Mobile App Privacy Policy

Aug 1, 2026

Karia Technology Pty Ltd

NOVATED DRIVER APP PRIVACY POLICY

Version 2.1 | ABN 78 678 723 012 | Last updated August 2026

Important: Your core personal information, including your name, employment details, salary, and novated lease details, is held in the Karia platform because your employer or novated leasing provider (NLP) entered it on your behalf. Karia holds this information as a service provider to your NLP, not as a primary data collector. If you have questions about that information, contact your NLP or employer first. This policy covers what the App itself collects directly from you when you use it.

Contents

Introduction
What is personal information?
Information held on your behalf
Information the App collects
How we collect your information
How we use your information
AI-powered receipt scanning
Disclosure
Overseas transfer
Security
Data retention
Analytics and tracking
Access, correction and deletion
Marketing
Opt-out and uninstalling
Complaints
Notifiable data breaches
International users: GDPR
Third-party links
Changes to this policy
Contact us

1. Introduction

Karia Technology Pty Ltd (ABN 78 678 723 012) ("Karia", "we", "us", or "our") is a technology company that provides a SaaS platform to novated leasing providers (NLPs) across Australia. The Novated Driver application ("the App") is a component of the Karia platform that allows drivers and employees to view and manage information related to their novated leasing arrangement.

We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

2. What is personal information?

Personal information is any information or opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not.

3. Information held on your behalf

The Karia platform contains personal information about you that was entered by your employer or NLP as part of setting up and managing your novated lease. This may include:

Identification details: name, date of birth, contact information, driver's licence details
Employment details: employer name, position, salary, employment duration, payroll information
Financial details: bank account information, lease agreement details, payment schedules, and spending records
Vehicle information: vehicle make, model, registration, and lease terms
Sensitive information: health or insurance-related information, where relevant and with appropriate consent

Karia does not use this information for any purpose other than delivering contracted platform services to your NLP. To access, correct, or request deletion of this information, contact your NLP or employer in the first instance.

4. Information the App collects directly from you

4.1 Information you enter

Receipt images submitted via the App's receipt scanning feature
Odometer readings and logbook entries where enabled by your NLP
Feedback, support requests, and correspondence submitted through the App

4.2 Device and technical information

Mobile device type, model, and unique device identifier
Mobile operating system and version
IP address and information about how you use the App

4.3 Location information

Where you grant permission, the App may collect GPS and location data to support logbook functionality, fuel monitoring, and trip tracking. Location data is used solely for your novated leasing arrangement and is not shared with third parties for advertising. You may revoke location permissions at any time through your device settings.

4.4 Analytics data

The App collects anonymised usage data through PostHog to improve its features. No personally identifiable information is transmitted to PostHog.

5. How we collect your information

Directly from you when you use the App or contact us
Automatically when you use the App (device information, usage patterns)
Through location services, where permitted
From your NLP or employer, who enters your personal and employment details into the platform

6. How we use your information

We use information collected through the App to display your lease and account details, process expense receipts, enable logbook and trip tracking, provide support, and comply with legal obligations. We do not use your information for advertising or profiling.

7. AI-powered receipt scanning

The App's receipt scanning feature uses AI to extract and classify expenses. Key safeguards include:

PII (card numbers, email addresses, phone numbers) is automatically redacted before transmission to any AI system
AI providers (OpenAI primary, Anthropic fallback) operate under zero-retention enterprise agreements, with no data stored or used for model training
AI processing occurs in the USA and is disclosed to your NLP per APP 8. Karia remains accountable under APP 8
All classifications are subject to human review: low-confidence results require NLP administrator approval before any action is taken on your account
An immutable audit record is maintained for ATO substantiation purposes

You may dispute any classification through the App. All disputes are reviewed by your NLP administrator.

8. Disclosure

Karia may disclose your information to your NLP or employer; AWS (cloud infrastructure); OpenAI and Anthropic (AI receipt processing, under zero-retention agreements with PII redacted); PostHog (anonymised analytics only); professional advisers; and regulators where required by law. We do not sell your information or share it for advertising.

9. Overseas transfer

Your information may be processed outside Australia: on AWS (primary data centres in Sydney); by OpenAI and Anthropic in the USA (receipt processing, zero-retention); and by PostHog (anonymised analytics, USA/EU). Karia remains accountable under APP 8 for overseas recipients.

10. Security

Security measures include end-to-end encryption at rest and in transit, role-based access controls, PII masking in all monitoring and logging systems, and AWS high-availability infrastructure with anomaly detection. Please protect your device and App credentials and notify us immediately if you suspect unauthorised access.

11. Data retention

Account and lease data: duration of your novated arrangement plus 90 days post-termination
Financial and transaction records: 7 years (ATO requirements)
AI-scanned receipt data: not retained by AI providers beyond processing your request
Device and analytics data: up to 365 days

12. Analytics and mobile tracking

The App uses mobile analytics SDKs to collect anonymised usage data to improve features. No personally identifiable information is transmitted. You may limit analytics collection through your device privacy settings.

13. Access, correction and deletion

You have rights under the Privacy Act 1988 (Cth) to access, correct, and request deletion of personal information Karia holds about you.

13.1 Access and correction

To request access to or correction of information Karia holds directly about you, contact us at legal@karia.com.au. We will respond within a reasonable timeframe at no charge. Where information was entered by your NLP or employer, please contact your NLP in the first instance as they are the primary responsible entity.

13.2 Requesting deletion

To request deletion of personal information Karia holds directly about you:

Email: legal@karia.com.au
In App: Account settings → Privacy → Request deletion
Post: Privacy Officer, Karia Technology Pty Ltd, L18 120 Spencer Street, Melbourne VIC 3000

Your request must include your full name and the email address associated with your App account.

13.3 NLP-loaded data

Note: If your personal information was entered into the Karia platform by your NLP or employer, including employment, financial, and lease details, your deletion request for that data should go to your NLP or employer first. Karia holds this data as a service provider and cannot delete it without the NLP's authorisation except where required by law.

13.4 Identity verification

For your security, we will verify your identity before processing any deletion request. This may involve confirming access to the email address associated with your account or providing additional identifying information.

13.5 What will be deleted

Upon processing a verified request, we will delete or de-identify:

Account credentials and login information
Personal identification information (name, email address, phone number)
Profile information and preferences
Support correspondence submitted through the App
Marketing preferences and consent records
Device and usage information

13.6 What we retain

Certain information is retained notwithstanding a deletion request, where required by law:

Financial and transaction records: 7 years (ATO obligations)
Records necessary for legal claims or regulatory investigations
Anonymised or aggregated data that cannot identify you
Backup copies: deleted within 90 days of active system deletion

13.7 Timeframe and grace period

We will process deletion requests within 30 business days of verifying your identity. You will receive email confirmation at each stage. There is a 30-day grace period after submission during which you may cancel your request: your account will be deactivated but not permanently deleted. After the grace period, deletion is permanent and irreversible.

13.8 Exceptions and partial requests

We may decline a deletion request where required by law, where the information is needed for legal claims, or where we cannot verify your identity. We will provide written reasons for any refusal. If you wish to delete only specific information rather than your entire account, please specify this in your request.

14. Marketing communications

We may send marketing communications where permitted under the Spam Act 2003 (Cth). All electronic marketing includes an unsubscribe mechanism. You may opt out at any time by using the unsubscribe link, adjusting notification preferences in the App, or contacting legal@karia.com.au.

15. Opt-out and uninstalling

You can stop all App data collection by uninstalling it. This will not delete information already held in the Karia platform by your NLP. Contact your NLP directly to request deletion of that data. To opt out of specific data collection (such as location), adjust permissions in your device settings.

16. Complaints

If you have a concern about how we have handled your personal information, contact us at legal@karia.com.au. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, GPO Box 5218 Sydney NSW 2001, phone 1300 363 992.

17. Notifiable data breaches

Karia is subject to the Notifiable Data Breaches (NDB) scheme. In the event of a breach likely to result in serious harm, we will notify the OAIC and affected individuals as required by law, and notify your NLP within 72 hours of confirmation.

18. International users: GDPR

If the EU General Data Protection Regulation (GDPR) applies to you, you may have additional rights including access, correction, restriction, erasure, and data portability. Contact us at legal@karia.com.au to exercise these rights.

19. Third-party links

The App may link to third-party websites or services. We are not responsible for their privacy practices.

20. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the App. The latest version is always available at www.karia.com.au.

21. Contact us

Email: legal@karia.com.au
Post: Privacy Officer, Karia Technology Pty Ltd, L18 120 Spencer Street, Melbourne VIC 3000

‹ Data Retention Policy