The short version
- We collect what we need to run your logbook, reports and the features you use: your email address, an optional cell number, and your vehicles and logs.
- When you ask for a quote or book a service, we send your name, contact details and vehicle identifiers to the businesses you are contacting, and only to them.
- A shared verified report never shows your name, contact details, VIN, licence plate or costs.
- Payments are handled by PayFast (we never see your card number). Login codes and other SMS go through an SMS provider.
- We do not sell your personal information and we do not show third-party advertising.
- You can update your details or delete your account yourself at any time.
What is new in this version
Since our August 2026 version Car Log has added verified reports and share links, services logged by mechanics, bookings, the SARS travel logbook, vehicle transfers, paid plans, cell numbers and SMS sign-in. This policy now explains how each of them handles personal information. It also corrects how we describe browser storage: the app uses your browser’s local storage, not cookies, to keep you signed in.
This policy explains how Car Log collects, uses, shares and protects personal information under the Protection of Personal Information Act 4 of 2013 (“POPIA”). It applies to our website and the Car Log web application. Words like “you” mean anyone whose personal information we handle, not only account holders.
1. Who we are and how to reach us
Car Log (carlog.co.za) is operated by Richard Soderblom, a sole proprietor trading as Car Log, based in Kempton Park, South Africa (“Car Log”, “we”, “us”). We are the “responsible party” under POPIA for the personal information described in this policy.
Our Information Officer is Richard Soderblom. You can reach us at help@carlog.co.za by phone: , or on WhatsApp: Message us on WhatsApp.
2. Whose information this covers
- Account holders: car owners, fleet owners, and the mechanics, parts suppliers and dealers who use Car Log for their business.
- People named by others: for example, an owner whose email address a mechanic enters when logging a service, or someone whose contact details appear in a quote request.
- People who open a shared report or use a logbook quick link that an account holder gave them.
- Website visitors.
3. What information we collect
| Category | What we collect | Where it comes from |
|---|---|---|
| Account | Email address; cell number (if you add one); your name (if you give it); account type (individual, fleet, mechanic, parts supplier or dealer); the time you accepted our terms; sign-in codes and attempts. | You, when you sign up and sign in. |
| Business profile | For mechanics, parts suppliers and dealers: business name, contact person, email, phone, city, the postal codes you serve, the part categories you stock, and your plan. | You, or our team when you ask us to set up your profile. |
| Vehicles | Make, model, year, engine details, VIN, licence plate, engine number and odometer readings. | You, or a mechanic who logs a service for you. |
| Fuel and service logs | Fuel fill-ups (litres, cost, odometer) and service records (date, type, work performed, cost, odometer). | You, or a mechanic. |
| Travel logbook | Trip date, purpose, odometer readings, distance, business or private category, and how the entry was captured. If someone else adds a trip through a quick link you shared, we also record the IP address it was sent from. | You, or a person you gave a quick link to. |
| Services logged by a mechanic | Your vehicle’s VIN or plate, your email address, the service details, and whether you confirmed or rejected the entry. | The mechanic enters them; you confirm or reject. |
| Quote requests and bookings | The parts or service you want, your notes, city and postal code, the date you asked for, your name, email, phone number and vehicle identifiers. | You. |
| Payments | Your plan, amounts, dates, invoice and receipt numbers, PayFast payment references and subscription token. We do not receive your full card number. | You and PayFast. |
| Messages | Emails and SMS we send you (type, time and delivery status), any SMS you send back to us (your number and message), and chats with us on WhatsApp (your WhatsApp number, profile name and messages). | Us, you, and our email, SMS and messaging providers. |
| Technical | IP address, browser and device type, timestamps, security and error logs, and rate-limiting data. | Collected automatically. |
| Support | What you send us when you contact us. | You. |
| Report activity | How many times a shared report link has been opened (not who opened it). | Collected automatically. |
4. How and why we use your information
| Purpose | Examples | Our lawful basis (POPIA section 11) |
|---|---|---|
| Provide Car Log | Your account, sign-in codes by email or SMS, the logbook, reminders, verified reports, sharing and vehicle transfers. | It is necessary to carry out our agreement with you. |
| Connect you with businesses | Parts quotes, service bookings, and services a mechanic logs for you. | It is necessary to carry out your request, and you choose to make it. |
| Payments and billing | Invoices, receipts, renewals and renewal reminders. | Our agreement with you, and our legal duty to keep financial records. |
| Keep Car Log safe | Rate limits, fraud and abuse prevention (including misuse of SMS), and a log of actions taken by administrators. | Our legitimate interest in protecting our users and service, and our legal obligations. |
| Support and service messages | Replying to you; confirmations; renewal notices; service reminders you have agreed to. | Our agreement with you and our legitimate interest in serving you. |
| Improve Car Log | Anonymised, combined statistics such as community averages for fuel consumption by engine type. These contain no names, emails, VINs or plates. | Our legitimate interest. The results are not personal information. |
| Marketing | Product news or offers, only if you have opted in. You can unsubscribe at any time. | Your consent. |
| Legal | Complying with the law, responding to legal process, and protecting our rights. | Legal obligation and legitimate interest. |
Businesses you contact (quotes and bookings)
When you request a parts quote, we send it to registered parts suppliers, or to mechanics if you need fitting, whose service area covers your postal code. That can be several businesses. Each receives your name, your email address and phone number (if you gave one), your vehicle’s make, model and year, its VIN, licence plate and engine number if they are on file, the parts you want, your city and postal code, and your notes.
