DODO Privacy Policy

1. Introduction

DODO TRANSPORT PTY LTD (“DODO”, “we”, “us” or “our”) provides technology connecting people requesting transportation services (Riders) with independent drivers providing transportation services (Drivers). ABN 37 690 944 177, Redbank Plains, Queensland, Australia. Phone: 0415 152 099. Last updated: 1 November 2026.

This Privacy Policy explains how DODO collects, holds, uses, discloses and protects personal information when you use the DODO Rider application, DODO Driver application, website, apply as a Driver, take a trip, contact support, or interact with DODO.

DODO is committed to handling personal information consistently with applicable Australian privacy law, including the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs).

Some information is necessary to provide services (account creation, booking dispatch, Driver verification, trip communication).

2. What Personal Information DODO Collects

2.1 Account and contact information: Full name, email address, mobile telephone number, address, account identifiers, profile photograph, preferences, authentication records, and status.

2.2 Driver information: Driver’s licence, booked hire driver authorisation, booked hire service licence, vehicle registration and compulsory third party insurance, certificate of inspection (COI), commercial vehicle insurance, document expiry dates, vehicle make/model/year/colour/plate, photos of the vehicle, profile photo, and onboarding and approval status. Driver documents and photos are uploaded to private storage for review by DODO.

2.3 Trip and booking information: Pickup, destination, intermediate stops, coordinates, route, distance, duration, ETAs, Driver live location while available or en route, timestamps, fares, tolls, tips, cancellations, ratings, and transaction history.

3. Location Information

Location data is collected while searching/requesting trips, travelling to pickup, completing trips, navigating, tracking Driver approach, and while a Driver is online and available.

Drivers may need to permit background location processing while online or during an active trip so riders and dispatch systems receive current location.

4. Device and Technical Information

We collect your device's notification token. Our service providers' systems record technical information such as your IP address, device type, operating system, app version, and sign-in and security events. If you have chosen on your device to share diagnostics with app developers, Apple or Google may give DODO crash reports.

5. Device Permissions

• Location — The Rider app uses your location while you are using the app, to find your pickup point and show nearby rides. The Driver app uses location while the Driver is online or on a trip, including when the app is in the background, so that Riders and DODO's dispatch system receive the Driver's current location and the Driver can navigate.
• Camera and photo library — Used in the DODO Driver app to take or upload ordinary photos: a profile photo, vehicle photos, and photos of licences, registration and other compliance documents. The Rider app does not use the camera.
• Microphone — The DODO apps do not record audio or use your microphone. The Driver app plays alert sounds and speaks navigation directions out loud. An audio component it uses lists a microphone permission in the app's settings on Android and iPhone, but the app never asks for or uses it.
• Notifications — Used for trip requests and updates, cancellations, earnings, tips and payouts, document and account updates, and support replies. Notifications are sent through Expo's push notification service and Apple or Google.
• Face ID and fingerprint (Driver app, optional) — Lets a Driver unlock the app with the phone's own Face ID or fingerprint check. See section 10–11.
• Phone functionality — Used to open your phone's dialler to call DODO or to make a masked, privacy-protected call between Rider and Driver.

6. Rider and Driver Communications

Private Call Masking: Where available, calls between a Rider and a Driver are connected through Twilio's call-masking service, so neither sees the other's private phone number. Each masked connection is set up for a single trip.

Masked telephone numbers are routing numbers and are not public customer-support lines.

DODO customer support is reachable at 0415 152 099.

7. Messages and Communications Records

Communications sent through DODO may be retained where reasonably necessary to provide support, investigate disputes or safety incidents, prevent fraud, and meet legal obligations.

DODO's apps and systems do not ask Twilio to record calls, and DODO does not record ordinary telephone calls.

8. Payment and Financial Information

Riders: card payments are processed by Stripe. You enter your card details into Stripe's payment form, and DODO does not receive or store your full card number. DODO stores Stripe customer and payment identifiers and payment status, and the app shows your card brand and last four digits as provided by Stripe.

Drivers: payouts are made through Stripe Connect. Stripe collects the identity and bank account details it needs during onboarding, and DODO receives the status of the Driver's Stripe account. DODO keeps trip, fare, toll, tip and earnings records to calculate payouts and refunds.

9. Ratings, Feedback, Complaints and Safety

We collect ratings, complaints, incident and safety reports, lost property reports, and any evidence you choose to give us, to maintain platform quality and safety.

10–11. Sensitive Information & Biometrics

Sensitive information (for example accessibility needs, or health information in an incident report) is collected only where the law allows it and, where required, with your consent, and access to it is restricted.

Biometrics: DODO does not collect biometric information. It does not use facial recognition and does not create biometric templates. Profile photos and document photos uploaded by Drivers are ordinary photographs used for identification and verification. They are not processed with facial-recognition technology. If DODO introduces biometric verification, we will tell the people affected before it starts and ask for their consent where the law requires it.

If you choose to unlock the DODO Driver app with your phone's fingerprint or face unlock, that check happens on your phone. DODO does not receive your fingerprint or face data.

