Privacy Policy for Mekanyk Sync Platform

Last Updated: 7 August 2026

1. Introduction

Welcome to the Mekanyk Sync Platform ("Platform", "Services"), developed and operated by Mekanyk Tech ("we", "us", "our"), a company based in South Africa. The Platform consists of our customer mobile application, our workshop administration application, and our website (including public workshop and vehicle-listing pages).

We are committed to protecting your privacy and handling your personal information responsibly and in compliance with the Protection of Personal Information Act, 4 of 2013 ("POPIA") and other applicable data protection laws. For personal information processed through your Platform account, Mekanyk Tech is the responsible party.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform. Please read it carefully. If you do not agree with the terms of this policy, please do not access or use our Services.

2. Information We Collect

What we collect depends on how you use the Platform and whether you use it as a vehicle owner ("Customer") or as an automotive workshop ("Workshop").

• Account and Identity Data: Your name, email address, and phone number, provided when you register, and your password (stored only in protected, hashed form). If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Phone Verification Data: When you verify your phone number, we generate and send one-time passcodes ("OTPs") by SMS. We record the phone number and verification status.
• Vehicle and Booking Data: Details of vehicles you add (make, model, year, registration/license plate, VIN, colour, photos), booking requests, problem descriptions, preferred dates, service history, and job-progress updates.
• Workshop Business Data: If you register a Workshop — business name, address and location, contact details, service offerings and pricing, operating hours, team member details, photos, and, where provided for invoicing, business registration and VAT details.
• Billing Data (Workshops): Workshop subscriptions are billed through our payment processor, Paystack. We do not collect or store full card numbers — card details are captured directly by Paystack. We store payment references, a secure payment authorization token used for subscription renewals, your billing history, and the tax invoices we issue.
• Client Records Entered by Workshops: Workshops may record their own customers' details (such as names, contact details, and vehicles) to manage bookings, including walk-in bookings. See section 8 for how responsibility for this information works.
• Vehicle Sale Listing Data: If a Workshop lists a vehicle for sale, the listing details and photos are published on our public website. Sensitive identifiers such as the VIN and registration plate are not shown publicly. If you enquire about a listed vehicle, the contact details you submit are shared with the selling Workshop so it can respond.
• AI Interaction Data: The content of your conversations with the Mekanyk AI assistant and related metadata. AI requests are processed by third-party AI providers (see section 6).
• Location Data: With your permission, your device's precise or approximate location, used to find workshops near you and for location-based features. You can withdraw this permission in your device settings.
• Media: Photos and images you upload (for example vehicle photos and workshop photos), which are stored with our media hosting provider.
• Communications Data: Messages exchanged through the Platform, support requests, and delivery metadata for notifications we send you (SMS, email, push, and — where available — WhatsApp).
• Device and Usage Data: Information collected automatically, such as device identifiers, IP address, operating system, app version, and usage activity. Our apps also attach integrity tokens (Firebase App Check) to requests to protect the Platform from abuse.
• Push Notification Tokens: If you enable push notifications, we store the device token needed to deliver them. You can turn notifications off in your device settings.

3. How We Use Your Information

We use the information we collect to:

• Create, secure, and manage your account, including phone verification by OTP and sign-in with Google.
• Facilitate bookings between Customers and Workshops, including walk-in bookings, booking status updates, and secure booking-tracking links.
• Operate Workshop tools: schedules, team management, client records, reports, and dashboards.
• Process Workshop subscription billing, renewals, and payment-failure follow-ups, and issue tax invoices as required by South African law.
• Publish vehicle-sale listings that Workshops choose to make public, and pass buyer enquiries to the selling Workshop.
• Provide the Mekanyk AI assistant and AI-supported features (such as helping interpret a service request or generating workshop content).
• Provide location-based features such as finding workshops near you.
• Send service communications: OTPs, booking confirmations and updates, tracking links, billing notices, and support responses, by SMS, email, push notification, and — where available — WhatsApp.
• Monitor, analyze, and improve the Platform's performance, reliability, and user experience.
• Detect, prevent, and investigate fraud, abuse, and security incidents, including through request-integrity checks and error monitoring.
• Comply with our legal obligations, including tax and accounting requirements.
• Respond to your requests and provide customer support.

Under POPIA, we process your personal information where it is necessary to perform our contract with you, where we have a legitimate interest (such as securing and improving the Platform), where you have consented (such as location access and optional marketing), and where the law requires it (such as tax record-keeping).

