Privacy Policy

Overrun is an Australian marketplace for surplus trade materials, operated by Overrun AU · ABN 94 245 738 263 · hello@overrunau.com.au — a business name registered with ASIC on 25 July 2026 and operated by its holder as a sole trader. In this policy “Overrun”, “we”, “us” and “our” refer to that business. “You” refers to anyone who visits the website at overrunau.com.au or uses any account or service on it.

We collect only what we actually need to run the marketplace.

Information you give us directly:

• Your name, email address, and password when you create an account (handled by our authentication provider, Clerk).
• The suburb, state, and postcode of each item you list. This is the location of the material itself - a job or pickup site - not a home address, and you enter it per listing. Selecting a suburb also stores that suburb’s approximate centre point so buyers can search by area. We do not collect GPS coordinates or precise location from your device, and we do not ask for a location on your profile.
• Your ABN and (optionally) business name when you choose to verify your ABN. We validate the ABN against the Australian Business Register at the time of entry; we do not store payment card details.
• Payment details when you subscribe to a paid membership. Card numbers and CVCs go directly to Stripe and never touch Overrun’s servers. We receive only subscription status, tier, and billing period.
• Content you publish: listing titles, descriptions, prices, condition, pickup/delivery preferences, and photos.
• Messages you send to other members through the in-app inbox.
• Anything else you send us in an email or support request.

Information collected automatically:

• Server logs, including your IP address, browser type, device type, referring URL, and timestamps. Used for security, fraud prevention, and diagnosing errors.
• Analytics events via Google Analytics 4, only after you accept analytics cookies through the consent banner. See our Cookie Policy for the full cookie list.
• Anonymous performance metrics via Vercel Analytics.
• Error reports via Sentry when something crashes. These may include the URL you were on, your account ID, and a stack trace, but not the content of any input fields.

We do not collect information about you from third parties, and we do not collect sensitive information as defined by the Privacy Act.

We use personal information to:

• Create and manage your account.
• Publish your listings and messages to the marketplace.
• Show buyers listings in their area, and display each item’s pickup location on its listing.
• Send you transactional emails: new-message notifications, listing-posted confirmations, membership receipts, and account or security notices.
• Process membership subscriptions and receive payments (via Stripe).
• Detect and prevent fraud, spam, or abuse of the marketplace.
• Diagnose bugs and understand aggregate usage of the site (via Sentry and Google Analytics 4).
• Comply with Australian tax, consumer, and privacy law.

We do not sell your personal information. We do not run behavioural advertising and we do not send unsolicited marketing emails. If we ever add optional product-update emails in the future, they will be opt-in and unsubscribable.

Service providers:

We use the following processors to run the site. Each is bound by a written agreement to use your data only for the services they provide to us, and to protect it to a standard equivalent to the Australian Privacy Principles.

• Clerk (US) - authentication and account management. Privacy policy.
• Stripe (AU/US) - payment processing and subscription billing. Privacy policy.
• Cloudinary (US) - hosting and delivery of listing photos. Privacy policy.
• Resend (US) - transactional email delivery. Privacy policy.
• Vercel (US) - website hosting and anonymous performance analytics. Privacy policy.
• Sentry (US) - error monitoring. Privacy policy.
• Upstash (AU region) - rate limiting, to stop spam and abuse of the marketplace. Stores only a counter keyed to your account ID for a short period; no name, email, or content. Privacy policy.
• Google Analytics 4 (US) - site usage analytics.
• Meta Platforms (US) - the Meta Pixel, which measures whether our Facebook and Instagram advertising brings people to Overrun. It loads only after you accept advertising cookies, and we never send it your name, email or listing contents. Only loaded after you accept analytics cookies via our consent banner. Privacy policy.
• Termly (US) - cookie consent management. Privacy policy.

Other members:

Your account name appears on listings you publish and on messages you send, alongside the suburb and state of the item itself. Your ABN-verified badge, if enabled, also appears on your listings. Your email address, phone number, and home or business address are not disclosed to other members through Overrun unless you choose to share them yourself in a message.

Legal disclosures:

We may disclose personal information if we are required to do so by Australian law, a court order, or a lawful request from a regulatory authority; or where we reasonably believe disclosure is necessary to protect our rights, the safety of a user, or the integrity of the marketplace.

Business transfer:

If Overrun is ever sold, merged, or otherwise transferred to another operator, personal information may be transferred as part of that transaction. The acquiring entity will be bound to protect it to a standard at least equivalent to this policy.

Most of the service providers listed above are based in the United States or route data through servers outside Australia. By using Overrun you consent to your personal information being processed in those countries. Each provider is contractually bound to protect your data to a standard equivalent to the Australian Privacy Principles, and where the provider certifies to the EU/US Data Privacy Framework, that framework applies too.

Traffic to overrunau.com.au is served over TLS/HTTPS. Passwords are hashed by Clerk using industry-standard algorithms and are never stored in Overrun’s own database in plaintext. Payment card numbers are handled entirely by Stripe under their PCI DSS Level 1 certification and never reach our servers.

No online system is 100% secure. If we become aware of a data breach that is likely to result in serious harm to affected users we will notify them and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.

We keep personal information only as long as we need it, and no longer than the law requires.

• Account data: retained while your account is active. When you delete your account, personal identifiers are removed from the active database within 30 days; backups are rotated out within a further 30 days.
• Listings: soft-deleted listings are retained for 12 months so that historic conversation threads remain readable to the other party, then hard-deleted.
• Messages: retained as long as either party still has an account.
• Payment and tax records: retained for 7 years to meet Australian Taxation Office record-keeping obligations.
• Server logs: retained for 90 days.
• Analytics data: Google Analytics 4 retains event data for 14 months by default.

Under the Privacy Act 1988 you have the right to:

• Access the personal information we hold about you.
• Correct anything that is inaccurate or out-of-date.
• Delete your account and associated personal information (subject to legal retention obligations described above).
• Withdraw consent for any processing that relies on your consent, including opting out of analytics cookies via the consent banner.
• Complain to us, and if not satisfied, escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, email us at hello@overrunau.com.au. We will respond within 30 days and will not charge a fee for reasonable requests.

Overrun is intended for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we discover that an account has been created by a minor we will deactivate the account and delete the associated data. If you believe a minor has provided us with personal information, email hello@overrunau.com.au.

No uniform industry standard for interpreting Do-Not-Track browser signals has been agreed. We therefore do not currently respond to them. If you want to prevent analytics tracking, decline analytics cookies via the consent banner or clear consent via the “Cookie preferences” link in the footer.

We may update this policy from time to time to reflect changes in the service or in the law. The “Last updated” date at the top of this page will always show the current version. If we make a material change we will notify account holders by email at least 30 days before the change takes effect.

For any privacy question or request:

Email: hello@overrunau.com.au

ABN 94 245 738 263