Privacy policy

The Workshop est 1924 Ltd (“we”, “us”) makes Spanner, workshop management software, and runs this website. This policy explains what personal information we handle, why, and what you can do about it. We follow the New Zealand Privacy Act 2020.

This website

If you fill in the Book a demo form, we receive what you type: your name, your workshop's name, email, phone number and anything else you tell us. It is emailed to us so we can reply and arrange a demo. We use it only to talk to you about Spanner, and we don't add you to a mailing list without asking.

This website doesn't use advertising, tracking or analytics cookies. Like any website, our hosting provider keeps short-lived technical logs (such as IP addresses) to run and protect the site.

Spanner: whose information it is

When a workshop uses Spanner, it puts in information about its own customers, vehicles, staff and suppliers. That information belongs to the workshop, and the workshop decides what is collected and how it is used. We hold it on the workshop's behalf, only to provide Spanner to them, and we never sell it or use it for anyone else. If you are a customer of a workshop that uses Spanner, the workshop is the right place to ask about your information; we will help them answer you.

Spanner: what we handle for workshops

• Workshop users: names, email addresses, mobile numbers, roles and sign-in details, and which records each person created or sent.
• The workshop's records: customers and their contact details, vehicles, jobs, timesheets, estimates, invoices, purchase orders, messages sent from Spanner and replies to them.
• Billing details for the workshop's subscription.

Small conveniences, such as a person's colour theme or the order of their menu, are kept in their own browser or on their staff record. Signing in uses a cookie, which is needed for Spanner to work.

Where information is kept, and who helps us

Spanner's database is hosted in Sydney, Australia, and the app runs on servers in Sydney. We use a small number of trusted providers to run Spanner, each only for its own job:

• Supabase: the database and sign-in (stored in Sydney, Australia).
• Vercel: hosting for Spanner and this website (Sydney, Australia; a United States company).
• Resend: sending emails from Spanner and from this website's form (a United States company).
• WebSMS: sending and receiving text messages, when a workshop uses texting (New Zealand).
• CarJam: NZTA vehicle lookups, when a workshop asks for one (New Zealand).
• Xero: when a workshop connects its Xero account, invoices, bills and contacts are sent to it.

Some of these providers are overseas. We choose providers with strong security and privacy protections, comparable to those required in New Zealand. Some optional features send information elsewhere only when a person chooses to use them: for example, the weather display looks up the workshop's town with a weather service, and the “Have Claude interpret this report” button copies figures to the person's own clipboard for them to paste into their own Claude account.

Keeping it safe

Every workshop's data is kept separate from every other workshop's, at the database level. Connections are encrypted, access is by personal login, and what each person can see depends on their role. If a privacy breach happens that is likely to cause serious harm, we will tell the affected workshop and the Privacy Commissioner, as the law requires.

How long we keep it

We keep a workshop's information while it subscribes. When a subscription ends, we give the workshop a copy if it asks within 30 days, and delete the information after 90 days, apart from anything we must keep by law (such as our own financial records). Demo requests are kept only as long as we need them to follow up.

Your rights

You can ask to see the personal information we hold about you and ask us to correct it. Email us and we will respond within 20 working days. If you are not happy with how we have handled your information, please tell us first; you can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes

We may update this policy. The date at the top shows when it last changed.

Contact

Privacy questions go to The Workshop est 1924 Ltd, Pukekohe, New Zealand: hello@spanner.nz.