LEGAL · ACCEPTABLE USE

Acceptable Use Policy.

Version 2.1 · Effective 12 September 2026 · Revised 13 October 2026

This Acceptable Use Policy (“AUP”) governs your use of the Pitlane HQ platform. It forms part of your agreement with Surau Engineering Pty Ltd (ABN 51 696 483 468), trading as “Pitlane HQ” (“PitlaneHQ”, “we”, “us”), and supplements our Terms of Service. Where this AUP and the Terms of Service both address the same conduct, the stricter obligation applies.

“You” means the workshop that subscribes to the Service, and every user you invite to it. You are responsible for the acts and omissions of your users, and for anyone using your account credentials.

1. Why this policy exists

Pitlane HQ sends messages, stores personal information, and processes payments on your behalf. Much of that activity is regulated, and some of it is carried out through suppliers whose own rules bind us. When you send an SMS through Pitlane HQ, you are the sender in substance: you chose the recipient, you hold the consent, and your business name appears on the message. This policy sets out what that responsibility means in practice.

2. General prohibitions

You must not use the Service to:

break any law, regulation, or industry code, or infringe anyone's rights;
store, send, or distribute malicious code, or content that is unlawful, threatening, abusive, harassing, defamatory, obscene, or that vilifies a person or group;
attempt to access any account, site, workshop, or system you are not authorised to access — including other tenants on the platform;
probe, scan, load-test, or attempt to defeat the security of the Service, except under a written engagement agreed with us in advance (see section 8);
use the Service for anything other than operating your own automotive workshop business, unless we have agreed otherwise in writing;
scrape or crawl the Service, or access it by automated means other than through documented APIs and integrations;
resell, sublicense, white-label, or redistribute the Service without our written permission;
misrepresent your identity or your relationship with any person, or impersonate another business on the marketplace or in messages;
upload personal information you have no lawful basis to hold, or import a contact list you did not collect yourself.

3. Messaging — SMS and email

This is the section most likely to cause you real trouble if ignored. Australian messaging law applies to you as the sender, and penalties under the Spam Act 2003 (Cth) are substantial and are enforced against senders, not platforms.

3.1 Consent

You must have a recipient's consent before you send them a marketing message, such as a promotion or offer, a win-back campaign, or a survey. Consent is either express (they asked to hear from you) or inferred from an existing business relationship — and inferred consent is narrower than most people assume.
Texts from Pitlane HQ's marketing features — bulk SMS, win-back campaigns, surveys and AI-drafted review requests — go only to customers whose SMS marketing consent is recorded. Pitlane HQ doesn't detect a promotion typed into any other message, so sending that only to customers who have consented is up to you. It does not check for consent before a marketing email: a win-back email can go to any customer with an email address who hasn't opted out of marketing, so having their consent to email them is up to you too.
Transactional messages, such as booking confirmations and reminders, service reminders, job updates, quotes, invoices and receipts, don't need recorded SMS marketing consent: Pitlane HQ doesn't check for it before sending them, but it doesn't text them to a customer who has opted out of SMS. The supplier rules in section 3.5 still apply to them. A message that includes a promotion must meet the marketing requirements in this section.
You must be able to prove consent for any recipient you send marketing to. That is the statutory requirement — the Spam Act puts the onus on the sender and does not set a fixed retention period. We require you to keep those records for the life of the messaging relationship plus five years as a condition of using the Service: it is our house rule, chosen to sit comfortably beyond any realistic complaint window, not a period the legislation prescribes. Pitlane HQ records consent captured through the platform; consent you collected elsewhere (on paper, in person, on your own website) is yours to evidence.

