Wrench|

Privacy Policy

Last updated: 25 August 2026

1. Introduction

Wrench (“we”, “us”, “our”) is a product of Noor Al Maal (Pty) Ltd (registration number 2025/628530/07), a company registered in South Africa with its physical address at 9 Zena Road, Gillview, Johannesburg, 2091, built for independent mechanics and small workshops. This privacy policy explains how we collect, use, store, and protect personal information in compliance with the Protection of Personal Information Act (POPIA), 2013.

Wrench also does not currently use analytics, tracking, or advertising cookies of any kind. If that changes, this policy will be updated first.

2. Information We Collect

2.1 Workshop and Mechanic Information

2.2 Customer Information

2.3 Vehicle and Job Information

3. How We Use Information

We use the information collected solely for the purpose of:

4. Data Storage

Workshop data is stored in our cloud database, hosted on Supabase infrastructure within the European Union region. Photographs are stored in Supabase Storage with workspace-level access controls (Row-Level Security). Each workshop’s data is isolated from every other workshop’s data at the database level.

The application also caches data locally on the mechanic’s device so that it works without an internet connection. Local data is synchronised with the cloud when a connection is available. Deleting data from our servers does not automatically clear any copy already cached on your own device — clear your browser or app storage, or uninstall the app, to remove local copies.

We do not sell, share, or transfer personal information to third parties for marketing purposes.

Cross-border transfers: some of the third-party services listed in §9 operate outside South Africa — Supabase in the European Union, and Vercel, OpenAI and Paystack in the United States. Personal information may therefore be processed outside South Africa. We only use providers that maintain appropriate data protection safeguards, and we do not transfer personal information to any other country without such safeguards in place.

5. Legal Basis for Processing & POPIA Consent

We, and the workshops using Wrench, process a customer’s personal information primarily because it is necessary to perform the vehicle repair or service the customer has asked for — booking the vehicle in, running the inspection, and producing the quote and invoice. Before any customer’s information is captured, the mechanic also confirms the customer’s informed consent to that processing and to follow-up communication (for example, WhatsApp updates about their job). This consent is recorded with a timestamp on the customer record and can be withdrawn at any time by contacting the workshop.

6. Data Retention

We retain your workshop’s data for as long as your account is active. Per-customer data can be exported or deleted at any time from that customer’s profile page — see “Data Subject Rights” below for exactly what that does and does not remove. A tool to export your whole workshop’s data in one go is planned but not yet built; until it is, contact us directly for a full workspace export.

Financial records are the one exception to any deletion request. South African tax law (the Tax Administration Act) requires invoices and related financial records to be retained for 5 years from the date of issue. Wrench keeps a permanent copy of every invoice at the moment it is issued specifically so this obligation can be met even if the underlying customer record is later deleted — deleting a customer does not, and legally cannot, remove invoices already issued to them.

After cancellation, your workshop’s data remains stored but the workshop becomes read-only until you resubscribe. If you ask us to delete your workshop entirely, we do so, subject to the same 5-year financial-record retention rule above.

7. Data Subject Rights

Under POPIA, individuals have the right to:

Customers should direct data subject requests to the workshop that performed the inspection. On a customer’s profile page, a workshop owner can export that customer’s details, vehicles and job history as a file, or delete the customer — which permanently removes their contact details (phone, email, address, notes, and company/VAT details) and hides them from the workshop’s customer list and search. Their name is kept on past jobs so the workshop’s service history still makes sense, and any invoice already issued to them is kept exactly as issued, as South African tax law requires (see §6). For any matter the workshop cannot resolve, or to request a full workspace export, the customer or workshop may contact us using the details below.

8. Security

We implement security measures including Row-Level Security on every database table, encrypted connections (HTTPS), Content Security Policy headers, input validation, rate limiting, and CORS protections. Customer-facing report links are tokenised and expire after 90 days — because these links do not require login, anyone who receives one can view the report until it expires, so share them only with the customer they belong to. Workshop owners are responsible for keeping their account credentials confidential.

If we become aware of a security compromise involving your personal information, we will notify the Information Regulator and affected individuals as required by POPIA, without unreasonable delay.

9. Third-Party Services

We use the following third-party services to operate Wrench:

10. Changes to This Policy

We may update this privacy policy from time to time. The “Last updated” date at the top of this page indicates when the policy was last revised. Material changes will be given at least 30 days’ notice through the application before they take effect.

11. Contact

For privacy-related queries or to exercise your data subject rights, please contact us at the email address listed on our website or in the application settings.

Terms of Service →