Privacy Policy

This policy explains how PICKU AUSTRALIA PTY LTD (ABN 38 670 095 511), trading as BYRO, handles your personal information. We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). It covers our booking site (book.byro.au), our website (byro.au), our customer portal (my.byro.au), and bookings made by phone or email, as well as driver applications (see section 12).

1. Information we collect

To provide your transfer we collect:

• Identity & contact details - your name, mobile number (your primary account identifier), and email address.
• Trip details - pickup and drop-off addresses, date and time, vehicle type, number of passengers, flight number(s) including any return leg, child-seat requirements, and any notes you add.
• Payment information - processed by Stripe. We store only the last four digits and card type, plus secure references - never your full card number, security code or expiry (see section 4).
• Business details (optional) - company name, ABN and billing address, if you request a company tax invoice.
• Account & booking history - your past bookings, cancellations, tips, saved (in-progress) bookings, and a reference to your saved card.
• Technical information - standard web and server logs, and error-diagnostic data from our monitoring tools, which may incidentally include the information above.
• Quote & visit activity - when you search for a price we may collect the routes, dates, vehicle and fares you view, together with your IP address and approximate location (city/region), to understand demand and improve our pricing and service.

2. How we use your information

We use your information to:

• provide, dispatch and manage your transfer;
• process payments, refunds and tax invoices/receipts;
• send booking confirmations and trip updates (including by SMS, WhatsApp or email);
• manage your account and saved details so future bookings are faster;
• provide customer support and handle complaints;
• prevent fraud and meet our legal, tax and regulatory obligations;
• with your ability to opt out, send service updates and post-trip review requests; and
• where you have given marketing consent, measure how our advertising performs, understand how visitors use our sites, and show you relevant ads - you can withdraw this consent at any time (see sections 7 and 10).

3. When you give us someone else’s details

If you book on behalf of another passenger, please make sure they are aware their details (such as name and contact number) are provided to us so we can carry out the transfer.

4. Card & payment data

Card payments are processed by Stripe. Your card details are captured securely by Stripe and are not transmitted through or stored on BYRO’s own systems. We retain only the last four digits and card type, and secure references that let Stripe identify your saved card for future bookings. BYRO never stores your full card number, security code or expiry date. Stripe’s handling of your data is governed by Stripe’s own privacy policy.

5. Who we share your information with

We share your information only as needed to run the service, with the providers below. We do not sell your personal information.

We may also disclose information where required or authorised by law.

6. Overseas disclosure

Some of the providers we use to operate BYRO store or process data outside Australia. In particular, card payments are processed by Stripe; address look-ups use Google services; application error monitoring uses Sentry (European Union); a no-personal-information advertising click identifier is reported to Google in the United States to measure ad performance, regardless of your cookie choice; and, where you have given marketing consent, richer advertising and measurement data (including hashed contact details) is shared with Meta and Google in the United States; and our websites are served through global hosting and CDN providers. By using BYRO you consent to your personal information being disclosed to and processed by these providers, which may be located in the United States, the European Union and other countries. We take reasonable steps to ensure these providers handle your information consistently with the Australian Privacy Principles.

7. Cookies & similar technologies

We use essential cookies and local storage to run the booking flow - for example to keep your booking session, your quote, and to carry your details between our website, booking app and portal (a cookie set on .byro.au so your choices survive across our subdomains). The reviews widget on our website is loaded from Trustindex.

With your consent, we also use marketing and analytics tags - such as the Meta pixel and Google tags - to measure how our advertising performs. These are off by default and only load after you accept marketing cookies in our consent banner; your choice is remembered in a byro_consent_marketing cookie set on .byro.au, and you can change it at any time through the banner or your browser settings. You can control or clear cookies through your browser settings; disabling essential cookies may stop the booking flow from working.

8. How long we keep your information

• Bookings, orders and invoices - kept for as long as needed to provide the service and to meet our tax, accounting and legal obligations (generally up to 7 years).
• Saved cards - kept until you ask us to remove them or your account is closed.
• Saved (in-progress) bookings - cleared automatically once a booking for that mobile number is completed.
• Quote data - short-lived (cached for around 15 minutes).
• Error/diagnostic logs - kept for a limited period in line with our monitoring provider’s retention.

9. How we protect your information

We take reasonable steps to protect your personal information. Payments are handled by Stripe over encrypted connections and BYRO does not store full card numbers. Access to booking data is restricted to authorised personnel and providers. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and to meet our obligations under the Privacy Act.

10. Marketing, advertising & reviews

Booking confirmations, invoices and receipts are transactional messages about your trip. After your trip we may invite you to leave a review. You can opt out of non-transactional marketing at any time by contacting us; reviews you choose to leave on Google are public.

To promote BYRO we measure how our advertising performs, in two ways with different privacy treatments:

Google - advertising measurement (no personal information). When you arrive from a Google ad, Google adds a click identifier to the web address. If you then make a booking, we record that identifier with your order and report it to Google so we can measure which ads lead to bookings. This identifier does not contain your name, email, phone number or address, and is used to measure advertising performance regardless of your marketing-cookie choice. We do not share your contact details with Google.