3.2 Identification and unsubscribe

Your business is the sender of the texts you send through Pitlane HQ, and the standard SMS setup verifies your business before a number is assigned to it. Every commercial message must clearly identify your business, and your message templates must name your workshop. This is your responsibility, not something the platform does for you: Pitlane HQ doesn't add your workshop's name to your messages. Bulk SMS, win-back, survey and AI-drafted review-request texts are checked for the words of the trading or legal name recorded for your business, apart from company suffixes such as Pty Ltd and a few common words, and refused when those words are missing; nothing is checked if no usable name is recorded. Other messages aren't checked for your name — the AI drafts you approve other than review requests (replies, job updates, complaint responses, payment chasers and translations) are transactional, so they aren't checked either. Consent-request templates can't be saved without the business-name placeholder.
Every marketing message must offer a working unsubscribe. Pitlane HQ adds “Reply STOP to opt out” to texts from its marketing features that don't already include it; any other marketing message needs its own. A STOP reply (or STOPALL, STOP ALL, UNSUBSCRIBE, UNSUBSCRIBE ME, UNSUB, CANCEL, END, QUIT, OPTOUT, OPT OUT, OPT ME OUT, REVOKE, STOP PLEASE, PLEASE STOP, STOP TEXTING, STOP TEXTING ME, STOP MESSAGING ME, STOP SENDING or STOP MESSAGES, as the whole reply) sent to your workshop's dedicated marketing number (including a retired marketing number) stops marketing texts only; job, booking and other transactional texts continue. A STOP sent to a main site number stops all SMS from your workshop. Either reply turns off SMS marketing consent for customer records matched to the sender's number, and the opt-out applies to the number even if no customer record matches. START or UNSTOP sent to a current or retired marketing number restores SMS marketing consent and clears the marketing opt-out, but leaves any all-SMS opt-out in place. START or UNSTOP sent to a main site number clears the all-SMS opt-out without restoring SMS marketing consent. For a customer opted out of all SMS, YES sent to a current or retired marketing number restores SMS marketing consent and clears the marketing opt-out, but leaves the all-SMS opt-out in place. For that customer, YES sent to a main site number clears the all-SMS opt-out without restoring SMS marketing consent. Otherwise, YES confirms an eligible pending booking when one is found.
You must not send a message to a recipient who has opted out of it, and you must not route around an opt-out by sending from a different number or a different site. A STOP reply is recorded as an SMS opt-out; it doesn't withdraw consent the customer gave you to email them. In an SMS-then-email win-back campaign, a customer whose text is refused because they haven't given SMS marketing consent, or have opted out of SMS, is emailed instead if they have an email address and haven't opted out of marketing. You remain responsible for having consent for any marketing email that mode sends.

3.3 Timing, volume and content

Respect quiet hours. By default the platform blocks sends between 9pm and 8am, evaluated in the timezone configured on the sending site — not the recipient's own timezone, which we do not know. If you message customers in another timezone, that difference is yours to manage. An individual customer can have their own quiet window recorded, which overrides the default for them.
There is an after-hours override for genuinely urgent sends. It exists for real operational need — a vehicle is unsafe to drive, a customer is waiting — and using it for anything promotional is a breach of this policy regardless of what the platform permitted.
Do not send at a frequency a reasonable recipient would find harassing.
Do not send content in restricted categories: adult content, gambling, illegal products or services, high-risk financial offers, or anything requiring a licence you do not hold.
Do not use the Service for political or fundraising messaging — different rules apply and we do not support it.

3.4 Do Not Call Register

If you make or trigger voice calls to numbers you did not obtain directly from the customer, the Do Not Call Register Act 2006 (Cth) may require you to wash the list against the Register. Marketing calls are your responsibility to clear, not ours.

3.5 Supplier rules flow down to you

SMS delivery is carried out by Twilio; email is delivered by Resend, and voice calls run on RingCentral where you use Pitlane Phones. Each carries its own supplier rules. Twilio's Acceptable Use Policy and its messaging policies apply to traffic you send through Pitlane HQ, in addition to this AUP. Where Twilio's rules are stricter, the stricter rule applies. A carrier or Twilio can block or filter traffic independently of us, and we cannot compel delivery of a message a carrier declines to carry.

4. Recorded calls and transcription

If you enable call recording or transcription, you are responsible for obtaining whatever notice or consent the law of your State or Territory requires before a call is recorded. These requirements differ across Australia and some jurisdictions require every party to be informed. Our Call Recording Notice explains the obligation and what the platform does and does not do for you. Do not enable recording until you have read it.

5. Artificial intelligence features

AI output is a draft, never an answer. Every diagnostic, repair, pricing, safety, or employment decision remains yours and must be reviewed by a qualified person before you act on it or send it to a customer.
Do not present AI-generated text to a customer as a professional opinion without a competent human having checked it.
Do not use AI features to generate content you would not be permitted to send under section 3, or to produce misleading claims about a vehicle's condition, history, or roadworthiness.
Do not attempt to extract another tenant's data through an AI feature, or to manipulate a prompt into bypassing platform restrictions.

