Privacy policy

This policy explains how Bike Domain Pty Ltd (ACN 162 726 972), which runs caravandomain.com.au, handles personal information. We are bound by the Privacy Act 1988 and the Australian Privacy Principles. In this policy "we" and "us" mean Bike Domain Pty Ltd, and "you" means anyone who uses the site.

The short version: we collect what we need to run a classifieds site, we keep sellers' contact details off public pages, we do not sell personal information, and you can ask us to see, fix or delete what we hold about you.

What we collect

When you browse

You can browse and search the site without an account. Public pages set no cookies, apart from one small cookie that remembers your answer to the analytics question (see Cookies and analytics below). We collect:

• basic request information your browser sends, such as your IP address, the page you asked for and your browser type, which our servers and our hosting and security provider log to keep the site running and to stop abuse
• the country your connection comes from, which we use as one signal when we check for scams and misuse
• anonymous performance measurements from about one page view in ten: how quickly the page loaded, the type of page, the kind of device, the Cloudflare data centre that served it and the country the connection came from. We store the page address only in scrambled (hashed) form, never with your IP address or anything that identifies you, and we delete these measurements after 90 days. They help us keep the site fast
• analytics, described below

When you create an account

We sign you in with a one-time code sent to your email address, or with your Google account if you choose. We do not use passwords. We collect your email address and, if you add them, your name and phone number. When you are signed in we set a session cookie so the site knows it is you; we keep a record of sign-ins, including the time, the IP address and the browser, so we can spot unusual activity and show you your active sessions.

When you list a vehicle

We collect the details of your ad: the vehicle or item, its price, its location (shown publicly as the suburb and state only), your description and your photos. We remove location data and other embedded information from photos when we process them. For damaged, written-off and parts-only vehicles we also collect the VIN or chassis number, and the engine number if you give it. They are stored encrypted. Only a dealer's ad shows one, and only where the dealer's state requires it (see the next paragraph). A buyer can reveal the VIN one ad at a time, and we log each reveal.

Dealer ads follow their state's advertising rules. In New South Wales and Victoria a licensed dealer's ad for a registered used vehicle shows its registration number, and a Victorian licensed dealer's ad for an unregistered used vehicle shows its VIN, or its chassis number where it has no VIN, because Victorian law asks for it. A private seller's registration number is never shown.

When you publish an ad we record that you accepted our terms and this policy, with the version, the time and your IP address.

When you contact a seller or a seller contacts you

Enquiries are sent through the site. We pass the buyer's message to the seller by email without showing the buyer's email address, and the seller replies through their dashboard. We keep the messages so both sides can see the conversation. If a seller shows a phone number, buyers reveal it with a click; we log each reveal, and some reveals need a quick check by text message before the number is shown.

For dealer ads, an enquiry also goes to the dealer's lead inbox. If the dealer receives leads in a standard format for their own systems, the buyer's email address is included only when the buyer ticks the box beside the form that allows it.

The same rule applies to every other way a dealer receives leads from us: by a connection to the dealer's own systems, through our API and in lead exports. The box starts unticked. The dealer's staff can keep notes and a status on each lead in their inbox.

When you register as a dealer

We collect the business's name and legal name, its ABN, its licence number and state, its address and public phone number, and the website, brands, description, logo and opening hours it chooses to show, as well as the name and email address of each person on the dealer account. We check the ABN with the Australian Business Register and keep the register's answer, and a person checks the licence against the state's public register. The dealer page shows the business details the dealer chooses to publish, and never the email addresses of the people on the account.

When you save a search

If you save a search, we keep the search, the name you give it, how often you want alerts and, if you turn on browser notifications, the notification address your browser gives us for that device. Saved-search alerts are sent only because you asked for them; every alert has a one-click unsubscribe.

When you save a tow rating

If you save a tow rating with our tow match tool, we keep the braked towing capacity and, if you give it, the towball download limit you entered, with your account. We use them only to show you your saved rating on the tow match page and "Within your tow rating" on ads, while you are signed in. You can clear them on the tow match page at any time, and they are deleted when your account is erased.