When you book a service, the mechanic you chose receives the same kind of information plus the date you asked for. These businesses then look after that information for their own purposes. Our terms allow them to use it to respond to your request, and not for unrelated marketing.
Mechanics who log a service for you
A mechanic can log a service on your behalf by entering your vehicle’s VIN or plate and your email address. We email you a link to review it and choose Confirm or Reject. If you have not used Car Log before, we send you one invitation email. An entry you do not respond to expires after 14 days. Once you confirm, the entry becomes part of your vehicle’s history with a “Mechanic Confirmed” tag, and that mechanic may contact you about future service reminders. Every reminder has a one-click opt-out. Mechanics keep their own record of the work they did.
People you share a report with
A verified report is public to anyone who has its link, with no sign-in, until you switch sharing off. It shows the vehicle’s make, model and year, its engine details, the service history (date, type, work performed, odometer and whether a registered mechanic did the work), a fuel-economy summary, its verified status and how many times it has been opened. It does not show your name, email, phone number, VIN, licence plate or any costs. Please do not type personal information into the free-text “work performed” field, because that text appears on the report.
Vehicle transfers
When you sell a vehicle, you can give the buyer a transfer code. Before accepting, the buyer sees a preview of the vehicle: make, model, year, mileage, VIN, engine number and plate. When the buyer accepts, the vehicle and its service and fuel history move to the buyer’s account, all service costs are permanently set to R0.00, and any sharing link stops working. Your own travel logbook entries stay with you, and we email you an export of them.
Our service providers
We use other companies to run parts of Car Log. They may only use personal information to provide their service to us.
| Provider | What they do | What they receive |
|---|---|---|
| PayFast | Takes card and EFT payments and runs subscriptions. | The payment details you enter on PayFast, and the order details we send (amount, item, reference, your email address). |
| SMS provider (SMSPortal) | Delivers SMS such as login codes. | Your cell number and the text of the message. |
| Delivers our emails. | Your email address and the email content. | |
| Contabo, Interserver and Neon | Run Car Log and store its data. | All information we store. Sensitive vehicle identifiers are encrypted. |
| WhatsApp (Meta) | Lets you chat with us on WhatsApp. | Your WhatsApp number, profile name and the messages you send us. |
| Error monitoring, such as Sentry and Bugsnag | Help us find and fix faults. | Technical error reports, which can include IP addresses and account identifiers. |
Legal requirements and business changes
We may disclose information where the law requires it, to respond to a valid legal process, or to protect our rights or the safety of others. If Car Log is ever sold or merged, personal information may transfer to the new owner, who must protect it as described here, and we will tell you first.
What we do not do
We do not sell your personal information. We do not currently show third-party advertising. If we ever do, we will update this policy first and will not give advertisers your personal information without your consent.
6. Cell numbers and SMS
We ask you to give us both an email address and a South African cell number. If either is missing, we remind you each time you sign in until you add it. You may skip the reminder, and you can remove your number in Settings at any time.
- What we use it for: to let you sign in with a one-time code by SMS where that option is available, to confirm the number is yours, and, for messages beyond sign-in, only for the purposes described in this policy.
- Verification: we text a code to check the number is yours. A verified number can be linked to one account only.
- Login codes: we only send a sign-in code to a number that is verified on an account. We do not keep your code in readable form.
- South African numbers only.
- Replies: if you reply to one of our SMS, we record your number and message. Replying STOP to a reminder or promotional message stops that kind of message. Sign-in codes you request will still arrive.
- Records: we keep the type, time and delivery status of each SMS we send. See “How long we keep information” for how long.
- Lost or changed number: mobile numbers are sometimes reissued to other people, so please keep yours up to date. If you lose access to your number or email, contact us. After we confirm your identity, an administrator can change or remove it. Every such change is recorded and we email you about it.
7. Chatting with us on WhatsApp
You can message us on WhatsApp with questions, for support, or to get set up as a mechanic, parts supplier or dealer.
- What we see: your WhatsApp number, your profile name and the messages you send. We use them to reply to you and to keep a record of the conversation.