12–14. Collection, Use & Sharing

Collected directly from you, automatically when you use the apps, and from other users (for example ratings and complaints).

Used to administer accounts, match riders and drivers, navigate routes, process payments, verify compliance, detect fraud, and comply with transport and safety laws.

Limited information is shared between Rider and Driver to coordinate a trip. Riders see the Driver's first name, photo, rating, vehicle details and live location on the way to the pickup. Drivers see the Rider's name, rating, profile photo (if any), pickup and destination. Private phone numbers are not shared.

15. Automated Systems and Decision-Making

Some decisions are made automatically by our systems. For each one, we list the kinds of personal information it uses:

• offering a Rider's request to nearby online Drivers who are eligible for the requested service. A Driver chooses whether to accept it. This uses the pickup location, and Drivers' locations, online status, vehicle and eligibility;
• calculating the fare shown before a trip from the service's base fare and its rates for the trip's distance and estimated time. This uses the pickup and destination you enter; and
• taking a Driver offline, and not offering them trips, when they no longer meet DODO's requirements to drive, for example when a required document has expired or their account is not active. A Driver on a trip is not taken offline until the trip ends. This uses the Driver's document expiry dates, approval status and account status.

If you think an automated decision about you is wrong, call 0415 152 099 and a member of our team will review it.

16–17. Cookies, Web & Marketing

The DODO apps and website use device and browser storage for security and to make features work. When the website's pre-booking and contact forms are open, the website keeps a temporary identifier in your browser's session storage so a form is not submitted twice. The driver application form does not store information in your browser. The booking website does not store information in your browser. The DODO website does not use advertising or analytics cookies.

We send direct marketing only where you have agreed to receive it. Every marketing message includes a way to unsubscribe, and we act on unsubscribe requests within the time required by the Spam Act 2003 (Cth).

18–20. Service Providers, Overseas Disclosure & Authorities

Service providers that handle personal information for DODO include:

• Supabase: database, sign-in, file storage and server functions for the apps.
• Stripe: card payments and Driver payouts.
• Twilio: masked calls between Riders and Drivers, where available.
• Google Maps Platform: maps, place search, directions and route information in the apps.
• OSRM routing service (router.project-osrm.org): route calculation in the apps, using trip start and end points.
• OpenStreetMap Nominatim and BigDataCloud: turning map coordinates into street addresses in the Rider app.
• Expo: delivery of app notifications.
• Resend: some emails sent by DODO's systems.

Our websites. When you visit www.dodotransport.com.au or booking.dodotransport.com.au, your browser connects to the following services. They receive your device's IP address and basic browser information as part of normal web requests:

• GitHub Pages (GitHub, Inc.) hosts both websites.
• Google Fonts (Google) supplies the typeface on www.dodotransport.com.au.
• Online booking and contact forms at booking.dodotransport.com.au: when you submit a form, your details are sent to DODO's booking relay, a Google Apps Script service run by Google in DODO's Google account, which emails them to DODO's booking inbox (hosted by Google Gmail) through FormSubmit (formsubmit.co), a third-party form service. Your details are not stored on the website. DODO's relay does not save your details; Google keeps technical records of the relay's operation, and the email stays in DODO's inbox until it is deleted. FormSubmit's privacy policy does not say how long it keeps messages.
• Map on the booking page: the map software (Leaflet) is loaded from unpkg.com and the map images from OpenStreetMap. When you submit a booking, the destination you entered is sent to OpenStreetMap Nominatim to show it on the map. Your device's location is used only if you tap "Refresh Map" and allow it in your browser.
• Website pre-booking and contact forms on www.dodotransport.com.au are not currently in use. When they are open, they send your details to DODO's systems hosted by Supabase, and confirmation emails are sent through Resend.
• Driver application form on www.dodotransport.com.au, when it is open: when you submit it, your details are sent to DODO's driver application relay, a Google Apps Script service run by Google in DODO's Google account, which emails them to DODO's inbox (hosted by Google Gmail). Your details are not stored on the website. The relay does not save them; it keeps one-way fingerprints for up to 6 hours to stop repeated applications. The form asks for your name, email, phone, the state you live in, the state you want to drive in, how long you have held your licence, whether you have an ABN and basic vehicle details. It does not ask for licence numbers or documents.
• Account deletion request form on www.dodotransport.com.au/delete-account, when it is open: when you submit it, your request (account type, the email address you give, and any phone number and additional information you choose to give) is sent to DODO's account deletion relay, a Google Apps Script service run by Google in DODO's Google account. The relay records the request in a private Google Sheets spreadsheet in DODO's Google account, which only staff authorised by DODO can open, and emails it to DODO's inbox (hosted by Google Gmail). Your details are not stored on the website. The relay keeps one-way fingerprints for up to 6 hours to limit repeated requests. The relay does not check whether an account exists and does not change or delete any account. The form never asks for passwords, sign-in codes, card details or identity documents.
• TikTok receives information only if you follow our link to TikTok.

Overseas. DODO's main database is hosted by Supabase in South Korea (Amazon Web Services, Seoul region). Several other service providers, including Stripe, Twilio, Google (including Google Maps Platform, Google Apps Script, Google Sheets and Gmail), Expo, GitHub and Resend, are based in the United States and may handle information there or in other countries where they operate. Some providers, including FormSubmit, the OSRM routing service and BigDataCloud, do not state in the information available to us where they process information, so information may be handled outside Australia. These providers handle information under their own terms of service and privacy policies.

We disclose personal information to government bodies where the law requires it. Depending on DODO's obligations under Queensland passenger transport law and tax law, this can include:

• the Queensland Department of Transport and Main Roads: booking records when requested, regular reports containing details of Drivers, vehicles and trips, and a notice if we end a Driver's arrangement because of serious safety misconduct; and
• the Australian Taxation Office: twice-yearly reports of Drivers' identity, ABN and payment details under the Sharing Economy Reporting Regime.

We may also disclose information to police, courts or insurers where the law requires or permits it, including for serious safety investigations.

21–23. Storage, Security, Data Breaches & Retention

We protect personal information with security measures including encrypted connections (HTTPS/TLS) to our apps, website and database services, access controls, role-based permissions and database access rules.

If a data breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner, following the Notifiable Data Breaches scheme.

We keep personal information only for as long as we need it for the purposes in this policy or as the law requires. When we no longer need information, we take reasonable steps to delete or de-identify it. A deletion request does not override a legal duty to keep records. Our retention periods are:

• General enquiries and contact messages (including privacy enquiries): 12 months after the enquiry is resolved.
• Booking requests that do not go ahead (not confirmed, declined or cancelled before confirmation): 2 years after the request is received, as Queensland passenger transport law requires for trips that are requested but not provided.
• Confirmed bookings and trips: at least 2 years after the trip, as Queensland passenger transport law requires for booking and trip records.
• Completed trips with payment or financial records: 7 years after the transaction, as required for financial records by the Corporations Act 2001 (Cth), which also covers tax record-keeping periods.
• Privacy complaints: 2 years after the complaint is closed.
• In-app trip messages between Riders and Drivers: kept for support and safety; a deletion period has not yet been set.
• Driver records (including name, driver authorisation number and the dates the Driver started and stopped driving with DODO): at least 2 years after the Driver stops driving with DODO, as Queensland passenger transport law requires.
• Driver applications received through the website: a deletion period has not yet been set.
• Account deletion requests and the record of how DODO handled them: kept as evidence that the request was dealt with; a deletion period has not yet been set.

Deleting records at the end of these periods is not yet automated. DODO is setting up the processes needed, and until they are in place some records may be kept longer than the periods above.

24–27. Access, Correction, Choices & Account Deletion

Under APPs 12 & 13, you may request access to and correction of your personal information. Contact us by phone on 0415 152 099 or through our online contact form. We may need to confirm your identity before we provide or change information. We aim to respond within 30 days, and we will tell you if we need more time and why.

You can update some of your details in the apps.

Deleting your account. You can ask DODO to delete your DODO Rider or DODO Driver account and the personal information linked to it. Our Delete Your Account page (www.dodotransport.com.au/delete-account) explains the steps. You can ask:

• in the app (DODO Rider: Account → Delete Account; DODO Driver: Profile → App Settings → Delete Account). The request is saved in DODO's support system (hosted by Supabase) with your account details, and you are signed out;
• through the online request form on that page, when it is open (see section 18–20 for how the form's details are handled); or
• by phone on 0415 152 099.

A request does not delete anything by itself. Authorised DODO staff handle each request by hand:

1. We check that the request comes from the account holder. A request made in the app while signed in already does. For other requests, DODO Support contacts you using the details already held in your account. Until then we do not confirm whether an account exists for the details given. We never ask for your password, a sign-in code, card details or identity documents.
2. We resolve anything outstanding first, such as an active trip, an unpaid fare, a refund, a Driver payout, or an open dispute, complaint or safety matter.
3. We close the account and delete or de-identify the personal information we no longer need. We keep the booking, trip, driver and payment records the law requires, for the periods in section 21–23, and protect them until they are deleted or de-identified at the end of those periods. Our payment provider Stripe keeps its own records under its legal obligations.
4. DODO Support confirms to you when your request has been processed, through the support chat in the DODO app, by phone from DODO, or by email from an @dodotransport.com.au address, and tells you which records are kept and why. We never contact you from a personal email address.

28–29. Changes, Complaints & Privacy Officer Contact

Policy updates will be published with a revised effective date.

Privacy enquiries and complaints. Contact DODO's Privacy Officer by phone on 0415 152 099 or through our online contact form (please mention "privacy" in your message). DODO TRANSPORT PTY LTD, Redbank Plains, Queensland, Australia.

How we handle a privacy complaint:

1. Acknowledgement: we aim to acknowledge your complaint within 3 business days.
2. Investigation: we look into what happened, may ask you for more information, and may need to confirm your identity.
3. Escalation: if the matter cannot be resolved by the person handling it, it is referred to a DODO director.
4. Written response: we give you a written response explaining what we found and what we will do. We aim to respond within 30 days of receiving your complaint; if a complaint is complex and needs longer, we will tell you why and when you can expect our response.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au