Privacy Policy

About this policy

The FitFourby website and services are operated by FITFOURBY PTY LTD, ACN 703 106 665, ABN 39 703 106 665. Contact us at hello@fitfourby.com.au and mark privacy requests or complaints for the Privacy Officer.

This policy applies to the FitFourby website and the account and enquiry services you use. It also explains the limits of features available only to invited testers.

We aim to follow the Australian Privacy Principles in our information-handling practices and comply with the privacy laws that apply to us. This policy explains those practices. Acknowledging it does not give us unlimited permission to use your information, waive your rights or subscribe you to marketing. Our Terms of Use deal separately with the service contract.

Company transition, 9 October 2026. This policy identifies the company for the services it operates from this date. Historical consent and contract records are retained as evidence and are not rewritten. A change of operator does not create fresh marketing consent or permission for a new use of personal information. Contact the Privacy Officer about information collected before this change or to exercise your access, correction or deletion rights.

Your choices

You can browse articles, compare vehicles and products, use calculators and search the fitter directory without an account. Some tools remember choices on your device. An account is needed to save builds to our server, retrieve account reports and use private weighbridge records. Anonymous browser builds are imported to an account only when you choose to import them.

We ask for information relevant to the feature or request. Without the necessary contact details we may be unable to answer an enquiry; without account credentials we cannot provide account storage; without suitable measurements we cannot produce a meaningful personalised calculation. Optional marketing, research and publication permissions remain separate from access to ordinary account services.

Information we collect and why

• Accounts: name, email, account identifier, verification and security information, profile changes, and records of the agreement version and affirmative action used to create the account. We store password hashes rather than readable passwords. Privacy notice acknowledgement is recorded separately from contractual acceptance.
• Garage and reports: vehicle/configuration choices, build names, accessories, loads, entered measurements, notes and saved report snapshots, so you can plan and retrieve your work. These records can reveal information about you when linked to your account.
• Enquiries and work: your name, email and any phone number, organisation, vehicle information, requested service, correspondence or supporting details you provide for contact, advisory, fleet, directory or editorial requests. If you engage us, we also keep the agreed scope, deliverables, communications and necessary invoice or transaction records.
• Directory submissions: business and branch details, services, public contact details, source information and the submitting person's contact details and authority. Public listing information is distinguished from private enquiry correspondence.
• Technical and security information: requests, device/browser information, network address, session and event times, and limited identifiers needed to operate the website, detect abuse and troubleshoot. The application uses keyed hashes for some security identifiers; hashing does not necessarily make information anonymous.
• Files and free text: information you include in an available upload or message. Please remove unnecessary registration/VIN numbers, addresses, other people's details and sensitive information before submitting. Do not send identity documents, payment card details or unrelated health information through an enquiry.

Information comes from you, your interaction with the service and, for directory/source verification, published business or manufacturer material. If someone refers an enquiry to us with your authority, we identify the source and purpose when reasonably practicable. We do not require a home address for ordinary account creation. Specific paid work may require billing or business details agreed at that point.

Cookies, browser storage and location

Essential session cookies keep you signed in and security cookies help protect requests. The session cookie has a maximum life of 30 days and the separate request-protection cookie one hour; sessions can end sooner after inactivity, revocation or sign-out. You can manage cookies in your browser, but blocking essential cookies can prevent account features working.

Local storage remembers selected vehicles and browser-only Garage builds until you delete them or clear site data. Session storage remembers comparison lists and navigation state for the browser session. We do not store login-form passwords in this storage. A password manager may separately offer to save your password under its own controls. Signing out or deleting a server account does not erase browser-only data on every device.

Fitter postcode and suburb searches calculate results in your browser. If you choose the location button, your browser asks permission to obtain coordinates for nearby results. The current application does not submit those coordinates to an account record or track your journeys. Your device's location service and any third-party map you choose to open have their own practices.

Private weighbridge records and optional research

Available account features let you enter measured figures or upload a PDF, JPEG or PNG ticket. We reconstruct a cleaned copy of the file and store it privately with the measurement context and correction history. Cleaning the file is a security measure; it does not reliably remove every visible personal detail, so redact unnecessary details first. Upload processing may be unavailable if the required local tools cannot safely process the file; manual entry remains an alternative.

New records stay with your account until you delete the record or account, subject to the retention review described below. Earlier records with a shorter promised expiry keep that limit. User-confirmed information remains distinct from staff-verified information.

Research use is optional and separately selected. If you opt in, staff-verified measurements may contribute to research and aggregate findings about the same vehicle configuration and loading conditions. The current research design requires at least ten distinct consenting accounts in a group and excludes original files, registrations, VINs, addresses and individual measurements from publication. A minimum group size alone does not establish de-identification: we must also assess re-identification risk before release. Commercial aggregate use requires separate operational approval.

