Privacy Policy

This Privacy Policy explains how Tarot Analytics Pty Ltd collects, uses, stores and discloses personal information in connection with Tarot Routing.

This Privacy Policy applies to Tarot Routing, including:

• the Tarot Routing web application available at https://route.optimiser.app;
• the Tarot Routing Optimisation API;
• the Tarot Routing Driver Runsheet App, available on the Apple App Store and Google Play Store;
• tracking pages, customer portals and related services provided as part of Tarot Routing; and
• any other related products or services offered by Tarot Analytics Pty Ltd.

In this Privacy Policy:

• “Tarot Analytics”, “we”, “us” and “our” refer to Tarot Analytics Pty Ltd.
• “personal information” includes “personal data” as that term is used under applicable EU and UK data protection laws.

We respect your privacy and aim to collect and use personal information only where it is reasonably necessary to provide, secure, support and improve Tarot Routing.

Our role

Tarot Routing is generally provided to organisations for use in managing routes, deliveries, drivers, tracking and related logistics operations.

In many cases, our customer is the organisation responsible for deciding how personal information is used in Tarot Routing. In those cases, Tarot Analytics processes personal information on behalf of that organisation.

For some information, such as account administration, billing, support, website analytics, security and our own communications, Tarot Analytics may be responsible for deciding how that information is used.

Personal information we collect

We may collect personal information that is reasonably necessary to provide and operate Tarot Routing. This may include:

• name, email address, phone number and organisation details;
• account, login and user access information;
• billing and payment-related information;
• support requests and communications with us;
• driver, route, delivery and job information entered into Tarot Routing by our customers or their users;
• delivery recipient information, such as name, delivery address, contact details and delivery instructions, where provided by our customers;
• proof of delivery information, such as timestamps, signatures, notes or other delivery records;
• location information where required for driver tracking, delivery tracking or proof of delivery; and
• technical information such as IP address, browser type, device type, operating system, usage logs and security logs.

We may also collect non-personal or aggregated information about how users interact with Tarot Routing and our website.

Tarot Routing is not intended to collect sensitive personal information, such as information about racial or ethnic origin, political opinions, religious beliefs, health or medical information, or similar categories of sensitive information. Customers and users should not submit sensitive personal information to Tarot Routing unless it is necessary for their lawful use of the service. If we become aware that sensitive personal information has been submitted unnecessarily, we may delete, restrict or de-identify it, or refer the matter to the relevant Customer.

How we collect personal information

We may collect personal information:

• directly from users when they create an account, use Tarot Routing, contact us or interact with our website;
• from our customers when they upload, enter or transmit information into Tarot Routing;
• from drivers, dispatchers, administrators and other users while using Tarot Routing;
• automatically through the operation of our website, platform, applications, APIs and security systems; and
• from service providers that help us operate, support or secure Tarot Routing.

Location information

Tarot Routing uses location data where it is required to provide driver tracking, delivery tracking, proof of delivery and related logistics functionality.

Driver background location data

If enabled by the organisation using Tarot Routing, the Tarot Routing Driver Runsheet App may collect driver location data, including GPS location, from the driver’s smartphone. This may occur while the app is running in the background.

Background location data is used to provide driver tracking functionality, including when drivers are navigating using another application such as Google Maps, Waze or Apple Maps. This is because driver tracking remains relevant while the driver is completing the route, even if the Tarot Routing Driver Runsheet App is not visible on screen.

The frequency of background location collection is configured by the organisation using Tarot Routing. The default frequency is once per 7 minutes. Organisations are encouraged to configure location collection as infrequently as possible while still meeting their operational requirements.

When background location collection is active, the driver may see a notification or system indicator on their device, depending on the device and operating system.

Driver location may also be temporarily shared with the delivery recipient if the organisation enables to-the-door tracking or similar customer-facing tracking functionality.

Driver tracking location data is stored for the period configured by the organisation using Tarot Routing. The default retention period is two months.

Other driver location data

Certain actions in the Tarot Routing Driver Runsheet App may record the driver’s location at the time of the action, such as:

• starting or ending a route;
• loading or unloading a parcel;
• recording a delivery event; or
• collecting proof of delivery.

