Privacy policy

1. Overview

TAS DroneXchange is operated by Timed Automation Solutions Pty Ltd ACN 686 774 872 (TAS, we, us, or our). This Privacy Policy explains what personal information we collect, why we need it, and how we protect it when you use the marketplace.

TAS DroneXchange supports drone sales, rentals, buy requests, operator services, service provider profiles, messaging, video call requests, payments, verification, tax invoice workflows, dashboard notifications, and related admin review processes.

By using the marketplace you agree to this Privacy Policy and our Terms of Use.

2. Information we collect

Depending on how you use the platform, we may process:

• Account data: name, email address, phone number (if provided), password credentials (stored in protected form), account status, and related login details.
• Profile and role data: marketplace roles (such as buyer or renter, seller, host, operator, or service provider), profile details, and public profile content you choose to show.
• Location and service area data: suburb, postcode, state, country, and service coverage details you provide for listings, search, bookings, and provider profiles.
• Marketplace activity: listings, drafts, saved listings, orders, bookings, quotes, service requests, enquiry details, related status history, and listing report submissions.
• Public listing media: listing photos and public specification files you upload. These may be publicly accessible through marketplace pages and object storage or CDN URLs.
• Messages and conversation metadata: message content you send, conversation participants, linked listing or order references, timestamps, and read or unread status where available.
• Dashboard notifications and preferences: in-platform attention counts, notification settings, and related activity used to show updates in your dashboard.
• Verification documents and review outcomes: identity and compliance documents you upload or capture, selfie or liveness images where required, identity check session references and status from our identity verification partner, verification status, and authorised admin review notes.
• Business authority data: business type, authority documents (for example ASIC extracts or letters of authority), and related review status for service provider company profiles.
• ABN, GST, and business verification data: Australian Business Number, business name, GST registration status, and related verification results where provided, including lookup results from the Australian Business Register (ABR) where used.
• Authentication data: sign-in method, and identifiers from authentication providers such as Firebase Authentication, Google sign-in, or Facebook sign-in where you choose those options.
• Payment and Connect metadata: payment status, checkout or PaymentIntent references, Stripe Connect account identifiers and onboarding status, payout references, refund or dispute references, and related order payment records. We do not store full card numbers. Stripe may collect bank and identity details directly during Connect onboarding.
• Tax invoice and RCTI-related data: invoice numbers, order values, GST amounts, ex-GST and inc-GST amounts, and related buyer or seller transaction details.
• Video call request metadata: participants, conversation identifiers, request time, scheduled time, accept or decline status, and technical signalling data needed to connect a call (including LiveKit connection metadata where configured).
• Cancellation and refund records: cancel reason, policy tier applied, fee or refund amounts, acknowledgement of the cancellation policy, and credit-note references where relevant.
• Search and product analytics: search queries, filter selections, result counts, and related session or user identifiers used to improve search and marketplace reliability.
• Content page analytics: anonymous session identifiers and page names for public information pages such as Terms of use, About TAS, Privacy policy, Partnerships, and Frequently asked questions, used for operational reporting.
• Marketing measurement data: where Meta Pixel (Facebook Pixel) is enabled, page views and limited conversion events such as registration or contact actions, subject to Meta's terms and the exclusions described under Cookies and analytics.
• Technical and security data: session identifiers, timezone preference cookies, device or browser information where available, logs, and security events needed to operate and protect the service.

3. How we use information

We use personal information to:

• Provide marketplace features including search, listings, bookings, sales, buy requests, operator services, and service provider workflows.
• Authenticate users, maintain accounts, and help prevent fraud or abuse.
• Review verification submissions, run identity checks through approved partners where configured, and display trust badges only after approval.
• Facilitate messaging, video call requests, and other communications between marketplace participants.
• Process payments, refunds, payouts, deposits, and Stripe Connect onboarding through payment partners.
• Generate and retain tax invoice or RCTI-related records for marketplace transactions.
• Send transactional emails and dashboard notifications about messages, orders, verification outcomes, and account activity.
• Administer cancellations, refunds, fee retention, reschedule requests, listing reports, and related support.
• Measure and improve search, onboarding, and marketing performance where analytics or Meta Pixel are enabled.
• Improve reliability, troubleshoot issues, keep the platform secure, and meet legal obligations.

4. Verification and identity documents

Depending on your role and the verification steps available, we may collect and review:

• Identity documents (for example driver licence, passport, or proof of age card)
• Selfie, face image, or liveness capture where required for identity matching
• Remote Pilot Licence (RePL)
• Remote Operator Certificate (ReOC)
• Aviation Reference Number where provided
• Certificate of Currency or other insurance documents where provided
• ABN, GST, and ABR lookup results
• Business type and authority documents for company service provider profiles
• Admin verification notes and review status

Identity verification partners (including Didit)

Where identity verification is required or offered through an automated check, TAS may use a third-party identity verification provider such as Didit. In that flow you may be asked to provide a government-issued ID and a selfie or liveness capture using your device camera. Didit processes that information to complete the check on our behalf.