When you subscribe to our emails

Our newsletters are separate email lists: general news and updates, buyers, sellers and dealers. You choose each list yourself; every box starts unticked, and agreeing to one list never signs you up to another. When you sign up on one of our forms, we send a link to confirm first, and nothing else is sent until you click it (double opt-in). If you do not confirm within 7 days, the request lapses and we send no reminder. We send at most one confirmation email a day and three in all to an address that never confirms, and if you use the "Not you? Remove this address" link in a confirmation email, we send nothing more to that address for six months, even if someone enters it again. A change you make while signed in to your account, or on the page reached from the "Change your lists" link in one of our emails, takes effect straight away, because we already know the address is yours.

When you subscribe we collect your email address, the lists you choose, and a record of your consent: the time, the page and form you used, your IP address, the exact wording you agreed to and the version of this policy shown with it. If you change your lists from your account settings, we record that change the same way. We use this only to send the emails you asked for and to prove you asked for them. We do not sell or share your address, and we never add you to a list you did not choose.

Every newsletter has a one-click unsubscribe link and a link to choose your lists, both working without signing in, and you can also reply to any of our emails to unsubscribe. Leaving one list does not affect the others, or your sign-in codes, receipts and saved-search alerts; a separate choice stops every non-essential email from us.

Newsletters are sent through Amazon Web Services (Amazon SES), which processes your address to deliver them, including outside Australia (see who we share it with, below). We do not put tracking pixels in our emails, so we do not know whether you opened one. Links in a newsletter go through our own site first. We record which subscriber clicked which link, keep that for 13 months, and use it only to count clicks for each newsletter and to look after the lists: someone who has not clicked anything for 12 months may be asked to confirm they still want our emails, or taken off the list. We do not use it to build a profile of you or for anything else. Your address comes from you, through one of our forms or your account, or from a sign-up record someone gave us that shows your consent (for example a sign-up sheet at an event); even then, nothing is sent until you confirm the link we email you. If you ask, we will tell you which.

When you pay for something

Payments are handled by Stripe. We never see or store your full card or bank account number. We keep a record of the order, the amount and the result.

When you use the contact form

We collect your name, email address and message so we can reply.

When you use our iPhone app

Our iPhone app uses the same account and shows the same ads as the website, so everything in this policy applies to it too. The app also sends us a few things of its own:

• An install id. When you first open the app, it makes a random number and sends it with each request. It names that copy of the app, not you or your phone, and deleting the app deletes it. With your sign-in we keep only a scrambled (hashed) form of it, so that a sign-in link we email you works only in the app that asked for it. We also use a scrambled form of it to limit how many error reports and ad views one copy of the app can send, and never store it with them. When you sign in, we record your phone's model (such as iPhone 16, never the name you gave your phone) and the app's version, and show them in your list of sessions.
• Push notifications. If you allow them, the app gives us a push token: the address that Expo and Apple use to deliver notifications to that phone. We keep it with your account, along with the switches you set in the app for each kind of notification (new messages, saved search alerts, price drops, changes to your ads, and news, which starts off). Signing out or deleting your account stops them, and we delete the token 30 days later.
• Error reports. When something goes wrong, the app sends us a short report: what went wrong, the screen it was on and the app's version. It is not linked to your account, and we remove email addresses, phone numbers and other long numbers from it. It goes to our server logs only, and we use it only to fix faults.
• Ad views. When you open an ad, the app tells us, so the seller can see how many people looked at it. We count one view a day for each ad from each connection, using a scrambled key that we delete within three days, and we never record who viewed an ad.
• Your postcode, only if you ask. If you tap "Use my location" when you search, the app asks your permission, works out your postcode on your phone and sends us only the postcode, never your position. We use it to find ads near you, and keep it only with a search you choose to save.

Expo (Expo, Inc., in the United States) delivers the app's push notifications and its updates for us. For a push notification, it receives the push token and what the notification says. Each time the app starts, it asks Expo's servers whether there is an update to download, and Expo receives your phone's internet (IP) address, which version of the app it is running and a random id that Expo's update service makes for that copy of the app, but nothing about your account.

Cookies and analytics

Public pages look the same to every visitor. Apart from one cookie that remembers your answer to the analytics question, we set cookies only when you sign in, start an ad or pay for something, and only to make those features work.

