LEGAL · ACCEPTABLE USE

Acceptable Use Policy.

Version 2.0 · Effective 31 July 2026

This Acceptable Use Policy (“AUP”) governs your use of the Pitlane HQ platform. It forms part of your agreement with Surau Engineering Pty Ltd (ABN 51 696 483 468), trading as “Pitlane HQ” (“PitlaneHQ”, “we”, “us”), and supplements our Terms of Service. Where this AUP and the Terms of Service both address the same conduct, the stricter obligation applies.

“You” means the workshop that subscribes to the Service, and every user you invite to it. You are responsible for the acts and omissions of your users, and for anyone using your account credentials.

1. Why this policy exists

Pitlane HQ sends messages, stores personal information, and processes payments on your behalf. Much of that activity is regulated, and some of it is carried out through suppliers whose own rules bind us. When you send an SMS through Pitlane HQ, you are the sender in substance: you chose the recipient, you hold the consent, and your business name appears on the message. This policy sets out what that responsibility means in practice.

2. General prohibitions

You must not use the Service to:

break any law, regulation, or industry code, or infringe anyone's rights;
store, send, or distribute malicious code, or content that is unlawful, threatening, abusive, harassing, defamatory, obscene, or that vilifies a person or group;
attempt to access any account, site, workshop, or system you are not authorised to access — including other tenants on the platform;
probe, scan, load-test, or attempt to defeat the security of the Service, except under a written engagement agreed with us in advance (see section 8);
use the Service for anything other than operating your own automotive workshop business, unless we have agreed otherwise in writing;
scrape or crawl the Service, or access it by automated means other than through documented APIs and integrations;
resell, sublicense, white-label, or redistribute the Service without our written permission;
misrepresent your identity or your relationship with any person, or impersonate another business on the marketplace or in messages;
upload personal information you have no lawful basis to hold, or import a contact list you did not collect yourself.

3. Messaging — SMS and email

This is the section most likely to cause you real trouble if ignored. Australian messaging law applies to you as the sender, and penalties under the Spam Act 2003 (Cth) are substantial and are enforced against senders, not platforms.

3.1 Consent

You must have consent from every recipient before you message them. Consent is either express (they asked to hear from you) or inferred from an existing business relationship — and inferred consent is narrower than most people assume.
Marketing messages require express opt-in. A service reminder to a customer whose vehicle you serviced is a different thing from a promotional offer, and the second one needs a real opt-in.
You must be able to prove consent for any recipient you message. That is the statutory requirement — the Spam Act puts the onus on the sender and does not set a fixed retention period. We require you to keep those records for the life of the messaging relationship plus five years as a condition of using the Service: it is our house rule, chosen to sit comfortably beyond any realistic complaint window, not a period the legislation prescribes. Pitlane HQ records consent captured through the platform; consent you collected elsewhere (on paper, in person, on your own website) is yours to evidence.

3.2 Identification and unsubscribe

Every commercial message must clearly identify your business. This is your responsibility, not something the platform does for you. Your message templates must name your workshop. We validate that consent templates contain a business-name token, but we do not automatically prepend your name to every outbound message — if you write a template that does not identify you, it will send as written.
Every commercial message must offer a functional unsubscribe. Pitlane HQ automatically recognises STOP, UNSUBSCRIBE, CANCEL, END and QUIT on inbound replies, revokes that customer's consent, and blocks further sends to the number.
You must not send to a recipient who has opted out, and you must not attempt to route around an opt-out by using a different number, a different site, or a different channel.

3.3 Timing, volume and content

Respect quiet hours. By default the platform blocks sends between 9pm and 8am, evaluated in the timezone configured on the sending site — not the recipient's own timezone, which we do not know. If you message customers in another timezone, that difference is yours to manage. An individual customer can have their own quiet window recorded, which overrides the default for them.
There is an after-hours override for genuinely urgent sends. It exists for real operational need — a vehicle is unsafe to drive, a customer is waiting — and using it for anything promotional is a breach of this policy regardless of what the platform permitted.
Do not send at a frequency a reasonable recipient would find harassing.
Do not send content in restricted categories: adult content, gambling, illegal products or services, high-risk financial offers, or anything requiring a licence you do not hold.
Do not use the Service for political or fundraising messaging — different rules apply and we do not support it.

3.4 Do Not Call Register

If you make or trigger voice calls to numbers you did not obtain directly from the customer, the Do Not Call Register Act 2006 (Cth) may require you to wash the list against the Register. Marketing calls are your responsibility to clear, not ours.

