Privacy Policy

CarMaint Ltd collects and processes personal information under the Privacy Act 2020 (New Zealand). This policy sets out what we collect, why we collect it, who we share it with, where it is stored, how long we keep it, and how you can access or correct it.

1. Our legal basis

The Privacy Act 2020 (New Zealand) is the primary legislation governing personal information held by CarMaint. CarMaint collects and processes personal information under that Act.

CarMaint also has obligations under its agreements with Stripe, Afterpay, Apple, Google, Microsoft and Expo that affect how personal information is handled.

Nothing in this policy limits any person’s rights under the Privacy Act 2020 or any other applicable New Zealand legislation.

2. What we collect, and why

CarMaint collects personal information only for lawful, specific and clearly defined purposes.

If you are a customer or user of the app

• Account details (name, email and phone; a postal address only where your workshop records one for you, for example for invoicing) — to create and manage accounts and facilitate bookings.
• Vehicle information (registration, VIN, make, model) — to facilitate service bookings and maintain service history.
• Payment information (tokenised payment references) — to process transactions through Stripe and Afterpay.
• Usage data (IP address, device type, session logs) — to operate and improve the platform.
• Service history data (photos, videos, invoices) — to maintain a record of vehicle services.
• Photos, videos and documents you choose to add — taken with your camera or picked from your photo library through the app: photos and videos of your vehicle or a job, a photo or PDF of a tax invoice, and estimate walkthrough videos, which include sound. We remove the location and camera details your phone embeds in a photo when it is uploaded; a video file may keep the details your device recorded.
• Profile photo — if you choose to add one to your account.
• Date of birth — to confirm you meet the age requirement in section 15.
• A notification token for your device — issued by the app’s notification service so we can send you reminders and job updates you have turned on. It identifies your app installation for messaging only; it is not an advertising identifier and we do not use it to track you.
• Vehicle registration records — when you or a workshop look up a registration plate, we retrieve the vehicle’s details (make, model, year, VIN, colour, WoF and registration expiry) from the New Zealand vehicle-data provider named in section 6 and store that record against your vehicle.

CarMaint does not store full credit card or bank details.

Records your workshop already holds. If you were already a customer of a workshop before it joined CarMaint, the workshop may load the details it already holds about you (name, contact details and your vehicle’s registration and service history) into CarMaint so it can keep servicing your vehicle. We hold those details on that workshop’s behalf and use them only for its work with you until you create your own account or ask us to stop.

What the CarMaint app asks your phone for

The app asks for permission only when you use the feature that needs it, and you can withdraw any of these in your phone’s settings:

• Camera and photo library — to take or attach photos and videos of your vehicle, a job or an invoice.
• Microphone — only as part of recording an estimate or inspection walkthrough video. The app does not record audio on its own.
• Notifications — to deliver reminders and job updates. These are on by default; you can turn each type off in the app’s Notification Settings. Push notifications also need your phone’s permission, which the app asks for the first time. We never use these channels for marketing without your active opt-in (see section 4).
• Face ID, Touch ID or fingerprint — to sign in quickly if you enable it. This check happens entirely on your device: CarMaint never receives your face or fingerprint data, only whether the check passed.

The app does not ask for or collect your location, and it does not read your contacts, calendar or messages. It does not use an advertising identifier or any other identifier that follows you across apps.

If you are a workshop on the platform

• Business registration and contact details — to onboard and manage workshops on the platform.
• Banking details — to process disbursements.
• Staff information — to verify qualifications and manage platform access.

3. The principles we apply

CarMaint applies the following principles to all personal information we handle:

• Lawful purpose — personal information is collected only for a lawful purpose directly connected to CarMaint’s operations.
• Limited collection — we collect only the information necessary for the stated purpose.
• Accuracy — we take reasonable steps to ensure personal information is accurate and up to date.
• Retention — personal information is retained only for as long as necessary and in accordance with CarMaint’s data retention schedule.
• Security — personal information is protected against unauthorised access, disclosure or loss.
• Transparency — individuals are informed about how their information is collected and used.
• Access and correction — individuals have the right to access and correct their personal information.

CarMaint will not use personal information in ways that are technically permissible but ethically questionable. We believe that personal information belongs to the individuals who provide it and that it must be handled with respect, honesty and integrity.