- Marketing: we only send promotional messages on WhatsApp if you have agreed to receive them, and you can tell us to stop at any time.
- Please keep it safe: never send passwords, sign-in codes or card details in a chat. We will never ask for them.
- WhatsApp’s role: WhatsApp is run by Meta and is subject to its own terms and privacy policy. Copies of a chat also stay on your phone and in WhatsApp’s systems, which we do not control.
8. Where your information is processed
Some of our providers, for example hosting, error-monitoring and messaging services such as WhatsApp, may store or process information on servers outside South Africa. We only send personal information abroad where POPIA allows it: where the recipient is bound by law, a binding corporate rule or a contract that gives your information similar protection, or where you have consented, or where the transfer is necessary to provide the service you asked for.
9. How we protect your information
- Connections to Car Log are encrypted (HTTPS).
- Sensitive vehicle identifiers such as your VIN and licence plate are encrypted in our database.
- Sign-in uses one-time codes instead of passwords. Codes expire quickly, only work a limited number of times, and are stored only in scrambled (hashed) form.
- Your card details go directly to PayFast. They never pass through our servers.
- Administration tools are restricted to authorised administrators, checked on every request, and administrator actions are logged.
- We limit how often sign-in codes, SMS and report links can be requested, to prevent abuse.
No system is completely secure. If a breach affects your personal information, we will tell you and the Information Regulator as POPIA requires.
10. How long we keep information
| Information | How long we keep it |
|---|---|
| Account, vehicle, fuel and service data | Until you delete it or delete your account. |
| Travel logbook entries | Until you delete them or your account. If you need them for a tax return, export them first. SARS generally expects records to be kept for five years, and that duty is yours. |
| Invoices, receipts and payment records | For as long as the law requires us to keep financial records (generally five years), even if you delete your account. |
| Sign-in codes | Minutes. Used or expired codes are removed. |
| Mechanic-logged entries you have not confirmed | They expire after 14 days. |
| Vehicle transfer codes | They expire after a set period (currently 30 days) or when used or cancelled. |
| SMS records | Message details (your number and the text) for up to 13 months, then they are erased. We keep counts and costs without personal details. |
| WhatsApp chats | For as long as needed to help you and keep a record of the request. You can ask us to delete a conversation. |
| Support correspondence | For as long as needed to help you and to keep a record of the request. |
| Security and error logs | For a limited period. |
| Backups | Deleted information can remain in encrypted backups until they are overwritten in the normal cycle. |
| Anonymised statistics | Indefinitely. They are no longer personal information. |
11. Deleting your account
You can delete your account yourself in your account settings. Please do these first:
- Cancel any paid subscription so that no further payments are taken.
- Download what you want to keep, such as verified report PDFs and travel logbook exports.
Deleting your account removes your account, vehicles and their fuel and service logs, travel logbook entries, quote requests, bookings and shared report links (they stop working). Some information is not covered by deletion:
- Financial records the law requires us to keep.
- Information already sent to other businesses, such as a quote request or booking. We cannot recall it, so please ask that business directly.
- Copies of a report that someone already downloaded or saved.
- Anonymised statistics.
12. Your rights
Under POPIA you may ask us to:
- tell you whether we hold your personal information, and give you a copy;
- correct or update it;
- delete it (subject to the exceptions above);
- stop using it for a purpose you object to, or withdraw a consent you gave.
Many of these you can do yourself: update your details and cell number in Settings, delete your account, switch report sharing off, opt out of mechanic reminders with the link in each email, and reply STOP to opt out of non-essential SMS. For anything else, email help@carlog.co.za from the email address on your account. We may ask you to confirm your identity first, and we aim to reply within 30 days.
Complaints
If you think we have not handled your information properly, please tell us first so that we can put it right. You also have the right to complain to the Information Regulator (South Africa): inforegulator.org.za, POPIAComplaints@inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. The Regulator also accepts complaints through its online portal. Its contact details may change, so please check its website.
- Car Log does not use advertising or analytics cookies.
- The Car Log web app keeps a sign-in token and a few preferences in your browser’s local storage so you stay signed in. Signing out or clearing your browser’s site data removes them.
- Our website loads fonts from Google Fonts and a styling library from a content delivery network. When it does, your browser contacts those providers, and they can see your IP address.
- When you pay, PayFast may set its own cookies on its pages. Please see PayFast’s own policy.
14. Children
Car Log is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us personal information, please contact us and we will delete it.
15. Changes to this policy
If we make a significant change, we will tell you by email or in the app before it takes effect where we can, and we will update the date and version at the top of this page. Where POPIA requires your consent for a new use of your information, we will ask for it.
16. Contact us
Questions about this policy or your information: help@carlog.co.za, or message us on WhatsApp: Message us on WhatsApp. Attention: Richard Soderblom, Information Officer, trading as Car Log, Kempton Park, South Africa.