4. Disclosure of Your Information

We may share information we have collected about you in the following situations:

• Between Customers and Workshops: When you book with a Workshop, that Workshop receives the information needed to provide the service — your name, contact details, vehicle details, and booking specifics. When a Workshop responds, its business details are shared with you. If you enquire about a vehicle listed for sale, your enquiry and contact details go to the selling Workshop.
• Public Pages: Workshop profile information and vehicle-sale listings that Workshops choose to publish appear on our public website and may be indexed by search engines. Public vehicle listings never include the VIN or registration plate.
• Service Providers (Operators): We use trusted third parties that process information on our behalf, limited to what each needs to perform its service:
  • Payment processing — Paystack
  • SMS and (where available) WhatsApp delivery — Twilio
  • Email delivery — SendGrid (Twilio)
  • Push notifications — OneSignal
  • AI features — Google (Gemini) and OpenAI
  • App integrity and analytics — Google Firebase; website analytics — Vercel
  • Maps and location services — Google Maps
  • Media hosting — Cloudinary
  • Error monitoring — Sentry
  • Real-time messaging infrastructure — Ably
  • Application and database hosting — Render (hosted in the European Union) and Vercel
• By Law or to Protect Rights: Where release of information is necessary to respond to legal process, investigate or remedy potential violations of our policies, or protect the rights, property, and safety of others, as permitted or required by applicable law, including POPIA.
• Business Transfers: In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
• With Your Consent: For any other purpose disclosed to you, with your consent.

We do not sell your personal information.

5. Payments

Workshop subscription payments are processed by Paystack. Your card details are entered directly with Paystack and are protected under its security certifications; we never receive or store full card numbers. To support automatic monthly renewals, Paystack issues us a secure authorization token linked to your subscription. You can manage your subscription in the workshop application. Customers do not pay for vehicle services through the Platform — payment for services is arranged directly between you and the Workshop.

6. AI Features

The Mekanyk AI assistant and related AI features are powered by third-party AI providers (currently Google's Gemini models and OpenAI). The content you submit to these features is processed by those providers to generate responses. Please do not share personal information in AI conversations beyond what is needed for your question. AI outputs are informational and may be inaccurate — see our Terms and Conditions.

7. Security of Your Information

We use administrative, technical, and physical safeguards to protect your personal information, including encryption of data in transit, hashed password storage, tokenized payment authorizations, request-integrity verification on our apps, and role-based access controls. While we take reasonable steps to secure your information, no security measures are perfect, and we cannot guarantee absolute security.

8. Client Records Entered by Workshops

Workshops can record and manage their own customers' information on the Platform (for example when creating a walk-in booking). For those records, the Workshop is the responsible party under POPIA and must have a lawful basis for using that information; Mekanyk Tech processes it as an operator on the Workshop's behalf, under the Workshop's instructions and our security safeguards. If a Workshop has recorded your details and you want them corrected or deleted, please contact that Workshop first; we will support their compliance, and you may also contact us directly.

9. Your Rights under POPIA

In accordance with POPIA, you have the right to:

• Access: Request access to the personal information we hold about you.
• Rectification: Request correction of inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained personal information.
• Erasure: Request the deletion or destruction of your personal information under certain conditions.
• Object: Object to the processing of your personal information on reasonable grounds relating to your particular situation, unless legislation provides for such processing.
• Withdraw Consent: Withdraw your consent at any time where we rely on consent to process your personal information.
• Lodge a Complaint: Lodge a complaint with the Information Regulator of South Africa (https://inforegulator.org.za) if you believe we are unlawfully processing your personal information.

To exercise these rights, contact us using the details below. You can also request account deletion from within the app or by contacting us.

10. Data Retention

We retain your personal information for as long as your account is active and as needed to provide the Services. After account closure we delete or anonymize personal information, except where we must keep it to meet legal obligations — for example, tax invoices and related billing records, which South African tax law requires us to keep for at least five years — or to resolve disputes and enforce our agreements.

11. Children's Privacy

Our Platform and Services are not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information.

12. International Data Transfers

Our primary application infrastructure is hosted in the European Union, and some of our service providers (such as our SMS, email, push notification, AI, and error-monitoring providers) process information in other countries, including the United States. Where your information is transferred outside South Africa, we take the steps required by POPIA's cross-border transfer rules to ensure it receives an adequate level of protection.

13. Cookies and Analytics

Our website uses cookies and similar technologies for essential functionality and, with your consent where required, analytics (Firebase Analytics and Vercel Analytics) to understand how the site is used and to improve it. You can manage cookie preferences through our cookie banner and your browser settings. Our apps use analytics and error monitoring to keep the Platform reliable.

14. Marketing Choices

Service communications (such as OTPs, booking updates, and billing notices) are necessary to provide the Platform. Optional marketing communications are sent only where permitted, and you can opt out at any time — via the unsubscribe link in emails, your device's notification settings for push, or by contacting us.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new Privacy Policy on this page and updating the "Last Updated" date, and for material changes we will provide additional notice through the Platform. You are advised to review this Privacy Policy periodically.

16. Contact Us

If you have questions or comments about this Privacy Policy, or wish to exercise your rights, please contact us at:

Mekanyk Tech info@mekanyk.com