Privacy considerations are assessed before any new data collection, feature or product is developed or launched, and only data that is genuinely necessary is collected.

4. Consent

CarMaint obtains, records and manages consent for data processing in accordance with the Privacy Act 2020:

• Consent must be freely given, specific, informed and unambiguous.
• Where CarMaint relies on consent as the basis for processing personal information, consent is obtained before processing commences.
• Consent for marketing communications is obtained through an active opt-in mechanism — pre-ticked boxes or implied consent are not acceptable.
• You have the right to withdraw consent at any time. Withdrawal of consent will be processed promptly and in any event within 5 business days.

By using the app, you consent to storage of account, contact and vehicle information on secure servers; to sharing necessary data with workshops, Stripe and Afterpay for transaction purposes; and to reasonable use of anonymised data for analytics and service improvement.

5. Marketing communications

CarMaint may send you marketing communications relating to the app and its services. You must actively opt in to receive such communications. You may opt out at any time by using the unsubscribe link in any email or by contacting support@carmaint.com. CarMaint complies with the Unsolicited Electronic Messages Act 2007 (New Zealand).

6. Who we share your information with

CarMaint shares personal information with third parties only when necessary and only under appropriate safeguards. The approved third parties are:

• Stripe Payments NZ Ltd — payment processing.
• Afterpay — payment processing.
• Google (Google Workspace) — email, document storage and collaboration.
• Microsoft (Microsoft 365 and Azure) — productivity tools and cloud infrastructure.
• Expo — delivers the app’s push notifications. Expo receives your device’s notification token and the content of each notification we send you.
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) — the notification networks for iPhone and Android respectively, which carry those notifications to your device.
• CarJam — New Zealand vehicle-registration data. When a registration plate is looked up, the plate is sent to CarJam and the vehicle’s details are returned to us.
• Resend — sends CarMaint’s transactional email (verification codes, booking and quote notices, reminders). Resend receives your email address and the content of each message.

We also share the information necessary to carry out your booking with the workshop you are dealing with.

All third-party providers must have appropriate data protection practices in place. Any new third-party data sharing arrangement must be approved before implementation.

CarMaint will never sell, rent or trade personal information.

7. Where your information is stored

The CarMaint platform and its database run in Microsoft Azure’s New Zealand North region, and the photos, videos and documents you upload are stored there. Access to a stored file always requires a signed-in session that is entitled to the job it belongs to; files are never published at an open web address.

Account, contact and vehicle information is stored on secure servers, which may be located outside New Zealand. Some personal information may be processed or stored overseas by approved third-party providers, including Google and Microsoft. CarMaint ensures those recipients maintain appropriate data protection standards comparable to the Privacy Act 2020.

CarMaint intends to expand to Australia, the USA and other regions. As CarMaint expands internationally, data localisation and cross-border transfer requirements for each jurisdiction will be assessed and documented before the platform launches in that market. Applicable consumer protection and privacy legislation may differ by jurisdiction, and localised versions of CarMaint’s policies will be introduced for each jurisdiction as the platform expands.

8. How long we keep your information

• Customer account and transaction records — 7 years from the date of the last transaction. This includes the technical and usage data described in section 2 (IP address, device type, session logs), which are audit records of those transactions and are kept for the same period.
• Service history data — 7 years from the date of service.
• Photos, videos and documents attached to a job — kept with that job’s service record for the same period, and removed with it.
• Workshop records — 7 years from the date of last activity.
• Financial and tax records — 7 years, in accordance with New Zealand tax law.
• Consent records — 7 years from the date consent was given or withdrawn.
• Data breach records — 7 years from the date of the incident.

Stored information may be retained for up to seven years after an account is closed, for audit and legal compliance. When data is no longer required it is securely deleted or destroyed.

9. Your service history

CarMaint stores vehicle service history, images and related records within the app for convenience. We take reasonable steps to protect data but cannot guarantee absolute security. You should download or export your records before deleting your account.

The stored records are for convenience only and do not replace official invoices or warranty documentation. Workshops remain responsible for maintaining their own service and warranty records in accordance with applicable warranty and consumer law obligations.

