← AutoRepairs NZ

Privacy Policy

Last updated: 27 October 2026 · Version: 1.6

1. Who we are

AutoRepairs NZ ("AutoRepairs", "we", "us") operates the AutoRepairs NZ marketplace at autorepairs.nz. AutoRepairs NZ is operated by Mellers Tech Limited, a company registered in New Zealand.

We are an "agency" for the purposes of the Privacy Act 2020 and this policy describes how we comply with the Information Privacy Principles (IPPs).

Privacy Officer: AutoRepairs NZ Privacy Officer, our contact page.

2. What we collect

If you are a vehicle owner

• Account: email address; display name and phone number if you provide them.
• Vehicle: registration plate, VIN, year, make, model, variant, engine, fuel type, transmission, odometer reading.
• Job: category and description of the problem, symptoms, suburb, postcode, urgency, whether the vehicle is driveable, your service and cost preferences, and whether the work is an insurance claim (including insurer and claim reference if you tell us).
• Private contact block: exact address, contact phone, contact email and access notes. Stored separately from the job and released only to providers you connect with.
• Photos and video you upload of the vehicle or fault.
• Messages you exchange with connected providers, and reviews you write.

If you are a provider

• Business: trading name, NZBN, provider type, business address, operating mode, years of experience, team size, labour rate, MTA membership, insurance status.
• Service profile: categories, subcategories and service areas.
• Verification evidence you submit, and our reviewer's notes and decision.
• Billing: subscription status, plan, trial and renewal dates, and a Stripe customer reference. We never see or store your card number — card data goes directly to Stripe.
• Activity: jobs you express interest in, connections, quotes, messages, completed jobs and customer ratings.
• Card payments (if you turn them on): your Stripe account reference and whether it can take payments; for each invoice paid by card, the amount, Stripe's fee, our fee, the amount paid out and the payout date.
• Payment records and integrations (if you use them): parts cost and supplier on your invoice lines (never shown to your customers), an accountant's email address for copies of payment records, and your Zapier link for hnry.

If you run a fleet

• Vehicles: registration, details, WOF, rego, service and road user charge dates and distances, odometer readings, notes, and costs you log.
• Driver checks: when a driver scans a vehicle's QR code, we record the name they enter (optional), the odometer reading, the checklist results, any defect note, and the time. Only the fleet's account holder can see these records. We hold them on the fleet's behalf, and the fleet is responsible for telling its drivers about them.
• Billing: plan, trial and renewal dates, and a Stripe customer reference. We never see your card number.

Information a business keeps about its own customers

Providers can use our customer tools (customer book, reminders, review requests, invoices and digital inspections). The provider decides what to add, such as customer names, emails, phone numbers, vehicles, service dates, invoices and inspection photos. We hold and process this information on the provider's behalf, as their agent under section 11 of the Privacy Act 2020. We use it only to provide those tools, and we never use it to market to their customers. Every reminder and review request includes an unsubscribe link. If you are one of their customers and want to see or correct your information, ask the business; we will help them respond.

Businesses we invite to join

To invite automotive businesses to AutoRepairs, we keep a list of businesses built from information they publish themselves, such as their website or a public directory: business name, trade, area, website, and the business email address and phone number they publish, including a contact person's name where one is given. We use it only to contact the business about AutoRepairs and to record our contact with them. Every email includes a link to stop further emails; we stop within 5 working days. A business can also ask our Privacy Officer to see or delete what we hold.

Everyone

Standard technical information from your device: IP address, browser and device type, pages visited and timestamps, collected by our hosting and infrastructure providers for security and reliability.

Rewards programme interest

If you register interest in rewards, we store your account ID, whether you selected customer or business benefits, and the registration date to help plan the programme. You can remove your interest on the Rewards page. Registering interest does not share your details with suppliers or subscribe you to marketing emails.

3. Why we collect it, and our lawful basis

We collect this information because it is necessary to run the marketplace: to match jobs to relevant providers, to let you communicate and quote, to verify providers, to bill provider subscriptions, to prevent fraud and misuse, and to meet our legal obligations. We collect it directly from you (IPP 2). Where a field is optional, it is marked optional in the form; if you decline to give it, the effect is simply that matching or quoting may be less accurate.

4. What providers can see, and when

This is the part of the policy most people care about, so we set it out precisely. Access is enforced in our database, not just hidden in the app.

Photos are for the vehicle and fault: please don't include people, number plates you don't want seen, or documents with personal details.

You choose which providers to connect with, and a job can be connected to a maximum of three providers. Emails telling you a provider can help include a one-tap link that connects you to that provider without signing in, so keep those emails to yourself. If you tick "Let interested businesses call or text me" when posting, the first three providers who respond are connected straight away and receive your contact details. You can remove a connection at any time; the provider then loses access to your contact details, though they will retain any information already exchanged in messages.

