1. Who handles your data

Kp Mechanical provides PreTrip and is the data controller for personal data processed to operate the service. Your employer or company also decides which employee and vehicle information it submits, who receives its company code, and who may edit its records. This notice covers our handling of data, not your company's separate employment or fleet-management practices.

2. Data collected and why

• Company and subscription information: company name, company code, Paddle customer and subscription identifiers, payment environment, subscription status and billing-period end date. We use these to provide company access and manage subscriptions.
• Inspection information: driver name, vehicle registration, odometer reading, checklist results, defect notes and timestamps. We use these to provide inspection records, company searches and PDF downloads.
• Editor and security information: editor names, hashed PINs, manager permissions, edit history and manager action logs. We use these to authorise changes, identify who changed records and protect record integrity. PINs are stored as hashes, not readable PIN values.
• Optional photos and AI results: uploaded vehicle images and any personal information visible in them, plus generated safety findings. We process these to provide the photo check. Avoid including faces, unrelated documents or other unnecessary personal information. Photos and AI results are not saved in your inspection record by the current app.
• Technical and usage information: IP addresses, device/browser information, requests and error or security diagnostics that may be processed by our hosting and service providers. These support service delivery, troubleshooting and fraud prevention.
• Support communications: contact details and messages you or your company send to us, used to respond to enquiries and resolve problems.

3. Basis for processing

Where a legal basis is required, we rely on contract performance to provide subscriptions, company access, inspections and requested photo checks; legitimate interests to protect the service, maintain audit records and troubleshoot problems; legal obligations for required compliance records; and consent where applicable for optional processing. Legitimate interests are balanced against your rights. We do not use your inspection content for marketing. Any future optional marketing or non-essential tracking requiring consent will be subject to that consent.

4. Who receives data

People with your company code can view the company's inspection records; authorised PIN holders may edit them and managers can view PIN-management audit logs. Anyone who receives a downloaded PDF from a company user can read the information in that file.

We share necessary data with service providers for hosting, database storage, security, diagnostics and support, including Lovable Cloud. Optional photo checks send images through Lovable AI Gateway to its model provider for analysis. The current AI request disables response storage, but this does not establish the providers' own operational log-retention periods.

Paddle, our Merchant of Record, receives data needed for product sales, subscription management, payments, tax compliance and invoicing. Paddle collects checkout contact and payment information directly under its Privacy Policy. We may also share necessary information with professional advisers such as legal and accounting advisers, and authorities when required by law.

5. Retention

Company, inspection, editor and audit data are retained while needed to provide company records and meet legitimate safety, audit, dispute-resolution or legal requirements. Cancellation ends access but does not automatically delete stored records. There is currently no automatic deletion schedule. We assess retention and deletion requests with the company and delete or anonymise personal data when it is no longer needed, subject to legal obligations. Optional photos and results are held in the current browser session rather than saved with inspections; providers may separately retain technical logs under their own policies. Support and diagnostic information is retained only as long as needed for its purpose or applicable legal requirements.

6. Security and international processing

We use appropriate technical and organisational measures, including encrypted transport, hashed PINs and server-side company access controls. Company records are separated, and changes require PIN verification and are logged. No system is completely secure; keep your company code and PIN private and share PDFs carefully.

Hosting, AI and payment providers may process information outside New Zealand. Where required, we use appropriate contractual or other safeguards for international disclosure. If UK or EEA transfer rules apply, relevant safeguards may include adequacy decisions or standard contractual clauses, as appropriate.

7. Your privacy rights

Under applicable New Zealand privacy law, you can request access to and correction of your personal information and raise concerns about its handling. Contact your company manager to arrange a request to Kp Mechanical and identify the records involved. We may need to verify your identity and company authority before releasing or changing data. You may complain to the New Zealand Office of the Privacy Commissioner.

Where GDPR or similar laws apply, rights may also include erasure, restriction, portability, objection and withdrawal of consent without affecting earlier lawful processing. You may complain to your local supervisory authority. We respond to GDPR requests within one month unless a lawful extension applies. Some information may need to be retained to satisfy legal obligations or protect others' rights.

8. Cookies and browser storage

PreTrip uses essential browser storage to remember your company code on the device. Interface preferences may also be stored locally or in an essential preference cookie. Remove stored site data through your browser settings to clear these preferences; you will need to enter your company code again. Paddle's checkout may use cookies or similar technologies for payments, security and fraud prevention, described in its privacy information. PreTrip does not currently add analytics or marketing cookies. If non-essential cookies are introduced, we will provide appropriate information and preference controls before using them where consent is required.

9. Updates and requests

We may update this notice as the service changes and will notify affected companies of material changes. For privacy questions or requests, ask your company manager to contact Kp Mechanical on your behalf. For data collected directly during checkout, contact Paddle through paddle.net.