1. Who We Are

DealerCostPro is operated as a software-as-a-service (SaaS) product providing profit tracking, expense management, and document generation tools for independent motor vehicle dealers in South Africa.

Responsible Party (POPIA): DealerCostPro
Contact: support@dealercostpro.com
Website: dealercostpro.com

2. Information We Collect

2.1 Information you provide directly

• Account information: Full name, email address, phone number (optional), and password when you register using email and password.
• Business information: Dealership name, vehicle purchase and sale prices, expense details, supplier information, and customer details entered when generating documents.
• Document data: Customer names, ID numbers, physical addresses, and contact details entered when generating deeds of sale, tax invoices, or other legal documents.
• Payment information: Billing details processed through PayFast. We do not store your card details — payment processing is handled entirely by PayFast (Pty) Ltd.
• Communications: Any messages you send us via email, WhatsApp, or the in-app support function.

2.2 Information collected when you use Google Sign-In

If you choose to sign in with Google, we receive the following information from Google as part of the OAuth 2.0 authorisation process:

• Your name as registered with Google
• Your Google email address (verified email only)
• Your Google profile photo URL (used as your account avatar)
• A unique Google user identifier (used to link your account)

We do not receive, store, or access your Google password, Google contacts, Google Drive files, Gmail messages, or any other Google account data beyond what is listed above. Our use of information received from Google APIs is limited to what is necessary to provide and improve the DealerCostPro service and complies with the Google API Services User Data Policy, including the Limited Use requirements.

2.3 Information collected automatically

• Usage data: Pages visited, features used, time spent in the application, and actions taken (such as adding vehicles or generating documents).
• Device information: Browser type and version, operating system, screen resolution, and whether you are using a mobile or desktop device.
• Log data: IP address, access timestamps, error logs, and request data for security and debugging purposes.
• Cookies and session data: Session cookies to keep you logged in. We do not use advertising cookies or third-party tracking cookies beyond the Meta Pixel described below.

2.4 Meta Pixel data

We use the Meta Pixel (Facebook Pixel) on our marketing pages (dealercostpro.com, /challenge, /signup) to measure the effectiveness of our advertising. The Pixel records events including page views, how far you scroll, whether you click our call-to-action buttons, and whether you complete a signup or purchase. This data is shared with Meta Platforms Ireland Limited and used to measure ad performance and build advertising audiences. The Pixel does not operate inside the authenticated application — it only runs on our public marketing pages.

3. How We Use Your Information

Purpose	Legal basis (POPIA)
Creating and managing your account	Performance of contract
Providing the DealerCostPro service (profit tracking, documents, dashboard)	Performance of contract
Processing payments via PayFast	Performance of contract
Sending transactional emails (login links, trial reminders, account notices)	Performance of contract
Sending service improvement and product update emails	Legitimate interest (with opt-out)
Measuring advertising effectiveness via Meta Pixel	Legitimate interest
Security monitoring, fraud prevention, and debugging	Legitimate interest
Complying with legal obligations	Legal obligation
Improving our product through aggregate usage analysis	Legitimate interest

We do not use your data for automated decision-making that produces legal effects, sell your personal information to third parties, or use your dealership's financial data for any purpose other than providing the service to you.

4. Data Segregation and Security

Every piece of data you enter into DealerCostPro — vehicles, expenses, documents, supplier records, customer information — is stored and accessed exclusively under your user account. No other DealerCostPro user can view, access, or retrieve your business data. This isolation is enforced at the database level on every query.

We implement the following security measures:

• Passwords are hashed using bcrypt before storage. We never store plain-text passwords.
• All data transmission uses TLS encryption (HTTPS).
• Magic link authentication tokens are cryptographically random, single-use, and expire after 24 hours.
• Session tokens are stored server-side in a PostgreSQL-backed session store.
• Database access is restricted to application servers only — no direct public database access.
• All significant account actions are recorded in an audit log.

