Privacy policy

1. Who we are

CoHire is our business name. The platform is provided by TWELVE PIXEL PTY LTD (ABN 14 670 579 432) ("we", "us"). We run a peer-to-peer marketplace that connects renters and owners (Lenders) of tools and equipment. We do not own the items listed by users. For the purposes of the Privacy Act 1988 (Cth), we are an APP entity and handle personal information in line with the Australian Privacy Principles (APPs).

This policy explains what personal information we collect, how we use it, how we store and share it, and your rights. The Platform is our website (including when you use it on mobile or desktop) and related services. Our Terms & conditions describe how bookings and payments work.

2. Personal information we collect

We collect information you provide and information we obtain from your use of the Platform.

• Account and profile: When you register (for example via email or social login), we store your email, display name, and optionally phone number and profile photo. We link your account to an internal user ID and, where used, a third-party authentication provider ID.
• Identity verification: We may collect phone numbers for SMS verification and additional information needed for identity checks, payouts, fraud prevention, or legal compliance. Payout identity checks for Lenders are typically handled through Stripe.
• Contact details: Email, phone number, and other contact details you give us for account, booking, or support use.
• Listings (Lenders): If you list items, we store listing details (title, description, category, pricing, location such as suburb and postcode, images, and declared item value where provided). We do not expose your full street address to other users until a booking is confirmed, as per our product design.
• Booking and transaction information: We store booking requests, confirmed bookings, dates, pricing, status, cancellation and refund records, and related operational steps (for example pickup and return status).
• Payment information: We do not store your full card number. Stripeprocesses payments and stores card or wallet details under Stripe's privacy policy and card scheme rules. We store references such as a Stripe customer ID and payment method identifiers so we can charge for bookings and, where you have consented, for allowed extra charges (for example damage, loss, or deposits shown for a booking).
• Messages: Messages between renters and owners on the Platform, including guest enquiry messages where offered. Messaging may be hosted with a third-party real-time service.
• Reviews and ratings: Star ratings and optional review text after completed bookings.
• Location information: Suburb, postcode, and other location details you provide for listings, search, or delivery. Device location is only used if you choose to share it through your device or browser settings.
• IP address, browser and device information: IP address, device and browser type, and general usage information to operate and improve the Platform and for security.
• Customer support: Information you send when you contact support (email, in-app chat, phone callback requests), including conversation content needed to help you.
• Fraud prevention and security: Signals used to detect misuse, chargeback risk, or account compromise (for example unusual login or payment patterns).

3. How we use your data

We use your personal information to: provide and operate the Platform; create and manage your account; process booking requests and payments; communicate with you about bookings, account and support; send service-related messages; send marketing where you have opted in (you can opt out at any time using unsubscribe links in emails or account settings where available); detect and prevent fraud or abuse; comply with legal obligations; and improve our services. We use payment data through Stripe to charge you for rentals and, with your consent, for off-session charges such as damage, loss or deposit amounts shown for a booking.

We may use data to operate, secure, and improve the Platform and to provide user support. If you choose to use optional tools that generate or refine listing text (for example description suggestions), or if you use our in-app support assistant, we send the content you provide for that request to an AI provider so it can return a suggestion or answer. You choose whether to save or use listing suggestions. Because that content is under your control, do not include sensitive personal information in listing fields, notes, or support messages if you do not want it processed by that AI provider.

We do not take your account display name or your stored profile or listing address fields from our systems and send them to an AI provider for those features unless you have typed that information into the listing, notes, or support request yourself. We do not use personal data to train public or general-purpose AI models run by those providers.

4. Payment data and saving cards

Payment processing is handled by Stripe. When you pay or save a card, Stripe collects and stores your payment details in line with Stripe's privacy policy and applicable card scheme rules. We store only non-sensitive references (for example Stripe customer ID and payment method identifiers) so we can charge you for future bookings and, where you have agreed, for charges related to damage, loss or deposits when you are not actively on the Platform.

Before initiating such off-session charges, we aim to give reasonable notice and typically around 48 hours to respond before a charge attempt, subject to exceptions where delaying a charge would be impracticable or inconsistent with applicable law or card rules. Nothing in this section limits statutory rights including under the Australian Consumer Law. You can add, update or remove saved payment methods in your account profile where the Platform allows.

5. Sharing, third parties and overseas storage

We may share your personal information with:

• Other userswhere needed for the service (for example owner and renter see each other's profile and booking details).
• Service providers who help us run the Platform under appropriate confidentiality and security arrangements, including for example:
  • Stripe - payments, saved cards, payouts, and related identity checks
  • Firebase (Google) - authentication (including Google and Facebook sign-in where offered), messaging storage, and related app services
  • Twilio - SMS verification codes
  • Supabase - primary database hosting
  • Vercel - website hosting and related infrastructure
  • Resend - transactional email
  • Google Analytics - website analytics where enabled
  • Contentsquare - session and experience analytics (for example heatmaps and usage patterns) where enabled
  • AI providers - optional listing tools and support assistance you choose to use
  • Google Places - address autocomplete where used
• Authorities when required by law or to protect rights and safety.

We do not sell your personal information to third parties.

Personal information is primarily stored on servers located in Australia and the United States (including for payment processing, authentication, messaging, analytics, and hosting services). Where personal information is processed outside Australia, we take reasonable steps to ensure overseas providers handle personal information in accordance with applicable privacy laws.

6. Retention

We keep your data for as long as your account is active and as needed to provide the service, resolve disputes, enforce our terms and comply with law. After account closure, non-essential account data is deleted or anonymised within 24 months. Financial and transaction records are retained for 7 years to meet Australian Taxation Office (ATO) and related legal requirements.

7. Sensitive information

We do not intentionally collect sensitive information (for example health information or criminal history information). Please avoid sharing sensitive information in open text fields, listing descriptions, support requests, or user messages.

8. Security

We use appropriate technical and organisational measures to protect your data (for example encryption in transit where used, access controls, and secure payment processing through Stripe). No system is completely secure; we will notify you and regulators where we are required to do so in the event of an eligible data breach affecting your personal information.

9. Your rights

Under the APPs you may request access to or correction of personal information we hold about you. You can update much of your profile and account information in the Platform. For other requests (including complaints about how we handle personal information) or to delete your account, see Data deletion below or contact us using the details in Section 14. We aim to respond to privacy requests within a reasonable time.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Users in other regions may have additional rights under local law.

10. Account and data deletion

You can request deletion of personal information we hold about you, including data obtained when you sign in with Facebook, Google, or email, where legally permitted. To request deletion of your account and associated personal data:

1. Email support@cohire.com.au from the email address linked to your CoHire account.
2. Use the subject line "Account deletion request" and include the email you used to register. If you signed in with Facebook or Google, say which provider you used.
3. We will confirm your request and delete or anonymise your account data within 30 days, unless we need to keep certain information for legal, tax, fraud prevention, or dispute resolution reasons (see Section 6).

Where the Platform offers an in-account deletion option, you may also use that path. Before deletion, cancel or complete any active bookings where possible. You can update your profile, remove saved payment methods, and delete listings from your account settings. Removing the CoHire app from your Facebook account stops future access via Facebook but does not by itself delete data we already hold; use the steps above to request deletion.

Financial and transaction records may be retained for up to 7 years as described in Section 6. We aim to respond to deletion requests within a reasonable time.

11. Cookies, analytics and session tools

We use cookies and similar technologies to run the Platform, keep you logged in, remember preferences, and understand how the Platform is used. This may include Google Analytics and Contentsquare (session and experience analytics) where those tools are enabled. You can adjust your browser settings to refuse or limit cookies; some features may not work fully if you do.

12. Children and minimum age

The Platform is for users who are at least 18 (or the age of majority where you live). We do not knowingly collect personal information from children under 18 for account registration. If you believe we hold information about a child under 18 in connection with an account, contact us and we will take appropriate steps.

13. Changes to this policy

We may update this privacy policy from time to time. We will post the updated version on the Platform and update the "Last updated" date. We encourage you to review it periodically. Where the law allows, continued use of the Platform after we post reasonable notice of changes may be treated as accepting the revised policy except that your statutory rights (including non-excludable protections under Australian law) remain unaffected by this sentence.

14. Contact and privacy complaints

For questions about this privacy policy, access or correction requests, deletion requests, or privacy complaints:

• Email: support@cohire.com.au
• Business name: CoHire (TWELVE PIXEL PTY LTD, ABN 14 670 579 432)
• Postal / office: 5 Fleet Street, North Parramatta NSW 2151

You may also contact us through features available on the Platform. We aim to respond to privacy-related enquiries within a reasonable time. If you are not satisfied, you may contact the OAIC (see Section 9).