3.5 Supplier rules flow down to you

SMS delivery is carried out by Twilio; email is delivered by Resend, and voice calls run on RingCentral where you use Pitlane Phones. Each carries its own supplier rules. Twilio's Acceptable Use Policy and its messaging policies apply to traffic you send through Pitlane HQ, in addition to this AUP. Where Twilio's rules are stricter, the stricter rule applies. A carrier or Twilio can block or filter traffic independently of us, and we cannot compel delivery of a message a carrier declines to carry.

4. Recorded calls and transcription

If you enable call recording or transcription, you are responsible for obtaining whatever notice or consent the law of your State or Territory requires before a call is recorded. These requirements differ across Australia and some jurisdictions require every party to be informed. Our Call Recording Notice explains the obligation and what the platform does and does not do for you. Do not enable recording until you have read it.

5. Artificial intelligence features

AI output is a draft, never an answer. Every diagnostic, repair, pricing, safety, or employment decision remains yours and must be reviewed by a qualified person before you act on it or send it to a customer.
Do not present AI-generated text to a customer as a professional opinion without a competent human having checked it.
Do not use AI features to generate content you would not be permitted to send under section 3, or to produce misleading claims about a vehicle's condition, history, or roadworthiness.
Do not attempt to extract another tenant's data through an AI feature, or to manipulate a prompt into bypassing platform restrictions.

6. Marketplace, reviews and public listings

Listings must describe your actual business, services, and locations accurately.
Do not write, solicit, incentivise, or publish fake or misleading reviews, and do not review yourself or a competitor. Misleading reviews breach the Australian Consumer Law and are enforced by the ACCC.
Do not selectively suppress genuine negative reviews while promoting positive ones in a way that misleads consumers about your overall standing.
Do not use the marketplace or job-posting features to harvest contact details for unrelated marketing.

7. Payments

Where you take card payments from your own customers through the Service, you must comply with the card scheme rules and the terms of the acquiring provider, and you must not surcharge beyond your actual cost of acceptance (a Competition and Consumer Act 2010 requirement, enforced by the ACCC).
Do not use the payment features to process transactions unrelated to your workshop business, to process payments on behalf of a third party, or to test card numbers.
Do not store full card numbers, CVVs, or magnetic-stripe data anywhere in the Service, including in free text fields, notes, or uploaded files.

8. Security research

We welcome good-faith reports. Email security@pitlanehq.com.au before testing anything, and never test against another workshop's data. Do not run automated scanners, denial-of-service tests, or social engineering against us, our staff, or our suppliers. We will not pursue a researcher who reports privately, acts within the scope we agree, and does not access, alter, or retain other people's data.

9. Fair use of platform resources

The Service is priced for normal workshop use. We may apply rate limits, and we may contact you if your usage is materially disproportionate — for example bulk API traffic, automated record creation, or storage far outside the pattern of a workshop of your size. Outside the immediate-suspension cases in section 11, we will talk to you before restricting anything, unless the usage is actively degrading the platform for other customers.

10. Monitoring

We do not read your customer records, messages, or files as a matter of course, and we do not use them to train models except through the optional, clearly-labelled contribution described in our Privacy Policy. We do access data where it is necessary to provide the Service, investigate a suspected breach of this AUP, respond to a security incident, or comply with a legal obligation. Access by our staff is logged.

11. Enforcement

What we do depends on what happened:

Most cases — we contact you. Something looks wrong, we ask, you fix it. That is the normal path.
Feature suspension. Where messaging or payment activity creates immediate risk to recipients, to carriers, or to the platform, we may suspend that feature while we sort it out, and tell you why.
Immediate suspension without notice. Reserved for unlawful activity, a live security threat, conduct that jeopardises our supplier relationships, or a legal direction requiring it.
Termination. For serious or repeated breaches, in accordance with the Terms of Service.

Suspension of a feature does not delete your data, and does not relieve you of fees already incurred. If we suspend or terminate for breach of this AUP, our obligations on data export and deletion in the Terms of Service and the Data Processing Addendum continue to apply.

12. Changes to this policy

We may update this AUP. For changes that materially increase your obligations we will give at least 30 days' notice by email to your registered billing contact and by notice in the Service, and the version number above will change. Changes required by law or by a supplier may take effect sooner where we have no choice, and we will tell you when that happens. Your acceptance of a version is recorded against the version number, so you can always see what you agreed to and when.