Privacy Policy

This Privacy Policy explains how AutoCertus (“AutoCertus”, “we”, “us”, “our”) collects, uses, shares and protects personal information when you use our website and progressive web app at app.autocertus.com (the “Service”).

AutoCertus is a vehicle-information platform: we help you record a vehicle’s health, service, maintenance and ownership history, and run AI-assisted diagnostics on problems you describe. This policy applies to everyone who uses the Service, anywhere in the world.

If you are in South Africa, this policy is written to comply with the Protection of Personal Information Act, 2013 (POPIA). If you are in the EEA, Switzerland or the United Kingdom, it is written to comply with the General Data Protection Regulation (GDPR) and UK GDPR.

AutoCertus is the data controller / responsible party for the personal information processed through the Service. You can reach our privacy contact at privacy@autocertus.com.

We collect the following categories of information:

3.1 Account information

• Name, email address, authentication identifiers (handled by our auth provider, Clerk).
• Profile details you choose to add: title, nickname, phone number, recovery email, country, city, postal code.
• Preferences: units (metric / imperial), technical knowledge level, notification channels, marketing consent, theme.

3.2 Vehicle information

• Make, model, year, VIN, licence-disc / registration details, colour, fuel type, odometer readings.
• Photos, scans of licence discs, invoices and other documents you upload.
• Service, maintenance, repair, fuel and diagnostic logs you enter or that we parse from your uploads using AI.

3.3 Diagnostic and AI interactions

• The symptoms, questions and free-text descriptions you submit for diagnosis or warning-light analysis.
• The AI-generated responses we return, and metadata about the request (model used, timestamp, credit cost).

3.4 Payment and subscription information

• Transaction identifiers, amounts, tier, subscription status and timestamps.
• Card details are handled directly by our payment processor (PayFast) — AutoCertus never receives or stores your card number or CVV.

3.5 Technical and usage information

• IP address and the country derived from it (via Cloudflare), user-agent, device type, approximate time zone.
• Sign-in timestamps, feature usage events, error logs, and rate-limiting counters.
• For anonymous diagnostic users: a short-lived rate-limit record keyed to your IP and a Cloudflare Turnstile token — no account is created.

We use personal information to:

• Create and maintain your account, authenticate sign-ins and keep the Service secure.
• Provide the features you use — storing your vehicles, running diagnostics, generating reports, tracking your credit balance and subscription status.
• Process your payments and handle refunds or disputes.
• Send you service communications (credit expiry warnings, receipts) and, only if you opt in, marketing communications.
• Detect and prevent fraud, abuse and automated scraping — particularly on the anonymous diagnostic endpoint.
• Improve the Service: diagnose bugs, understand feature usage in aggregate, and train / tune prompts for our AI features (we do not use your identifying data to train third-party foundation models).
• Comply with our legal obligations — for example, responding to lawful requests from regulators or complying with tax and accounting rules.

If you are in the EEA, Switzerland or the UK, we rely on the following legal bases:

• Performance of a contract — providing the Service you signed up for, processing your payments, delivering the reports and features tied to your tier.
• Legitimate interests — keeping the Service secure, preventing abuse, improving the product, and showing first-party service communications. We balance these against your rights and have tried to minimise the data we rely on.
• Consent — for marketing emails and any feature you explicitly opt into. You can withdraw consent at any time.
• Legal obligation — retaining records we are required to keep, or disclosing information when we are legally compelled.

We process personal information in line with the eight conditions of POPIA, including limiting processing to what is necessary, collecting information directly from you where possible, keeping it accurate, and implementing appropriate security safeguards. We do not collect special personal information (race, religion, biometrics, etc.) unless you voluntarily include it in free-text you send us.

You have the right under POPIA to access your information, request correction or deletion, object to processing in certain circumstances and to lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

We do not sell your personal information. We share it only with the service providers we rely on to run AutoCertus, each of which is bound to use the data only for the purposes we set out:

• Clerk — account authentication and session management (United States).
• Cloudflare — hosting, database (D1), object storage (R2), key-value store and CDN. Your requests are processed on Cloudflare’s global edge network.
• Google LLC — Gemini is our AI model provider for diagnostics and vehicle reports.
• PayFast — payment processing for South African users.
• Email-sending provider — we may use a transactional email provider (for example, Resend) to deliver service and marketing emails. This is described more fully once the feature is live.

We may also disclose personal information if we are legally required to (for example, in response to a lawful court order), or if necessary to protect the rights, property or safety of AutoCertus, our users or the public.

We use only a small number of essential and functional cookies. We do not use advertising cookies and do not serve third-party advertising.

• Strictly necessary — Clerk’s session cookies, which keep you signed in. These cannot be switched off without breaking the Service.
• Functional — your theme preference, unit preference and recent-vehicle selection, stored in your browser so the app behaves consistently between visits.

Depending on where you live, you have some or all of the following rights in relation to your personal information:

• Access — request a copy of the information we hold about you.
• Rectification — ask us to correct information that is wrong or incomplete.
• Deletion / erasure — ask us to delete your account and the personal information we hold about you (subject to limited retention obligations).
• Restriction — ask us to pause processing in certain cases.
• Objection — object to processing we carry out on the basis of legitimate interests, including direct marketing.
• Portability — ask for a machine-readable export of the data you gave us.
• Withdraw consent — at any time, where we rely on consent.
• Lodge a complaint — with the Information Regulator of South Africa, the UK ICO, or your local EU data-protection authority.

To exercise any of these rights, email privacy@autocertus.com. We may need to verify your identity before acting on the request. We will respond within the timeframes required by the applicable law (generally 30 days under GDPR, reasonable time under POPIA).

We keep account and vehicle information for as long as your account is active, plus a short grace period after deletion so that accidental deletions can be reversed. Diagnostic submissions and AI responses are kept tied to the vehicle that owns them until you delete that vehicle or the account. Payment records are kept for as long as required by tax and accounting law in the relevant jurisdiction (typically five to seven years). Anonymous rate-limit records are kept for hours, not days.

Personal information is encrypted in transit using TLS and at rest within our hosting provider’s systems. Access inside AutoCertus is limited to the people who need it to operate the Service. No system is perfectly secure, though — if you believe your account has been compromised, please contact us immediately.

AutoCertus is operated from South Africa, and our service providers are based in jurisdictions including the United States, the European Union and the United Kingdom. Where we transfer personal information out of the EEA, Switzerland or the UK, we rely on the providers’ approved transfer mechanisms (Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework). Where we transfer personal information out of South Africa, we do so only to recipients with comparable protections, or with your consent.

AutoCertus is not directed at children. We do not knowingly collect personal information from anyone under 18 in South Africa or under 16 in the EEA / UK (or the lower age set by your member state). If you believe a child has given us their information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top and, where the change is material, we will notify you in-app or by email before the change takes effect. The current version is always the one published at this URL.

Questions, requests or complaints about this policy? Email privacy@autocertus.com.