This location data is collected only when the relevant action is performed in the app.

How we use personal information

We may use personal information for the following purposes:

To provide Tarot Routing

We use personal information to provide the core functionality of Tarot Routing, including route optimisation, delivery management, driver runsheets, tracking, proof of delivery, customer notifications and related services.

To administer accounts

We use personal information to create and manage user accounts, authenticate users, manage permissions and provide access to Tarot Routing.

To provide support

We use personal information to respond to customer service requests, troubleshoot issues, investigate errors and provide technical support.

To process billing and payments

We use billing and payment-related information to process orders, manage subscriptions, issue invoices and maintain business records. We do not sell payment information.

To send service communications

We may use contact details to send transactional or service-related communications, such as account notices, support messages, billing notices, security alerts and important product updates.

To send product updates and marketing communications

Where permitted by law, we may send product updates, company news or related information. Users can unsubscribe from marketing emails by following the unsubscribe instructions included in those emails.

To improve and secure Tarot Routing

We may use information to monitor performance, improve functionality, analyse usage, detect errors, prevent misuse, protect security and maintain the reliability of Tarot Routing.

Artificial intelligence and machine learning

Tarot Routing uses artificial intelligence and machine learning in two distinct ways.

Privately hosted machine learning models

Tarot Analytics creates and trains proprietary machine learning models hosted exclusively on Tarot Analytics-controlled infrastructure. These models are used to predict driving times based on traffic conditions and to calculate estimated time of arrival (ETA) for routes and deliveries. This feature is only activated if you opt in to route optimisation with traffic.

To train and improve these models, we use departure times, arrival times, and latitude and longitude coordinates generated through the ordinary operation of Tarot Routing. All training data is processed within Tarot Analytics’ own infrastructure, remains under our control, and is subject to the same security, access control and retention measures described in this Privacy Policy.

Cloud-based large language models

Two Tarot Routing features use cloud-based large language model (LLM) services: AI chat support (an AI-powered assistant for help and guidance) and the AI rules checker (which assists with reviewing routing rules and configuration). When you use these features, the data you provide may be transmitted to a third-party cloud AI provider for the sole purpose of generating a response.

Tarot Analytics opts out from allowing its AI cloud providers to train their models using any data provided to them. If you do not wish your data to be processed through cloud-based AI features, do not use AI chat support or the AI rules checker. Core logistics features — route optimisation, driver runsheets, tracking, proof of delivery and related services — do not rely on these cloud-based AI features.

Legal bases for EU and UK personal data

Where the EU General Data Protection Regulation or UK General Data Protection Regulation applies, we process personal data only where we have a lawful basis to do so.

Depending on the circumstances, these lawful bases may include:

• performing a contract or taking steps before entering into a contract;
• complying with legal obligations;
• our legitimate interests or the legitimate interests of our customers, provided those interests are not overridden by individual rights and freedoms;
• consent, where required by law; and
• processing carried out on behalf of our customers, where the customer is responsible for establishing the relevant lawful basis.

EU and UK data residency

For customers in the European Union and the United Kingdom, customer data is hosted and processed within the European Union and/or the United Kingdom. We do not transfer EU or UK customer data outside the EU or UK unless required by law, requested by the customer, or otherwise permitted under applicable data protection laws with appropriate safeguards in place.

Australian privacy requirements

Tarot Analytics Pty Ltd is an Australian company. Where the Australian Privacy Act 1988 and the Australian Privacy Principles apply, we handle personal information in accordance with those requirements.

This includes taking reasonable steps to collect only information that is reasonably necessary for our functions or activities, using and disclosing personal information for the purposes described in this Privacy Policy, protecting personal information from misuse, interference, loss and unauthorised access, and allowing individuals to request access to or correction of their personal information where required by law.

Cookies and analytics

Our website and platform may use cookies and similar technologies to operate the service, remember user preferences, improve security, analyse usage and improve user experience.

We use a cookie consent banner and cookie preference tools where required, including for users in the European Union and the United Kingdom. Non-essential cookies, including analytics cookies, are used only in accordance with the choices available through those tools and applicable law.

We may use analytics services, including Google Analytics, to understand how our website and platform are used. Analytics information may include technical information such as browser type, device type, pages visited, approximate location, usage patterns and IP-derived information. We use this information to improve our website, platform and services.

Users may also configure their browser to refuse cookies or alert them when cookies are being sent. Some parts of the website or platform may not function properly if cookies are disabled.

Sharing personal information

We do not sell personal information.

We may share personal information where reasonably necessary for the purposes described in this Privacy Policy, including with:

• the organisation that uses Tarot Routing and its authorised users;
• drivers, dispatchers, administrators and other users involved in the relevant route or delivery workflow;
• delivery recipients, where customer-facing tracking or delivery notifications are enabled;
• service providers that help us host, operate, secure, support, analyse or improve Tarot Routing;
• payment processors, accountants, lawyers, insurers and other professional advisers;
• regulators, authorities or other parties where required by law; and
• another entity in connection with a business transfer, merger, acquisition, restructure or sale of assets.

Where we use service providers to process personal information, we take reasonable steps to ensure they process that information only for authorised purposes and protect it appropriately.

International transfers

Except as described above for EU and UK customers, personal information may be stored or processed in countries where we or our service providers operate, which may include Australia, Singapore, the European Union, the United Kingdom and the United States.

Where personal information is transferred internationally, we take reasonable steps to ensure the transfer complies with applicable privacy and data protection laws. This may include contractual protections, technical safeguards or other lawful transfer mechanisms.

Retention of personal information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide Tarot Routing, comply with legal obligations, resolve disputes, maintain business records, enforce agreements and protect security.

Some retention periods are configured by the organisation using Tarot Routing. For example, driver tracking location data is retained for the period configured by the organisation, with a default retention period of two months.

GPS tracking coordinates are automatically deleted within two months of capture. Where it is not feasible to delete personal data without affecting legitimate business or legal requirements, we may anonymise the data using one-way, non-reversible methods so that it can no longer be associated with an identifiable individual.

Where personal information is no longer required, we take reasonable steps to delete, de-identify or securely archive it, unless we are required or permitted by law to retain it.

Security

Tarot Analytics takes reasonable technical and organisational measures to protect Tarot Routing and Customer data against unauthorised access, alteration, disclosure, misuse, interference, loss or destruction.

These measures include encryption in transit, access controls, authentication controls, backup and recovery processes, monitoring, incident response procedures, secure development practices and internal security policies.

Our information security practices are aligned with the principles of ISO/IEC 27001. Tarot Analytics uses ISO/IEC 27001 as a reference framework when reviewing and improving our security controls, policies and information security management practices.

The Tarot Analytics IT Security Policy is available upon request.

Your rights and choices

Depending on where you are located and which privacy laws apply, you may have rights to:

• request access to personal information held about you;
• request correction of inaccurate or incomplete personal information;
• request deletion of personal information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• request a copy of certain personal data in a portable format; and
• make a privacy complaint.

Where Tarot Analytics processes personal information on behalf of an organisation, we may need to refer your request to that organisation or act on the organisation’s instructions.

To exercise privacy rights or make a privacy request, please contact us at info+privacy@tarotanalytics.com.

Privacy complaints

If you have a concern about how we handle personal information, please contact us first so that we can try to resolve it.

If you are in Australia, you may have the right to complain to the Office of the Australian Information Commissioner.

If you are in the European Union, you may have the right to complain to your local data protection authority.

If you are in the United Kingdom, you may have the right to complain to the UK Information Commissioner’s Office.

Data breaches

If a data breach occurs, we will assess and respond to it in accordance with applicable law. Where required, we will notify affected customers, individuals, regulators or other relevant parties.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the date on this page.

We encourage users to review this Privacy Policy periodically to stay informed about how we handle personal information.

Your acceptance of this Privacy Policy

By using Tarot Routing or our website, you acknowledge that you have read this Privacy Policy. If you do not agree with this Privacy Policy, please do not use Tarot Routing or our website.

Contacting us

If you have any questions about this Privacy Policy, our privacy practices or your dealings with Tarot Analytics Pty Ltd, please contact us at:

Tarot Analytics Pty Ltd
Email: info+privacy@tarotanalytics.com