When Didit is used, TAS typically receives:

• Session identifiers and workflow status (for example approved, declined, or in progress)
• Verification outcome needed to update your marketplace identity status
• Limited supporting metadata needed for support, fraud prevention, and audit

Didit may process ID images, selfie or liveness images, and biometric data derived from those captures under its own notices. Please also read Didit's Verification Privacy Notice and End User Terms for Identity Verification. Completing a Didit check on TAS DroneXchange means you agree to those Didit terms for that verification session, in addition to this Privacy Policy.

Identity verification may involve overseas processing by Didit or its infrastructure providers. See Service providers and overseas processing below.

We store file metadata, session references, and review outcomes needed to manage verification. Private file paths are not exposed on public pages. Manual document upload remains available only where Didit is not required or not configured for that environment.

5. ABN, GST and tax invoice records

For sellers, operators, and service providers, the platform may process business and transaction details needed for marketplace trading and tax documentation, including:

• ABN
• Business name
• GST registration status
• GST effective date where available
• Buyer and seller transaction details
• Invoice number
• Order value
• GST amount
• Ex-GST and inc-GST amounts
• Tax invoice or recipient created tax invoice (RCTI) related records

Some financial and transaction records may need to be retained even after account closure for legal, accounting, taxation, dispute, or audit purposes.

6. Payments

When payment processing is enabled, payment card details are handled by payment providers such as Stripe. TAS DroneXchange does not store full card numbers on its own systems.

Paid marketplace charges use Stripe Connect with direct charges on the payee's connected Express account. We may store payment references, PaymentIntent or checkout IDs, Connect account status, payout references, refund or dispute references, and transaction metadata needed for order management, support, accounting, and dispute handling.

During Connect onboarding, Stripe may collect identity and bank details directly from the payee under Stripe's privacy policy. TAS receives status and identifiers needed to enable publishing and payouts.

Payment providers process payment information under their own privacy policies. Please review those policies for details of how they handle your payment data, including Stripe's privacy policy.

7. Video calls and communications

TAS DroneXchange may offer video call request features linked to marketplace conversations. Where you use those features, we may process call request metadata such as participants, conversation ID, request time, scheduled time, accept or decline status, and technical signalling data needed to establish the connection.

TAS DroneXchange does not record or store video or audio call content unless a separate recording feature is introduced and clearly disclosed to users.

Video calls may use browser WebRTC technology and third-party media services such as LiveKit (including relay or TURN capacity provided through that service). Those providers may process technical connection data under their own terms and privacy practices.

Messages you send through the platform are stored so you and the other party can continue the conversation and so TAS can support dispute handling and safety reviews where needed.

8. Notifications and email

We may send or display notifications related to your use of the marketplace, including:

• Dashboard notifications about orders, bookings, messages, reviews, and account updates
• Message notifications
• Order status notifications
• Verification outcome notifications
• Password reset and other account security emails
• Transactional emails about marketplace activity

Where configured, transactional email may be sent through a third-party email provider. Where notification preferences are available in your account settings, you can manage applicable platform notification choices. Some account and security emails are necessary to operate your account and cannot be turned off.

9. Cancellations, refunds and payment records

When you cancel an order, accept a quote, or pay for a booking, we process limited personal and transactional information needed to apply the platform cancellation policy, including:

• Order and party identifiers, workflow type, and status at the time of cancel or reschedule
• Whether you acknowledged the cancellation policy on checkout
• Fee retention (for example the post-schedule 25% buyer fee), full or partial refunds, automatic unscheduled refunds, bond return, and credit-note amounts calculated under the policy tiers
• Schedule reminder emails and timestamps for bookable orders
• Messages or reasons you provide when cancelling, requesting a reschedule, or settling a rental damage claim

Card refunds and payout adjustments are executed by the payment partner (for example Stripe). We store payment and refund references required for order history, support, taxation, and dispute handling. We do not store full card numbers on TAS DroneXchange servers.

Cancellation records are retained with the related order for as long as the order data is kept under Retention and backups, or longer where required for legal or financial record-keeping.

10. Sharing and disclosure

We do not sell personal information. We may share data:

• With other users as needed to complete marketplace transactions (for example, contact details visible in a booking, order, message, or video call request).
• With service providers that help operate hosting, authentication, storage, payments, email, maps, analytics, security, or communications, under appropriate agreements.
• With authorised administrators when investigating listing reports, disputes, safety concerns, or verification issues.
• When required by law, regulation, or to protect the rights, safety, and security of users and the public.

