change takes effect. The version here is always the one that applies.