Photos, videos and documents. Photos, videos and documents attached to a job are stored as part of that job’s service record and kept for the same period, then removed with it. When a photo is uploaded we remove the location and camera details your phone embedded in it. A video file may keep the details your device recorded.

Workshops you deal with. A workshop you have booked with or been served by can see your vehicles and the work it has done for you. It cannot see what you paid another workshop, or another workshop’s invoices or line items.

Transferring history when a vehicle is sold. You have unlimited access to your vehicle service history stored on the app. When a vehicle is sold, the current registered owner may initiate a service history transfer through the app to transfer the vehicle’s records to the new owner’s CarMaint account. The transfer must be initiated by the current registered owner. CarMaint is not responsible for transfers not initiated prior to the sale of a vehicle.

10. Accessing and correcting your information

You have the right to request access to the personal information CarMaint holds about you. Requests must be:

• submitted in writing to support@carmaint.com;
• accompanied by sufficient information to verify your identity.

We will respond within 20 working days of receipt. Where a request is complex or involves a large volume of information, CarMaint may extend the response timeframe by a further 20 working days, notifying you of the extension and the reason.

You also have the right to request correction of inaccurate personal information, and to request deletion of your data where retention is no longer required. All requests will be actioned within 20 working days.

11. Keeping your information secure

Personal information is protected against unauthorised access, disclosure or loss. Security and access controls are built into new features from day one. CarMaint takes reasonable steps to protect data but cannot guarantee absolute security.

12. If something goes wrong

Where a data breach is suspected or confirmed, CarMaint will assess whether the breach constitutes a notifiable privacy breach under the Privacy Act 2020. Where notification is required, the Office of the Privacy Commissioner and affected individuals will be notified as soon as practicable. Breach records are retained for a minimum of 7 years.

The Office of the Privacy Commissioner can be contacted at privacy.org.nz or 0800 803 909.

13. Cookies

CarMaint sets one cookie of its own. When you sign in to the CarMaint platform we set a single cookie named session_token, which keeps you signed in as you move between pages. It is strictly necessary: without it you would be signed out on every page. It is marked HttpOnly, so scripts running in your browser cannot read it; it is restricted with SameSite=Lax; and in production it is sent only over HTTPS. It is cleared when you sign out.

On the screens where you pay for a quote or an instalment plan, Stripe’s payment library loads in your browser and sets two cookies of its own, __stripe_mid and __stripe_sid, which Stripe uses to detect fraudulent activity. These are set whether or not you are signed in, because a quote can be opened and paid from a link we send you. Stripe is a payment processor we share information with, described in section 6, and Stripe’s own privacy policy governs those cookies.

We set no advertising or analytics cookies, and we do not use cookies to build a profile of you or to serve advertising. The CarMaint website at carmaint.com sets no cookies at all and carries no advertising, analytics or tracking tags.

14. Analytics and crash reporting

By using the app you consent to reasonable use of anonymised data for analytics and service improvement.

CarMaint uses no third-party analytics or crash-reporting services. Neither the CarMaint app nor the CarMaint web platform embeds an analytics, attribution or crash-reporting component — there is no Google Analytics, Firebase Analytics, Sentry, Amplitude, Mixpanel, PostHog, Segment, Datadog or Bugsnag in either — and CarMaint does not use advertising identifiers or track you across other companies’ apps and websites. The CarMaint app does not ask for or collect your location.

15. Children and young people

To use the CarMaint app:

You must be at least 16 years old or otherwise legally permitted to own or operate a vehicle in New Zealand.

If you are under 18, you confirm you have parental or guardian consent to use the App and to enter into service or payment agreements.

16. Changes to this policy

We may review or update this policy from time to time to reflect changes in our operations, platform or applicable law. We will provide reasonable notice of any material changes.

17. Governing law

This policy is governed by and construed in accordance with the laws of New Zealand. Nothing in this policy limits any person’s rights under the Privacy Act 2020 or any other applicable New Zealand legislation.

18. Contact us

CarMaint Ltd
Registered in New Zealand · NZBN 9429053521057
375 Coatesville-Riverhead Highway, Coatesville, Auckland 0793
Email: support@carmaint.com
Phone: 0800 CARMAINT

See also our Customer Terms and Conditions.