DealerCostPro is hosted on secure cloud infrastructure using PostgreSQL for data storage. Data is stored on servers located within cloud infrastructure operated by reputable providers under data processing agreements. While we implement strong security measures, no system is completely immune to breach. In the event of a data breach affecting your personal information, we will notify affected users in accordance with POPIA requirements within 72 hours of becoming aware.

5. Data Sharing and Third Parties

We share your personal information only in the following circumstances:

5.1 Service providers

Provider	Purpose	Data shared
PayFast (Pty) Ltd	Payment processing	Name, email, billing amount
Resend Inc.	Transactional email delivery	Name, email address
Google LLC	Sign-in authentication (if used)	Google ID, name, email (received from Google, not sent)
Meta Platforms Ireland Ltd	Advertising measurement (marketing pages only)	Hashed events via Pixel
Cloud hosting provider	Application hosting and infrastructure	All application data (as data processor)

5.2 Legal requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of DealerCostPro, our users, or the public.

5.3 Business transfers

If DealerCostPro is acquired, merged, or undergoes a change of ownership, your personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. Specifically:

• Active accounts: Data is retained for the duration of your subscription plus 90 days after cancellation, allowing you to reactivate or export your data.
• Trial accounts (expired, not converted): Account and vehicle data is retained for 30 days after trial expiry in read-only form, then deleted.
• Legal documents (deeds of sale, tax invoices): Retained for 5 years from generation date in compliance with South African tax and consumer protection requirements.
• Audit logs: Retained for 2 years for security and compliance purposes.
• Email logs: Retained for 12 months to prevent duplicate sends and for troubleshooting.
• Magic link tokens: Deleted immediately after use or upon expiry (24 hours), whichever comes first.

7. Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act, you have the following rights:

• Right of access: Request a copy of all personal information we hold about you.
• Right to correction: Request correction of inaccurate or incomplete personal information.
• Right to deletion: Request deletion of your personal information, subject to legal retention requirements.
• Right to object: Object to the processing of your personal information for direct marketing or where processing is based on legitimate interest.
• Right to data portability: Request your vehicle, expense, and account data in a portable format (CSV or JSON).
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to complain: Lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

To exercise any of these rights, contact us at support@dealercostpro.com. We will respond within 30 days.

8. Cookies

DealerCostPro uses the following cookies:

Cookie	Type	Purpose	Duration
session	Essential	Keeps you logged in during your session	Session (cleared on browser close) or 30 days if "remember me"
_fbp	Analytics	Meta Pixel browser identifier (marketing pages only)	90 days
_fbc	Analytics	Meta click identifier from Facebook ads	90 days

We do not use advertising cookies inside the authenticated application. You can disable cookies in your browser settings, but this will prevent you from remaining logged in.

9. Children's Privacy

DealerCostPro is a business tool intended for adults operating motor vehicle dealerships. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at support@dealercostpro.com and we will delete that information promptly.

10. International Data Transfers

Some of our service providers (including Resend and Meta) are based outside South Africa. Our application hosting provider and cloud infrastructure partners may also process data in their respective jurisdictions. Where personal information is transferred internationally, we ensure appropriate safeguards are in place, including contractual data processing agreements that impose data protection standards equivalent to POPIA. By using DealerCostPro, you acknowledge that your data may be processed by these providers in their respective jurisdictions.

11. Google API Disclosure

DealerCostPro's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request the minimum Google account data necessary for authentication (name, email, profile photo, and unique identifier).
• We do not use Google user data to serve advertisements.
• We do not allow humans to read your Google data unless you have given explicit permission, it is necessary for security purposes, or we are required to do so by law.
• We do not transfer Google user data to third parties except as necessary to provide the DealerCostPro service, subject to this policy.
• We do not use Google user data for any purpose other than creating and managing your DealerCostPro account.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address associated with your account) and by posting a notice on the DealerCostPro application at least 14 days before the changes take effect. Continued use of the service after the effective date constitutes acceptance of the revised policy. The date at the top of this page reflects the most recent update.

13. Contact Us

For any privacy-related questions, requests, or complaints: