Privacy policy
Last updated 28 October 2026
Who we are
RunDesk is business software for Australian skip-bin and waste businesses: one app with Office, Fleet Command, Driver, Yard and Workshop. RunDesk is provided by the RunDesk operator (currently Newcastle Skip Co) ("RunDesk", "we", "us").
We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) for the personal information RunDesk handles.
Who this policy is for
RunDesk is sold to businesses ("operators"), not to the public. This policy covers:
- Staff of an operator who have a RunDesk login (office staff, drivers, yard and workshop staff).
- Customers of an operator whose details the operator enters into RunDesk, or who book through the operator's website.
For customer records, the operator decides what it enters and why, and RunDesk stores and processes that information for the operator. If you're a customer of a skip-bin business, that business's own privacy policy also applies — contact them first about your records.
What we hold
| Information | What it is | Why |
|---|---|---|
| Staff logins | Name, login email, the RunDesk apps and access you're given, password changes and sign-in sessions. Your password is stored scrambled (hashed) by our sign-in provider — nobody at RunDesk or your company can read it. | To let you sign in and to show you only what your login allows. |
| Customer records the operator enters | Customer names, phone numbers, email and site addresses, bookings, jobs, quotes, invoices, payments received and notes. | To run the operator's bookings, jobs and invoicing. |
| Job photos and documents | Photos taken in the app (for example bin placement, loads, damage, dockets) and attached files, kept in private file storage, in a separate folder for each company. Photos can show a site, a vehicle or people nearby. | Proof of work, disputes and customer questions. |
| Weighbridge data | Weighbridge tickets: weights, dates and times, vehicle registration, driver, customer, material and charges. | Tipping records, invoicing and records the operator must keep. |
| Fleet, yard and workshop records | Vehicles, prestart checks, faults and repairs, timesheets (start and finish times) and run sheets. | Running the fleet safely and paying staff correctly. |
| Location | Maps and zones: addresses are placed on a map only when the operator uses maps or delivery zones (for example to work out a delivery zone and price). Your device's location, only at set moments and only with your phone's permission: one reading when you clock in or out (Driver, Yard, Fleet Command), when a load is tipped in the Yard, and when a driver marks a bin delivered (so the pickup driver can find it) — the last one only if the operator has switched on "Driver tracking". RunDesk does not track your location in the background. If you say no, RunDesk still works, just without the location. | Delivery-zone pricing, timesheet records, and finding bins on pickup. |
| Website bookings | Details a customer types into the operator's website booking form (name, contact details, address, bin size, dates). | To create the booking for the operator. The form is rate-limited using the visitor's IP address to stop abuse. |
| Storage on your device | A copy of your company's RunDesk data, changes waiting to send and your sign-in session are kept in the app's storage on the device, so RunDesk keeps working without signal. | Offline use. Clearing the app's or site's data, or uninstalling the app, removes it. |
| Website enquiries | The name, business name, email, phone, number of trucks and message you send through the "Book a demo / Start a free trial" form on the RunDesk website. Your IP address is kept with it for up to 30 days to stop abuse. | To reply to you about RunDesk, arrange a demo or set up a trial. Only RunDesk's own staff see these. |
| Technical logs | Our hosting providers keep standard logs (IP address, time, the request made) for a short time. | Security, fixing faults and preventing abuse. |
We don't ask for sensitive information (such as health information) and we ask operators not to enter it. We don't store card numbers in RunDesk.
How we collect it
Mostly from the operator and its staff as they use RunDesk, from customers who book through an operator's website, and automatically from the app (sign-in sessions, timestamps, technical logs).
How we use it
- To provide RunDesk to the operator and its staff, and to keep it secure.
- To help with support requests.
- To bill the operator for its RunDesk plan (business details only).
We don't sell personal information. RunDesk has no advertising, no ad networks, and no tracking or analytics that follow you across other apps or websites. We don't use your information for marketing to you.
Where it's stored and who we share it with
- Supabase — database, sign-in and private file storage. Your company's data is stored in Supabase's Sydney, Australia region (ap-southeast-2).
- Cloudflare — hosts the RunDesk website and app pages and delivers them through its content delivery network (CDN).
- Email delivery for sign-in emails (invites, confirm-your-email and password reset), sent through our sign-in provider.
- OpenStreetMap map tiles and address search — only when maps or zones are used: the map area being viewed, or the address being looked up, is sent to OpenStreetMap's servers.
- Your employer (the operator): its admins can see and manage staff logins and the company's records.
- Anyone the law requires us to give it to (for example under a court order).
If RunDesk is transferred to another company (it is planned to move to a new RunDesk company), the personal information goes with it and stays protected by this policy. We'll update the operator name above when that happens.
Overseas disclosure
Your company's records are stored in Australia (Sydney). Some of our providers are based overseas or use overseas systems:
- Cloudflare runs a worldwide network, so RunDesk's app pages and the requests passing through it may be handled at Cloudflare locations outside Australia, including the United States.
- Supabase is a US company; its staff may access systems from overseas to keep the service running, under its security controls.
- OpenStreetMap map and address services are run from Europe and the United Kingdom.
We take reasonable steps (APP 8) to make sure these providers handle personal information in a way that's consistent with the Australian Privacy Principles.
How we protect it
- All connections are encrypted (HTTPS).
- Each company can only see its own data — this is enforced by the database itself, not just the app.
- Photos are kept in private storage and shown through short-lived links.
- Passwords must be at least 10 characters and are stored hashed.
If a data breach is likely to cause serious harm, we'll notify the people affected and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.
How long we keep it
- Company records are kept while the operator uses RunDesk. When an operator leaves, we delete its data within 90 days, after giving it a chance to export it.
- Invoices and other tax records are business records of the operator, which must keep them for 5 years under Australian tax law. The operator decides how it keeps them after that.
- A staff login is removed when the operator's admin removes it, or when you ask us to delete it (see below). The sign-in account itself is deleted within 30 days of your request.
- Backups are overwritten on a rolling basis within 30 days.
Access, correction and deletion
You can ask for a copy of the personal information we hold about you, or ask us to correct it (APPs 12 and 13). Most records belong to the operator, so the quickest way is usually to ask your company's RunDesk admin, who can see and fix them. You can also contact your company's RunDesk admin (usually the owner or office manager), or RunDesk itself through the person who set up your company's RunDesk account. We'll answer within 30 days, it's free, and we'll check who you are before sharing or changing anything. If we can't do what you ask, we'll tell you why in writing.
To delete your RunDesk login, use Delete my RunDesk login… in the app, or see Delete your RunDesk account.
Complaints
- Tell us first: contact your company's RunDesk admin (usually the owner or office manager), or RunDesk itself through the person who set up your company's RunDesk account. Say what happened and what you'd like done.
- We'll acknowledge it within 7 days and aim to resolve it within 30 days.
- If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.
Children
RunDesk is a workplace app for businesses and isn't meant for children.
Changes to this policy
We'll update this page when things change, and change the date at the top.
Contact
Privacy questions: contact your company's RunDesk admin (usually the owner or office manager), or RunDesk itself through the person who set up your company's RunDesk account.