6. Marketplace, reviews and public listings

Listings must describe your actual business, services, and locations accurately.
Do not write, solicit, incentivise, or publish fake or misleading reviews, and do not review yourself or a competitor. Misleading reviews breach the Australian Consumer Law and are enforced by the ACCC.
Do not selectively suppress genuine negative reviews while promoting positive ones in a way that misleads consumers about your overall standing.
Do not use the marketplace or job-posting features to harvest contact details for unrelated marketing.

7. Payments

Where you take card payments from your own customers through the Service, you must comply with the card scheme rules and the terms of your acquiring provider — they, not PitlaneHQ, decide whether you may add a card surcharge at all. From 1 October 2026 the schemes forbid surcharging on eftpos, Mastercard and Visa cards, and American Express does the same by its own decision, following the Reserve Bank's removal of the prohibition that had stopped the schemes imposing no-surcharge rules. What matters is the date the card payment is made, not the date the invoice was issued. Where a surcharge is still permitted, it must never exceed your actual cost of acceptance — a Competition and Consumer Act 2010 requirement, enforced by the ACCC, which continues to apply. Weekend, public-holiday, booking and service fees are not card surcharges and are unaffected.
Do not use the payment features to process transactions unrelated to your workshop business, to process payments on behalf of a third party, or to test card numbers.
Do not store full card numbers, CVVs, or magnetic-stripe data anywhere in the Service, including in free text fields, notes, or uploaded files.

8. Security research

We welcome good-faith reports. Email security@pitlanehq.com.au before testing anything, and never test against another workshop's data. Do not run automated scanners, denial-of-service tests, or social engineering against us, our staff, or our suppliers. We will not pursue a researcher who reports privately, acts within the scope we agree, and does not access, alter, or retain other people's data.

9. Fair use of platform resources

The Service is priced for normal workshop use. We may apply rate limits, and we may contact you if your usage is materially disproportionate — for example bulk API traffic, automated record creation, or storage far outside the pattern of a workshop of your size. Outside the immediate-suspension cases in section 11, we will talk to you before restricting anything, unless the usage is actively degrading the platform for other customers.

10. Monitoring

We do not read your customer records, messages, or files as a matter of course, and we do not use them to train models except through the optional, clearly-labelled contribution described in our Privacy Policy. We do access data where it is necessary to provide the Service, investigate a suspected breach of this AUP, respond to a security incident, or comply with a legal obligation. Access by our staff is logged.

11. Enforcement

What we do depends on what happened:

Most cases — we contact you. Something looks wrong, we ask, you fix it. That is the normal path.
Feature suspension. Where messaging or payment activity creates immediate risk to recipients, to carriers, or to the platform, we may suspend that feature while we sort it out, and tell you why.
Immediate suspension without notice. Reserved for unlawful activity, a live security threat, conduct that jeopardises our supplier relationships, or a legal direction requiring it.
Termination. For serious or repeated breaches, in accordance with the Terms of Service.

Suspension of a feature does not delete your data, and does not relieve you of fees already incurred. If we suspend or terminate for breach of this AUP, our obligations on data export and deletion in the Terms of Service and the Data Processing Addendum continue to apply.

12. Changes to this policy

We may update this AUP. For changes that materially increase your obligations we will give at least 30 days' notice by email to your registered billing contact and by notice in the Service, and the version number above will change. Changes required by law or by a supplier may take effect sooner where we have no choice, and we will tell you when that happens. Your acceptance of a version is recorded against the version number, so you can always see what you agreed to and when.

A correction or clarification that doesn't add to your obligations is published as a revision of the current version. The revision date above changes and your acceptance of the version still stands. Each revision, and the exact wording it replaced, is listed below.

