Privacy Policy

1. Who we are

KickTyres is a New Zealand-based service that also serves customers in Australia. This policy explains how we collect, use, and protect your personal information under New Zealand’s Privacy Act 2020 and, for our Australian customers, the Australian Privacy Principles under the Privacy Act 1988 (Cth).

2. What we collect

• Account details. Email address and login credentials (passwords are hashed; we never see them).
• Vehicle queries: number plates you look up and vehicle details returned by data providers.
• Inspection data. Your answers, notes, and photos from guided inspections.
• Payment data: handled by Stripe. We store only a customer reference and transaction status, never card numbers.
• Technical data: IP address and basic request logs, used for security and rate limiting. On our public car-fault pages we also record the browser identifier (user agent) and language your browser sends, so we can detect and report automated copying of that content. These records are not linked to your account, and we keep them for 30 days.

3. How we use it

• To provide the service: lookups, risk analysis, reports, and your inspection history.
• Inspection photos are sent to our AI provider (Anthropic) solely to analyse them for your report. They are not used to train AI models.
• To process payments and prevent fraud and abuse, including detecting automated systems that copy our car-fault research in bulk, and reporting them to the network provider they operate from.
• To contact you about your account or material changes to the service.

We do not sell your personal information.

4. Who we share it with

• Supabase: database, authentication, and photo storage.
• Stripe: payment processing.
• Anthropic: AI analysis of inspection photos and findings.
• Vehicle data providers. Your plate query is sent to retrieve vehicle details.

Some providers store data outside New Zealand. We only use providers with safeguards comparable to the Privacy Act 2020.

5. Retention and deletion

We keep your account data while your account is active. You can request deletion of your account and associated inspection data at any time by emailing support@kicktyres.com. We aim to complete deletion within 20 working days. Payment records are retained for 7 years as required by NZ tax law (which also satisfies the Australian Taxation Office's 5-year record-keeping requirement for Australian transactions). The technical security records described in section 2 are deleted after 30 days.

6. Your rights

Under New Zealand’s Privacy Act 2020, and under the Australian Privacy Principles if you are in Australia. You may request access to, or correction of, the personal information we hold about you. Contact us at the address above. If you are not satisfied with our response, New Zealand customers may complain to the Office of the Privacy Commissioner (privacy.org.nz), and Australian customers may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

7. Security

Data is encrypted in transit, access to production systems is restricted, and database access is protected by row-level security so users can only access their own records.