Privacy policy.

1. Information we use

Gearshift is a connected vehicle ownership service used by participating dealerships and their customers. Depending on how you use it, we may process:

• Account and contact details: name, email address, phone number, dealership relationship, login credentials and secure session information.
• Vehicle and ownership records: registration, VIN, make, model, delivery date, odometer readings, service history, warranty or plan details, bookings, valuations and support conversations.
• Dealership information: administrator profiles, branch details, workshop availability, authorised calendar busy times, dealership applications and documents or images that an authorised user submits.
• Preferences and communications: service, booking, valuation, trip-summary and marketing notification choices, plus delivery and audit records needed to keep those choices effective.
• Technical and security information: device platform, app version, browser or user-agent details, IP-derived security signals, error information and the strictly necessary cookies or local storage used for sign-in and app operation. Gearshift does not use advertising cookies.

2. Location and mileage tracking

Tracking is off by default and starts only after you choose it in Gearshift and grant the device permissions. On Android, background tracking uses a visible location foreground-service notification. On iOS, the operating system may show its background-location indicator. You can turn tracking off in Gearshift or in your device settings at any time.

The first time you activate Gearshift on your phone, the app asks you to connect that vehicle with Bluetooth, Android Auto or CarPlay so we can recognise it later. The phone uses the active connection and any vehicle identity it advertises. A generic or custom head-unit name can be confirmed by you, while a connection that clearly identifies a different make or model is refused. We store a one-way hash of that connection, not the device name or address, and you can confirm up to three car connections. Headphones and other phones are not treated as your car. The phone then processes location, motion and optional Bluetooth signals locally to start and end trips and to distinguish walking, cycling and vehicle travel. After a trip ends, Gearshift uploads a compressed path plus those scores. Servers snap that path to the road network, score whether it likely belongs to your registered vehicle, then delete the path within 31 days. Dealerships see only confirmed odometer kilometres—not coordinates, maps or Bluetooth names. Ambiguous travel such as an Uber is not added to your car.

The installed web app can calculate a foreground trip while it is open and still uploads only a daily distance total. Native Android and iOS apps continue first-stage classification in the background when the required permission is granted. Completed native trips may be held on the device until they can be uploaded securely.

3. How we use information

• Provide account access, vehicle records, service forecasts, bookings, support and valuation requests.
• Use confirmed trip and daily distance totals to update the odometer and recommend when to book a service, subject to your review and the settings you choose.
• Send transactional notices you request or need for the service. Dealership marketing and vehicle promotions are off unless you opt in when you activate your account, or later in notification settings. You can turn them off at any time. Your dealership chooses when to send a promotion; Gearshift does not message every client when new stock is loaded.
• Verify dealership applications, secure the service, prevent abuse, investigate incidents, maintain audit records and improve reliability.
• Meet legal, regulatory, accounting and dispute-resolution obligations. We do not use trip geometry for advertising, behavioural profiling or live vehicle tracking, and we do not show routes to dealerships.

4. Sharing and service providers

We share the minimum information needed for the ownership workflow. Your participating dealership and its authorised staff can see the customer, vehicle, service, booking, valuation and daily odometer information relevant to their relationship. They cannot access trip geometry, coordinates or route history.

We use carefully scoped providers to operate Gearshift:

• Cloudflare: Workers runs the application; D1 stores structured records; R2 stores private documents, media and short-lived encrypted trip geometry. These services also provide security and delivery infrastructure.
• Resend: sends transactional email from Gearshift addresses when email delivery is enabled.
• Google Maps Platform: helps authorised dealership users search and verify branch addresses. A separate Roads API key may snap consented native trip paths to the road network so kilometre totals are more accurate. Google does not receive this geometry for advertising.
• Calendar providers: a dealership administrator may connect Google Calendar or Microsoft 365 to read workshop busy times. Gearshift does not create or edit those calendar events.
• Apple and Google mobile services: the operating system and location/motion libraries process device signals required for the app’s optional tracking feature.

We do not sell personal information. We may disclose information to professional advisers, authorities or a successor service where reasonably necessary for law, security, fraud prevention, a dispute or a corporate transaction.

5. Retention and your choices

We keep account, vehicle, service, booking and support records while your account or dealership relationship is active and for as long as reasonably needed for legal, audit, security, accounting or dispute purposes. A dealership may retain records it is independently responsible for. Expiring sessions, password-reset links, invitation links and mobile tracking credentials are automatically cleaned up or revoked.

Encrypted trip geometry is kept only long enough to match the road network and score the journey, then deleted within 31 days. Confirmed daily distance summaries remain part of the vehicle’s service and odometer history until the account or dealership record is deleted or a lawful retention reason requires otherwise.

You can disable automatic tracking, change transport or daily-prompt choices, turn off optional notifications, correct profile details, or permanently delete your Gearshift account from Profile → Account settings. Deletion removes the account, credentials, sessions, tracking and account-specific requests, messages and client profile. Detached vehicle, completed-service and appointment records may remain where a dealership has a legal, accounting, audit or dispute-resolution duty. Read the full account deletion instructions, or email privacy@gearshift.co.za if you cannot sign in.

6. Your rights

Subject to applicable law, including South Africa’s Protection of Personal Information Act (POPIA), you may ask for access to, correction of or deletion of your personal information, object to a use, withdraw an optional consent, or ask about our processing. You may also complain to the Information Regulator of South Africa. We will explain any lawful reason we cannot complete a request.

We use access controls, encrypted connections, scoped dealership permissions, secure token storage and audit records to protect information. No online service can promise absolute security, so please protect your credentials and tell us promptly about suspected unauthorised access.

7. Contact and policy changes

For privacy, POPIA or data-rights questions, contact the Gearshift privacy team. For general product support, use the in-app support centre or support@gearshift.co.za.

We may update this policy as the service changes. The effective date above shows which version is current. If a change materially affects optional tracking or another consent choice, we will provide a clear notice in the app or through an appropriate channel.