You can withdraw research permission without losing private access to your saved measurements. We then stop including your identifiable records in future research use. We cannot reliably remove your contribution from findings already irreversibly de-identified and aggregated. We do not publish your original ticket or individual record through this research permission.

Reports and private feature testing

Personalised Build Reports are encrypted snapshots retained in your account history until you delete the report or account, subject to backups and justified retention. Comparison PDF exports are generated for direct download and do not create Build Report history. Neither action creates a marketing subscription.

Private comparison-PDF email delivery is an experimental, separately gated feature. Its stored delivery address, PDF and download link expire after 24 hours. Local test delivery writes a private test message and does not send it externally.

Invited Garage+ testing can include modifications, costs, maintenance, warranties, quotes, attachments and selected report snapshots. This is not a generally available paid membership feature. Original attachments and reconstructed previews are held privately; original file and report storage is encrypted. Selected advisor sharing, where available, requires your deliberate choice of recipient and records, expires within 30 days and can be revoked earlier. Revocation prevents further service access but cannot retrieve copies a recipient has already downloaded. Private pilot feature-event counts help assess the pilot; they do not make your vehicle or files public.

Enquiries, directory contacts and publication

We use form details to review and answer your request and administer any work you agree to. Acknowledgement and service messages are transactional. A directory call, email, website or map link takes you directly to the selected third party; it is not permission for us to distribute your enquiry to a list of businesses. Where advisory work would benefit from sending your requirements to a workshop or another specialist, we first explain the proposed recipient and purpose and obtain your direction.

Gallery/build submission forms currently collect an editorial enquiry, rather than immediately publishing a public post or accepting a general image upload. We confirm the proposed content and publication permission before publishing. Where you submit business listing details for publication, the applicable Fitter and Business Listing Terms explain the listing arrangement. The user content provisions explain content permissions. We do not publish private account builds or tickets merely because you use the service.

For an advisory question proposed for publication, we seek separate permission and remove details that could reasonably identify you. Contact us to withdraw permission or request removal. We address copies under our control; we cannot guarantee removal of independent third-party copies or search caches.

Service providers and overseas handling

Authorised people and service providers may handle information needed for website/database hosting, security, delivery of requested messages, support, backups and professional advice. Where a feature is active, its providers receive the information required for that purpose. We restrict access and assess provider safeguards; we do not promise that information is never shared.

Resend handles requested transactional email, including account verification, security messages and enquiry acknowledgements. Google Workspace handles messages sent to our business mailboxes. Where you allow optional analytics, Google Analytics processes browser and network information and public page/action data. Google may process this information in the United States and other countries; analytics is a separate optional choice, not a condition of an account. Payment collection, marketing subscriptions and advertising are not active. We explain additional service providers before enabling a feature that needs them.

Some providers may process information outside Australia. We take the safeguards required by applicable law and make information about applicable provider locations available on request, including the countries where practicable. General acceptance of our Terms or acknowledgement of this policy is not consent to bypass overseas-disclosure protections. A feature requiring specific consent will explain the recipient, purpose and choice at that point.

Other disclosures and commercial relationships

We may disclose information with your direction, to obtain confidential professional advice, or when a law, court order or other lawful basis permits or requires it. If the business is reorganised or transferred, any disclosure must be reasonably necessary, protected during due diligence and consistent with applicable law; an asset transfer is not permission for unrelated marketing.

Our current service does not sell, rent or trade personal information. A future commercial referral or data proposal requires a fresh privacy assessment and appropriate notice or permission before it starts. Sponsorship or a referral fee does not authorise undisclosed sharing of your contact details. Relevant commercial relationships must also be disclosed where they affect a recommendation or placement.

Analytics, advertising and automated processing

We count article-link clicks on our own server to help order relevant articles. These aggregate counts do not contain account details, cookies, comparison choices or vehicle profiles; brief request controls help limit repeated or automated clicks.

When configured, we offer optional Google Analytics 4 to measure visits and selected actions on public pages. Google’s tag loads only after you choose Allow analytics. Declining leaves it unloaded. You can change your choice using Analytics preferences in the footer on public pages. Account, login, garage, report, admin, password-reset and verification pages are excluded. We do not add query strings, fragments, form contents, account IDs, enquiry references or vehicle/build values to analytics events. Public page paths and origin-only referrers are used; Google also processes browser and network information. Browser and device identifiers can be personal information. Consent-dependent reports estimate browsers and cannot reliably identify every person or deduplicate multiple devices.

Advertising features, Google signals, advertising personalisation, user-provided data collection and advertising links are disabled. Optional analytics cookies last up to 180 days without extending on each visit; a versioned choice is remembered locally for up to 180 days. Withdrawing permission disables collection and clears accessible analytics cookies, but does not erase information already processed. We configure Google’s event/user retention to two months; standard aggregated reports have separate retention rules. Google's Privacy Policy and retention information explain its practices. New advertising or other materially different processing requires another assessment and the applicable notice or permission.

Calculators use supplied figures and assumptions to provide planning information. They do not grant engineering approval or determine legal entitlement. We use automated security checks to limit abuse. No third-party AI service is integrated to process customer account or ticket content in the current service. If we introduce customer-facing AI, cloud extraction or materially significant automated decisions, we will assess the information flow and legal requirements and explain them before use. Staff must not submit identifiable customer information to an unapproved AI service.

Marketing preferences

Newsletter subscription is currently disabled. Creating an account, requesting advice, using a calculator or generating a report does not subscribe you. If marketing is offered later, the choice will be optional and separate, with the channel and purpose explained. We record the wording/version, time and method of your choice.

Applicable commercial messages must identify the sender and provide a working, straightforward unsubscribe option. We will action unsubscribe requests within five working days, without requiring an account login or an extra fee. We may keep a minimal suppression record so we respect your choice, and necessary evidence of consent. Requested service and security messages may continue where necessary, without unrelated promotions.

Retention and account deletion

We keep information for its stated purpose while it remains reasonably needed, then delete or de-identify it, unless a specific legal obligation, dispute or other lawful need justifies limited retention. We review purpose and necessity rather than treating cheap storage as a reason to keep everything. Retention varies by the type of record and its purpose; there is no single automatic deletion period for every category.

Account deletion requires a confirmed request. It removes access and current account-linked Garage, report, ticket and security-factor records. Private file cleanup is retried if it cannot finish immediately. Separate enquiries, client work, invoice records, minimal agreement/security evidence and deletion-reconciliation records may need a separate review. Some security records contain an account identifier or keyed network hash and are not automatically anonymous.

Expired session and security-token data is removed on a rolling maintenance cycle. Expiring experimental PDF delivery records are removed after their stated period. There is no automatic 90-day purge of every security log and no guarantee that all information in every system disappears within 30 days.

Protected backups are not used as an ordinary customer database. Deleted information may remain there until the applicable backup expires. Restoration must reconcile completed deletions before restoring ordinary access. Contact us for information about the backup retention that applies to your request. We will explain any justified exception or outstanding cleanup when responding to a deletion request. Browser-only copies and copies you have downloaded remain under your control.

Security and incidents

We use access restrictions, authentication, request limits, security logging and protected storage appropriate to the information. Passwords and tokens use one-way protections; selected private report and attachment content is encrypted. Authorised staff access is limited to service or security purposes. These measures reduce risk but cannot guarantee that an incident will never occur.

If a suspected breach occurs, we contain it, preserve evidence, assess risk and take protective action. We notify affected people and regulators when required, including under the Notifiable Data Breaches scheme where it applies, and consider additional notifications that help prevent harm. We do not delay urgent protective action while waiting for an assessment deadline.

Access, correction and complaints

Your account provides available export, correction and deletion controls. The export covers supported account records; it is not necessarily every enquiry, business record or processor log that may relate to you. To request access, correction, deletion, withdrawal of optional permission or help with a privacy concern, email hello@fitfourby.com.au. We check identity or authority proportionately and avoid requesting unnecessary identity documents.

We aim to respond within 30 calendar days. If a request needs longer, we explain why and give a progress update. We do not charge to make a request or correct information. If access cannot be provided in full, we explain the lawful reason, consider a practical alternative and explain complaint options. Where appropriate, you can ask us to associate your correction statement with disputed information.

Tell us first if you are dissatisfied so we can investigate. You may also contact the Office of the Australian Information Commissioner, which can explain whether it has jurisdiction over your complaint. This process does not limit another right or remedy available by law.

Children and overseas visitors

Public information can be browsed without declaring an age. Account and paid-service eligibility is described in the Terms of Use. We do not collect a date of birth, identity document or biometric age evidence for ordinary signup. Tell us if a child has created an account contrary to those rules or if information about a child has been submitted unnecessarily so we can investigate and take appropriate action.

FitFourby currently focuses on Australian vehicles and users. Technical access from another country does not mean we have introduced a local service there. Before actively expanding into a new market or introducing monitoring that engages another jurisdiction's laws, we assess the additional requirements. This policy does not remove protections that already apply to an individual by law.

Changes to this policy

We identify versions and dates and keep historical versions internally. For a material change to information handling, we provide an appropriate notice before the change where required and obtain a new specific consent where the proposed activity needs it. A new policy version does not retrospectively authorise incompatible use. Typographical changes do not normally need a fresh acknowledgement, and privacy updates are not automatically a demand to re-accept the service contract.