12.1 Revision history

15 September 2026 (version 2.1): Corrected section 3 to match how Pitlane HQ sends messages: the consent you need is for marketing messages, and Pitlane HQ needs recorded SMS marketing consent only for marketing texts; how your business is identified as the sender, and which marketing texts are checked for your name; what STOP and START replies do; and how an opt-out on one channel affects the other, including the email fallback in SMS-then-email win-back campaigns. No new obligation was added.
Wording this revision replaced
- 3.1 Consent: “You must have consent from every recipient before you message them. Consent is either express (they asked to hear from you) or inferred from an existing business relationship — and inferred consent is narrower than most people assume.”
- 3.1 Consent: “Marketing messages require express opt-in. A service reminder to a customer whose vehicle you serviced is a different thing from a promotional offer, and the second one needs a real opt-in.”
- 3.1 Consent: “You must be able to prove consent for any recipient you message.”
- 3.2 Identification and unsubscribe: “Every commercial message must clearly identify your business. This is your responsibility, not something the platform does for you. Your message templates must name your workshop. We validate that consent templates contain a business-name token, but we do not automatically prepend your name to every outbound message — if you write a template that does not identify you, it will send as written.”
- 3.2 Identification and unsubscribe: “Every commercial message must offer a functional unsubscribe. Pitlane HQ automatically recognises STOP, UNSUBSCRIBE, CANCEL, END and QUIT on inbound replies, revokes that customer's consent, and blocks further sends to the number.”
- 3.2 Identification and unsubscribe: “You must not send to a recipient who has opted out, and you must not attempt to route around an opt-out by using a different number, a different site, or a different channel.”
2 October 2026 (version 2.1): Corrected sections 3.1 and 3.2 to match how Pitlane HQ classifies declined-work follow-ups: they are transactional texts, not marketing, so they do not need SMS marketing consent and are not part of the marketing features whose texts are checked for the business name. No new obligation was added.
Wording this revision replaced
- 3.1 Consent: “You must have a recipient's consent before you send them a marketing message, such as a promotion or offer, a win-back campaign, a follow-up on work they declined, or a survey. Consent is either express (they asked to hear from you) or inferred from an existing business relationship — and inferred consent is narrower than most people assume.”
- 3.1 Consent: “Texts from Pitlane HQ's marketing features — bulk SMS, win-back campaigns, declined-work follow-ups, surveys and AI-drafted review requests — go only to customers whose SMS marketing consent is recorded. Pitlane HQ doesn't detect a promotion typed into any other message, so sending that only to customers who have consented is up to you. It does not check for consent before a marketing email: a win-back email can go to any customer with an email address who hasn't opted out of marketing, so having their consent to email them is up to you too.”
- 3.2 Identification and unsubscribe: “Bulk SMS, win-back, declined-work and survey texts are checked for the words of the trading or legal name recorded for your business, apart from company suffixes such as Pty Ltd and a few common words, and refused when those words are missing; nothing is checked if no usable name is recorded. Other messages, including AI drafts you approve, aren't checked for your name.”
9 October 2026 (version 2.1): Corrected section 3.2 to describe STOP, START/UNSTOP and conditional YES replies at current and retired marketing numbers and main site numbers; no new obligation was added.
Wording this revision replaced
- 3.2 Identification and unsubscribe: “Every marketing message must offer a working unsubscribe. Pitlane HQ adds “Reply STOP to opt out” to texts from its marketing features that don't already include it; any other marketing message needs its own. When a customer replies STOP or another common opt-out word, such as UNSUBSCRIBE, CANCEL, END or QUIT, Pitlane HQ opts out the customer record matched to that number: your workshop stops texting them, reminders and other transactional texts as well as marketing, and their SMS marketing consent is turned off. A reply from a number that isn't on any customer record blocks further texts to it from the site it was sent to, until your workshop unblocks the sender in Messages. When a customer on a customer record replies START or UNSTOP, transactional texts to them are turned back on; marketing needs their consent again.”
13 October 2026 (version 2.1): Corrected section 3.2 to list every opt-out reply Pitlane HQ recognises, in place of a few examples; no new obligation was added.
Wording this revision replaced
- 3.2 Identification and unsubscribe: “Every marketing message must offer a working unsubscribe. Pitlane HQ adds “Reply STOP to opt out” to texts from its marketing features that don't already include it; any other marketing message needs its own. A STOP reply (or UNSUBSCRIBE, CANCEL, END, QUIT and similar) sent to your workshop's dedicated marketing number (including a retired marketing number) stops marketing texts only; job, booking and other transactional texts continue. A STOP sent to a main site number stops all SMS from your workshop. Either reply turns off SMS marketing consent for customer records matched to the sender's number, and the opt-out applies to the number even if no customer record matches. START or UNSTOP sent to a current or retired marketing number restores SMS marketing consent and clears the marketing opt-out, but leaves any all-SMS opt-out in place. START or UNSTOP sent to a main site number clears the all-SMS opt-out without restoring SMS marketing consent. For a customer opted out of all SMS, YES sent to a current or retired marketing number restores SMS marketing consent and clears the marketing opt-out, but leaves the all-SMS opt-out in place. For that customer, YES sent to a main site number clears the all-SMS opt-out without restoring SMS marketing consent. Otherwise, YES confirms an eligible pending booking when one is found.”