11. Service providers and overseas processing

TAS may use carefully selected third-party service providers to help deliver the marketplace. These may include providers for:

• Hosting and infrastructure (including Google Cloud or Firebase services where configured)
• Authentication and account security (including Firebase Authentication, Google sign-in, and Facebook sign-in)
• File and object storage
• Identity verification and fraud prevention (including Didit where configured)
• Business number lookups against the Australian Business Register (ABR)
• Payments (including Stripe and Stripe Connect)
• Email delivery
• Maps and location services
• Product analytics and marketing measurement (including Meta Pixel where enabled)
• Security monitoring
• Communications and LiveKit media or relay services used for video calls

Some service providers may process or store information outside Australia. Where that happens, TAS takes reasonable steps to use providers with appropriate privacy and security controls, and to put suitable arrangements in place for the service they provide.

Payment providers, identity verification partners, and authentication providers also process information under their own privacy policies. Examples include Stripe, Didit, and Firebase / Google.

12. Data hosting and control

We aim to operate with a strong Australian data sovereignty focus. At the same time, we use cloud infrastructure and third-party providers where needed to deliver a reliable, secure marketplace experience. That means some processing may occur through those providers, including outside Australia, as described in Service providers and overseas processing.

13. Retention and backups

We retain personal information for as long as needed to operate the marketplace, meet legal obligations, support accounting and taxation requirements, and resolve disputes. This may include:

• Account and profile data
• Listings, public listing media, and other marketplace content
• Order, booking, quote, and transaction records
• Messages and conversation metadata
• Verification documents and review outcomes
• Tax invoice, RCTI, and payment records
• Search analytics and security logs
• Backups created to protect platform continuity
• Records linked to deleted or closed accounts where retention is still required

When information is no longer required, we delete or anonymise it in line with our retention practices. Deletion requests may be limited where information must be kept for legal, financial, tax, dispute, safety, security, or audit purposes. Account deletion may also be delayed while open orders, unpaid balances, pending payouts, active disputes, or verification retention requirements remain. Residual copies may also remain in backups for a limited period until those backups rotate or expire.

14. Security

We take reasonable steps to protect personal information against misuse, interference, loss, and unauthorised access, modification, or disclosure. Measures may include:

• Access controls for accounts and administrative tools
• Private storage for verification and other sensitive uploads
• Partner-managed secure channels for automated identity checks where configured
• Secure upload handling and protected filenames
• Form and session protections designed to reduce common web risks
• Audit logging for relevant admin actions

No online service can be guaranteed completely secure. Please keep your login credentials confidential and tell us promptly if you suspect unauthorised access to your account through the Contact page.

15. Data breach response

If TAS becomes aware of unauthorised access to, loss of, or disclosure of personal information, we will assess the incident, take steps to contain it, and respond as appropriate. Where required by applicable Australian privacy law, TAS will notify affected individuals and the relevant regulator.

16. Your rights

Subject to applicable Australian privacy law, you may request to:

• Access personal information held about you
• Correct personal information that is inaccurate or out of date
• Delete your account or specific data where operationally and legally feasible (subject to open orders, payouts, disputes, and retention needs)
• Withdraw consent for optional processing where consent is the legal basis
• Ask us about how your personal information is handled

Use the Contact page or your account support options to make a request. We may need to verify your identity before acting on it.

17. Cookies and analytics

The platform uses essential session cookies to keep you signed in and to protect forms. We may also store a timezone preference cookie so dates and times display correctly for you.

Where Meta Pixel (Facebook Pixel) is configured, Meta may set or read cookies and receive limited event data such as PageView and selected conversion events (for example Lead, Contact, or CompleteRegistration). Sensitive marketplace routes such as admin tools, verification, payment, messaging, and tax invoice pages are excluded from Pixel loading where configured.

We also record marketplace search analytics (query text, filters, result counts, and related session or user identifiers) to improve search quality and reliability. These records are not sold as advertising audiences.

We also count anonymous visits to selected public content pages (Terms of use, About TAS, Privacy policy, Partnerships, and Frequently asked questions) using session identifiers. Signed-in users may include a marketplace user id. These counts help us understand interest in key information pages and are not sold as advertising audiences.

Browser controls and Meta account settings may limit some advertising cookies. Essential session cookies are required for signed-in marketplace use.

18. Privacy contact and complaints

For privacy questions, access or correction requests, deletion requests, or privacy complaints, contact Timed Automation Solutions Pty Ltd through the Contact page or the support channels published on TAS DroneXchange.

Please include enough detail for us to understand and investigate your request or complaint. We will review privacy complaints within a reasonable time and aim to respond in a clear and helpful way.

If you are not satisfied with our response, you may be able to refer your complaint to the Office of the Australian Information Commissioner (OAIC), where applicable.

19. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated date. Continued use of the platform after changes are posted constitutes acceptance of the revised policy.