Privacy Policy

How we handle personal information, in line with POPIA

Last updated: 24 August 2026 · Effective date: 24 August 2026 · Governed by South African law

1. The short version

Your dealership records live on your own computer, not on our servers. We hold your account email, your subscription status, and a copy of your database only if you choose to use cloud backup. Our website sets no cookies and does not track you across the internet.

The rest of this page sets out the detail required by the Protection of Personal Information Act 4 of 2013 (POPIA).

2. Who is responsible

AutoStock is supplied by GC Independent, a South African business, which is the responsible party for the personal information described here.

Information Officer: contactable at support@autoinvoice.co.za.

3. What we collect

When you create an account

Your name and email address.
A password, which is stored only as a cryptographic hash and is never visible to us.

When you subscribe

Your subscription status, plan and renewal date.
A payment reference from PayFast, and the amount and date of each payment.

We never see your card details. Card data is entered on PayFast's own systems and is never sent to us or stored by us.

When you use cloud backup

A copy of your AutoStock database, which will contain your business records and the details of your customers and suppliers.
The date and size of the backup.

The backup is stored in a private area accessible only to your own account. We do not open, inspect or analyse its contents. The bundled vehicle reference catalogue is stripped out before upload to keep it small.

When you visit our website

We count page views and clicks on the subscribe button so we know whether the site is working. For each visit we record only:

The page address visited.
The referring website's domain, if you arrived from one.
Whether the screen is phone, tablet or desktop sized.
A random session identifier held in your browser's sessionStorage, which is erased when you close the tab.

No cookies, no IP addresses, no device fingerprinting, no advertising trackers. None of what we record identifies you, which is why this site carries no cookie consent banner.

4. Information about your customers

When you use AutoStock you will capture personal information about other people, such as the names, identity numbers, contact details and addresses of the customers you sell to and the sellers you buy from. Some of this is required by the Second-Hand Goods Act.

That information is yours, and you are the responsible party for it under POPIA. It is stored on your computer. We only ever hold it if you use cloud backup, and then only to give it back to you.

Your own obligations to those people, including keeping their information secure and using it only for the purpose it was collected, remain yours.

5. Why we process it, and on what basis

To provide the service you paid for: account, licence checks and backups. Lawful basis: performance of a contract.
To take payment: processed by PayFast. Lawful basis: performance of a contract.
To support you: answering emails and WhatsApp messages you send us. Lawful basis: legitimate interest.
To keep records SARS requires: proof of sale and payment. Lawful basis: legal obligation.
To see whether the website works: anonymous counts only. Lawful basis: legitimate interest.

We do not use your information for advertising, and we do not sell it to anyone.

6. Who else is involved

We use a small number of service providers, each for one purpose:

Supabase hosts accounts, subscription records and cloud backups.
PayFast (Network) processes card payments.
Netlify hosts this website.

Some of these operate servers outside South Africa. Where personal information is transferred abroad, it is protected by the provider's contractual and security commitments as POPIA requires.

7. How it is protected

All traffic between you and our systems is encrypted in transit using TLS.
Backups are stored encrypted at rest, in a private area scoped to your account.
Row-level security means an account can only ever read its own records.
Passwords are hashed and are never recoverable, by us or anyone else.
Your sign-in token is stored on your computer using Windows' own encryption, tied to your Windows account.

8. How long we keep it

Account details: while your account exists, and for as long afterwards as the law requires.
Payment records: five years, as SARS requires.
Cloud backups: until you replace them or ask us to delete them.
Website analytics: aggregate counts only, with nothing that identifies a person.

9. Your rights under POPIA

You may:

Ask what personal information we hold about you.
Ask us to correct anything inaccurate.
Ask us to delete your account and your cloud backup.
Object to processing based on legitimate interest.
Complain to the Information Regulator of South Africa.

Email support@autoinvoice.co.za and we will respond within a reasonable period.

You do not need our permission to get your data out. AutoStock exports everything to CSV from inside the program, at any time, including while an account is locked for non-payment.

10. Changes to this policy

We may update this policy. Where a change materially affects how we handle your information, we will email registered users before it takes effect. The date at the top of this page always shows when it was last updated.

Privacy questions?

Email our Information Officer at support@autoinvoice.co.za
or WhatsApp 070 418 2281