We use Google Analytics to count visits and learn which pages help buyers and sellers. Advertising features and advertising signals are turned off. Google Analytics loads only if you choose to allow analytics in the notice on the site, and from then on it sets its own cookies. You can change your choice at any time with the Analytics choices button at the foot of each page; your choice is kept in your browser's local storage and in a small cookie called bd_consent for 12 months, so we don't ask again on every visit. That cookie holds only your answer and is never sent to Google. Ads you save are also kept in your browser's local storage, and in your account when you are signed in. Forms are protected by Cloudflare Turnstile, which checks that a person, not a bot, is sending them. Cloudflare, which protects and delivers the site, may also set its own short-lived security cookies (such as cf_clearance or __cf_bm) to tell people from automated traffic; they are not used for analytics or advertising.

How we use personal information

We use personal information to:

• run the site, show your ads and pass messages between buyers and sellers
• check ads and accounts for scams, rebirthed or stolen vehicles, and misuse
• process payments and send receipts
• send the emails the service depends on, such as sign-in codes, enquiries, the reminder before each monthly renewal of your ad and renewal reminders for dealer plans
• send the newsletters you subscribed to, and only those lists, with a record of your consent (see when you subscribe to our emails)
• answer your questions and complaints
• keep the site secure, measure how it performs and improve it
• meet our legal obligations

We do not sell personal information and we do not use it for advertising on other sites.

Automated checks and decisions

We use automated checks, including an AI model, to help decide whether an ad can go live, should be held for a person to check, or should be rejected, and whether an enquiry or a phone number reveal needs an extra check first. These decisions can affect you, so this section explains them.

The checks use:

• the text, photos and price of the ad
• how long the account has existed and how many ads it has posted recently
• the country the connection comes from
• whether the photos, the description or the VIN match another seller's ads
• whether the ad contains contact details that belong in the contact fields
• for a private seller, how many vehicles the account has listed in the past 12 months, compared with the lowest number at which any state the account's ads are in treats selling as dealing

Our automated checks approve some ads, and a person approves the rest; at times a person approves every ad. When a check holds or rejects an ad, or blocks an enquiry, we tell you it was an automated check and you can ask for a person to review it. If we can't approve your ad, we'll tell you why so you can fix it. If a rejected ad is deleted instead, we refund what you paid for it in full. Our terms set out how. We aim to review a request within one business hour during our moderation hours, and we tell you the outcome. If a check fails or times out, the ad is held for a person; it is never approved by default. For a private seller, an automated count can flag the account when the number of vehicles listed in 12 months reaches the lowest number set by any state the account's ads are in: when the seller submits the ad that reaches it (after the seller confirms the vehicles are their own), or in a nightly check that does not ask the seller first. While an account is flagged, each new ad from it waits for a person before it can go live. It is never rejected automatically, and the flag stays until a person reviews the account and lifts it.

Who we share it with

We share personal information only as needed to run the site:

• with the other party to a sale, to the extent you choose (for example, when you send an enquiry or a buyer reveals your phone number)
• with the service providers that host and operate the site for us: hosting and security (Cloudflare and our server providers), email delivery including our newsletters (Amazon Web Services; we use no mailing-list company), text message checks (Twilio), payments (Stripe), push notifications and updates for our iPhone app (Expo), analytics (Google), and the AI model that helps with moderation (Anthropic)
• with the Australian Business Register, to check the ABN a dealer gives us
• with police, regulators or courts when the law requires it, or when we believe it is needed to prevent fraud or harm

Some of these providers store or process information outside Australia, including in the United States. We choose providers that protect information to standards comparable to the Australian Privacy Principles, and we give them only what they need.

How long we keep it

We keep information only as long as we need it:

Ads and accounts stay while your account is open, and you can delete them at any time. Some records, such as payments and receipts, are kept for longer where tax or other laws require it.

Security

We protect personal information with encryption in transit, encrypted storage for VINs, chassis numbers and engine numbers, restricted staff access, security monitoring and regular tested backups. No system is perfectly secure; if a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the law requires.

Your choices and rights

You can:

• see and update your details, your ads and your sessions in your account
• delete an ad or close your account
• turn analytics off from the notice on the site
• unsubscribe from any newsletter with the link at the foot of each email, change your lists from that email or your account settings, or reply to any of our emails
• ask us for a copy of the personal information we hold about you, or ask us to correct it

Send access, correction or deletion requests through the contact form. We will respond within 30 days. We may need to confirm your identity first.

Complaints

If you think we have mishandled your personal information, tell us through the contact form and we will investigate and reply in writing. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner.

Changes to this policy

We will update this policy when our practices change and show the date it was last reviewed below. If a change materially affects how we use information you have already given us, we will tell you by email before it takes effect.