Privacy Policy

1. What we collect

Account data: name, email and sign-in activity, managed by Clerk, our identity provider.

Workspace data: the records your organisation enters: clients, vehicles, surveys, photographs, stock, incidents and reports.

Technical data: request logs, device/browser metadata and service telemetry needed to run and secure the platform.

2. How we use it

To provide the service: store and display your organisation's records, sync field captures, and deliver reports and share links you create.

To operate and secure the platform: authentication, abuse prevention (rate limits, audit logs), backups and diagnostics.

We do not sell data, and we do not use your workspace data for advertising.

3. Corporate affiliation

If a shop affiliates to a corporate parent, aggregate rollups of that shop's activity (counts such as clients, vehicles and open incidents) become visible to the parent's members. The affiliation is declared by the shop's own manager and can be removed in Settings.

4. Roles under POPIA

For workspace data, your organisation is the responsible party and TyreSync acts as the operator; we process it only on your behalf and under your instructions.

For account and technical data, we act as the responsible party.

We use sub-processors to run the service: Clerk (identity, covering all web authentication, fraud and abuse prevention), Supabase (database and file storage) and Vercel (hosting). Each processes data under its own safeguards.

5. Retention and deletion

Workspace data is kept while the shop is active. Deleted records are removed from active use and expire from backups within a bounded retention window.

Share links expire by token revocation; revoking a link ends external access to that report or batch immediately.

6. Security

Data is scoped per organisation and served only to its members. Photographs and documents live in private storage and are served through short-lived signed URLs. Factory API access uses revocable scoped keys.

No method is perfect; if a breach risks your data we will notify affected organisations without undue delay, as POPIA requires.

7. Your rights

Under POPIA (and GDPR where applicable) you may request access, correction, deletion or portability of personal information, and object to processing.

Workspace data requests go to your organisation's owner first; they control the records. Contact us for anything account-level.

8. Contact

Privacy questions and requests: privacy@tyresync.app.

If unresolved, you may approach the Information Regulator (South Africa).