Providers who stop paying their subscription lose access to new job matches. A provider already connected to your job keeps access to that job, so that work in progress is not disrupted.

5. Who else we share information with

We do not sell personal information, and we do not share it for third-party marketing. We use the following processors, who act on our instructions:

• Supabase — database, authentication and file storage. Data is hosted in Sydney, Australia (AWS ap-southeast-2).
• Stripe — provider subscription payments, and card payments on business invoices. When you pay an invoice by card, you pay the business's own Stripe account, so Stripe and that business receive your payment details. Stripe is the controller of card data it collects; see Stripe's own privacy policy.
• Zapier and hnry (only if a business turns this on) — a business can choose to send its own invoices and payment records, including its customer's name and email, to its hnry account through its own Zapier link. This happens at that business's direction.
• Our web host — serving the site and security logging.
• Email delivery — sending sign-in codes and notifications.
• Text message delivery (ClickSend) — when a business replies to a job you posted, we may text the mobile number you gave on that job with the business name and a link to see the reply. These texts are only about your own job, never marketing. We send at most three per job, and you can ask us to stop at any time.
• AI processing provider (when you use AI Assist) — processing the job description and coarse job context needed to create a clearer brief or provider checklist. AutoRepairs is configured so AI Assist does not send your exact address, phone number, email or other private contact block. The current rollout uses OpenAI when this optional feature is enabled.

We may also disclose information where required by law, to a regulator or court, to investigate suspected fraud or misuse, or to protect someone's safety.

6. AI Assist

AI Assist is optional. If you press an AI Assist button, we may send the text of the job description together with non-private context such as the job category, suburb or region, urgency and whether the vehicle is driveable to our AI processing provider. We do not send the private contact block (exact address, phone number or email) to AI Assist.

AI output is a drafting and triage aid only. It may be incomplete or wrong and is not a mechanical diagnosis, quote, safety inspection or professional recommendation. You should review and edit an AI-generated job brief before posting it. Providers remain responsible for their own diagnosis, advice and work.

7. Sending information overseas (IPP 12)

Your information is stored in Australia and may be processed in other countries where our providers operate, including the United States. Before sending personal information overseas we satisfy ourselves that the recipient is subject to safeguards comparable to the Privacy Act 2020, through contractual terms with each provider. Australia has privacy laws providing comparable safeguards.

8. How long we keep it

• Active accounts: for as long as your account is open.
• Jobs, quotes and messages: 7 years after the job is completed or cancelled, so that both parties have a record if a dispute or Consumer Guarantees Act claim arises.
• Billing records: 7 years, as required by the Tax Administration Act 1994.
• Verification evidence: for the life of the provider account, then 12 months.
• Closed accounts: deleted or de-identified within 90 days, except where a longer period above applies.

9. Your rights (IPP 6 and IPP 7)

You may ask us for a copy of the personal information we hold about you, and ask us to correct anything that is wrong. Email our contact page. We will respond within 20 working days, as the Privacy Act requires. There is no charge for a routine request.

You can also delete your account from your account settings, or by emailing us. If we cannot correct information you disagree with, you may ask us to attach a statement of correction, and we will.

10. Security

Access is enforced at the database level using row-level security, so a provider cannot retrieve information they are not entitled to even by calling our API directly. Uploaded photos are held in a private storage bucket. Sign-in uses one-time email codes rather than passwords. Card details never touch our servers.

No system is perfectly secure. If we suffer a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, as required by the Privacy Act 2020.

11. Cookies and local storage

We use browser local storage to keep you signed in and to preserve a job you are part-way through writing.

Google Analytics. We use Google Analytics to understand how the site is used: which pages are viewed, and when key steps happen, like a job being posted or a business signing up. Google Analytics sets its own cookies for this. We only send page names and short labels such as the type of job and the region. We never send your name, email, phone number, address, job description or vehicle, and page addresses are sent with job and link codes removed.

Google Ads measurement. If you arrive at AutoRepairs by clicking one of our Google ads, Google can also tell whether that ad led to a job being posted. Google may set advertising cookies for this, for up to 30 days after the click. We send Google that a job was posted, never what the job was, your details or your vehicle. Visitors who don't come from an ad get no advertising cookies. You can block or clear these cookies in your browser at any time, and see Google's own policy at policies.google.com/technologies/ads.

12. Children

The marketplace is intended for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact our Privacy Officer and we will delete it.

13. Changes

If we change this policy we will update the date above and, for material changes, notify you by email or in the app before the change takes effect.

14. Complaints

If you are unhappy with how we have handled your information, contact our Privacy Officer first. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner: privacy.org.nz, 0800 803 909.