Google & Meta - remarketing and richer measurement (only with your marketing consent). If you accept marketing cookies, we also share booking-funnel events (such as a price check or a completed booking) and hashed, irreversible versions of your contact details (for example your phone number or email) with Meta and Google, so they can attribute conversions and, where applicable, show you relevant ads. We share only coarse route information (for example region to region) - never your exact pickup or drop-off address. This is off by default: you opt in through our consent banner and can withdraw at any time via the banner or your browser settings, and withdrawing does not affect your booking.

11. Accessing or correcting your information, and complaints

You can ask us for a copy of the personal information we hold about you, or ask us to correct it, by contacting contact@byro.au. We will respond within a reasonable period. If you believe we have mishandled your personal information and you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Driver applications

This section applies if you apply to drive with BYRO at byro.au/drive-with-byro. The rest of this policy also applies, except where this section says something different.

What we collect

• Your details - name, mobile, email, residential address, suburb and state, licence state, your answers about your licence and any driver authority, when you can drive, and your ABN, the business name you choose for it and your experience if you give them.
• Your date of birth - if you hold a NSW licence, so we can check your eligibility on the Driver Vehicle Dashboard, using the licence number from the licence you send us.
• Your car - where it is registered, its number plate, make, model, year, colour, seats and type.
• Documents you send us - your driver licence, a photo of you, your national police check, driving records, any driver authorisation, registration, CTP and insurance papers, safety or inspection certificates, any booked hire service licence, and photos of your car.
• Your consent record - the wording you agreed to, the signature you drew, the time and your IP address.
• Your IP address when you start - recorded when you begin an application, even if you never send it.

A police check or driving record can show criminal history, which is sensitive information under the Privacy Act. We only collect it with your consent. We tell you this above the first upload, and sending us one of these documents is how you agree to us collecting it.

How we use it

We use this information to decide whether you are eligible and suitable to drive for BYRO, to meet our duties under point to point transport law, and to contact you about your application, including one you haven't finished. If you are approved, we use it to set you up as a driver and keep your compliance record. We do not use it for marketing or advertising, and the application page does not load the Meta pixel or show the marketing cookie banner.

Checks with regulators

If you hold a NSW licence and give your consent, we can use your surname, date of birth and licence number to check your eligibility on the Point to Point Transport Commissioner's Driver Vehicle Dashboard. It can show whether you hold the relevant licence and whether disqualifying offences or penalty notices are recorded against your name, without detailing what an offence is. For other licences, you consent to us confirming your licence, police check and driving record with the authorities that issued them. Either consent is voluntary, lasts 12 months or until you stop driving for BYRO, and can be cancelled in writing at any time. Without it, we may not be able to confirm you are eligible.

Where it goes and who can see it

• Storage - your details and files are kept in our dispatch system, on a DigitalOcean server in Sydney. Only logged-in BYRO staff can open your files. Your private link lets you replace or remove them, but not download them, so please keep that link private.
• Backups - the whole system is backed up daily, on that server, with DigitalOcean, and to Google Drive, which may store data outside Australia.
• Telegram - when you apply, add documents or leave an application unfinished, our team gets a Telegram message with your name, mobile, suburb, licence state and car details, your answer about the Passenger Transport code or any cancelled or refused driver authority, where you stopped and which documents are still to come. Telegram may process this outside Australia.
• Email - our email provider, Resend, sends your confirmation and private link. It handles your email address, first name, mobile and that link, and may do so outside Australia.

If you give an ABN, we check it on the Australian Business Register, the government's public register, to find the names registered to it. As you type your suburb or address, what you've typed goes to Google to suggest matches.

If you are approved, these also apply:

• Anthropic - our compliance system sends your licence, police check, any driver authorisation, registration, CTP, insurance and safety certificate to Anthropic, an AI provider in the United States, to read details such as expiry dates. It does not read your photos, driving records or any booked hire service licence, and nothing goes to Anthropic while your application is being assessed.
• GitHub - your name, mobile, email, suburb, number plate and car details go into our driver list, kept in a private GitHub repository, which may be outside Australia.
• Our CRM - your working name and car are added to the driver list in Close, our CRM.
• Google Maps - your suburb is sent once, to place your home base.
• Working as a driver - passengers see your first name, photo, car and number plate. Jobs reach you by WhatsApp, SMS and Google Calendar, and passengers reach you through Twilio's masked numbers.

By applying, you consent to these disclosures, including outside Australia. We do not sell this information.

How long we keep it

Anything deleted, files or details, can stay in our backups for up to 30 more days.

Your choices and complaints

Applying is voluntary, but we can't assess an application without the details and documents it needs. You can ask us to access, correct or delete your application at contact@byro.au. If you think your licence information has been obtained without your consent or misused, tell us first. If you are not satisfied, contact the Office of the NSW Privacy Commissioner or Transport for NSW at privacy@transport.nsw.gov.au. Section 11 explains other complaints.

13. Contact us

PICKU AUSTRALIA PTY LTD trading as BYRO · ABN 38 670 095 511
Suite 532, 61 Jonson Street, Byron Bay NSW 2481
Phone / SMS: +61 440 136 000
Email: contact@byro.au