Privacy Policy

X Tow is the entity responsible for the personal information collected through the Services. For privacy enquiries, see Contact us below.

Depending on how you use the Services (for example as a customer requesting a tow, or as a tow operator), we may collect:

• Identity and contact details — name, phone number, and email address.
• Account information — login credentials, profile preferences, and communications with us.
• Location data — approximate or precise geolocation when you use location features (for example to set a pickup pin, show nearby operators, or track an active tow). See Location data below.
• Vehicle details — make, model, colour, registration (rego), and registration state, and any other vehicle information you provide to help operators complete a tow.
• Job and trip information — pickup and drop-off addresses, quotes accepted, job status, ratings, and related service history.
• Payment information — payment method details and transaction records. Card numbers and similar sensitive payment credentials are collected and processed by our payment processor; we do not store full card numbers on our systems.
• Operator information — where you join as an operator, details needed to verify and operate on the network (for example licensing, vehicle or truck details, and payout preferences).
• Biometric information (operators only) — a reference photograph of your face and the results of weekly face checks, used solely to confirm that the operator attending a job is the person we verified. See Biometric information below.
• Technical and usage data — device type, app or browser information, IP address, and how you interact with the Services, collected automatically to operate, secure, and improve the Services.

We collect information directly from you when you create an account, request a tow, communicate with support, or otherwise use the Services. We may also receive information from operators in connection with a job, from payment and maps providers in the course of providing the Services, and from publicly available sources where permitted by law.

We use personal information to:

• match customers with available tow operators and facilitate quotes, dispatch, and completion of tows;
• process payments, refunds, and related billing records;
• provide in-app tracking, messaging, and status updates for active jobs;
• verify accounts, prevent fraud and misuse, and keep the Services secure;
• provide customer and operator support, and respond to enquiries and complaints;
• improve the Services, including reliability, coverage, and user experience;
• send service-related notices (for example job confirmations, safety alerts, and account updates); and
• comply with legal obligations and enforce our terms.

We do not sell your personal information. Where we use information for a purpose that is not related to those set out above, we will take steps required under the APPs, which may include obtaining your consent.

Location is central to how X Tow works. When you allow location access, we use location data to:

• identify your approximate or precise position so you can request a tow and set pickup and drop-off points;
• show nearby operators and calculate distance, ETA, and quotes;
• share relevant job location details with the matched operator so they can navigate to you and complete the tow; and
• enable live tracking during an active job where that feature is available.

You can control location permissions through your device settings. If you disable location access, some features of the Services may not work or may work with reduced accuracy (for example you may need to enter an address manually). We retain location-related job data as part of the trip record for the periods described in Data retention.

This section applies only to tow operators, not to customers. If you use X Tow to request a tow, we do not collect biometric information about you.

Customers hand their vehicle to whoever arrives. To confirm that the operator who turns up is the person whose licence, insurance and accreditation we verified, operators complete a face check once a week.

What we collect. When you first set up the check, we keep one photograph of your face as your reference photo. Each week you complete a short camera check: your device streams a brief video to Amazon Web Services, which confirms a real person is present, and a single still frame from that check is compared against your reference photo. We also keep the outcome of each check — whether it passed, the match score, and the reason for any failure.

What we do not keep. We never store the weekly video, and we never store the still frame used for the comparison. The frame exists only for the duration of the comparison and is then discarded. Your reference photo is the only face image we retain.

Legal basis and consent. Biometric information used for automated verification is sensitive information under the Privacy Act 1988 (Cth). We collect it only with your express consent, which you give during operator onboarding after being shown this information, and only because it is reasonably necessary to verify operators on the network. You are not required to consent — but because we cannot confirm who is driving without it, we cannot accept you as an operator if you do not. You may withdraw consent at any time by contacting us or closing your account; withdrawing consent means you can no longer operate on the network.

Where it is stored and processed. Your reference photo is stored encrypted in Amazon Web Services’ Sydney region (ap-southeast-2), in Australia. The liveness check that confirms a real person is in front of the camera runs on Amazon Rekognition in AWS’s Tokyo region (ap-northeast-1), because AWS does not offer that feature in Australia. This is a disclosure of personal information overseas for the purposes of APP 8, and we rely on AWS’s contractual and security commitments in relation to it. The video is streamed from your device directly to AWS; it does not pass through our systems and we do not receive a copy. The face comparison itself runs in Sydney.

How long we keep it. Your reference photo is kept while you are an active operator and deleted 30 days after your account closes. The records of each check — pass or fail, score, and reason — are kept for two years so we can review a locked account and demonstrate that verification was carried out. These records contain no image.

How it is used, and how it is not. This information is used only to confirm your identity as an operator. It is never shown to customers, never used to identify you anywhere else or in any other context, never used for marketing or profiling, and never sold or disclosed to anyone other than the AWS services described above, except where required by law.

Deletion. To have your reference photo and check history deleted, email privacy@xtow.com.au with “Delete my biometric information” in the subject line. We will action it within 30 days and confirm when it is done. Deleting your reference photo ends your ability to operate on the network unless you enrol again. Closing your account triggers the same deletion without you having to ask.

We use trusted service providers to operate the Services. They may process personal information on our behalf, only as needed to provide their services to us, and subject to appropriate contractual and security arrangements. These include:

• Supabase — authentication, database, and backend infrastructure used to store and manage account, job, and related service data.
• Google Maps — maps, geocoding, directions, and related location services used to display maps, resolve addresses, and support navigation and ETAs.
• Payment processor — processing card and other payment method transactions, including authorisation, capture, refunds, and fraud checks. Payment credentials are handled by the processor under its own security and privacy practices.
• Amazon Web Services — storage of operator reference photos in Sydney, and the Amazon Rekognition face liveness and face comparison services used for operator verification. See Biometric information above.

We may also disclose personal information to tow operators as needed to fulfil a job you have requested or accepted; to professional advisers; to law enforcement or regulators where required or authorised by law; and in connection with a business sale, merger, or restructure, subject to appropriate safeguards.

Some providers may store or process information outside Australia. Where we disclose personal information overseas, we take reasonable steps consistent with APP 8 to ensure the recipient does not breach the APPs in relation to that information, or we rely on another permitted basis under the Privacy Act.

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including to provide the Services, resolve disputes, maintain security, and meet legal, accounting, and reporting requirements.

Trip, payment, and account records are typically retained for the life of your account and for a further period after account closure or job completion where we need them for tax, dispute resolution, fraud prevention, or legal compliance (often up to seven years for financial and transaction records, unless a longer period is required). Location data associated with a completed job forms part of that trip record. When information is no longer needed, we take reasonable steps to destroy or de-identify it.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Measures include access controls, encrypted connections where appropriate, and use of reputable infrastructure and payment providers. No method of transmission or storage is completely secure; if you believe your account or information has been compromised, contact us promptly.

Under the Privacy Act and the APPs, you generally have the right to:

• Access the personal information we hold about you (APP 12);
• Correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13);
• ask us about our privacy practices and how we handle your information; and
• make a complaint if you believe we have breached the APPs.

To request access or correction, or to raise a privacy concern, contact us using the details below. We will respond within a reasonable time. In some cases we may refuse a request where the Privacy Act allows (for example where giving access would be unlawful or unreasonably impact another person’s privacy). If we refuse, we will explain why (unless it is unreasonable to do so) and how you can complain.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au.

The Services are intended for users who can lawfully enter into agreements and request towing services in Australia. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us so we can take appropriate steps.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Where changes are material, we will take additional steps to notify you where appropriate (for example through the app or by email). Continued use of the Services after an update constitutes acceptance of the revised policy, to the extent permitted by law.

For privacy questions, access or correction requests, or complaints, contact:

• Email: privacy@xtow.com.au
• Phone: (03) 8899 6462

Please mark privacy-related emails with “Privacy request” in the subject line so we can prioritise them.