Legal
Privacy Policy
Last Updated: 5 October 2026
This Privacy Policy explains how PanelDesk ("PanelDesk", "we", "us", "our") collects, uses, stores, and shares personal information when you use our marketing website and software service.
PanelDesk is operated by PANELDESK (PTY) LTD, a private company registered in South Africa under registration number 2026 / 183378 / 07. This Privacy Policy forms part of the PanelDesk Terms of Service.
For privacy and data-protection matters, Sam Fourie serves as PanelDesk's Director and Information Officer under registration reference 2026-004645.
1. Scope and Roles
PanelDesk provides software for workshop operations, including quotes, job cards, final costing, invoicing, and customer-facing document workflows.
For workshop data entered by your business (for example your customer, vehicle, and document records), your workshop is the responsible party under applicable law, including POPIA, and is responsible for lawful collection and use of that information. PanelDesk acts as an operator for that data when processing it to provide the service.
PanelDesk also acts as the responsible party for account, trial, billing, support, operational security, and service analytics data needed to run the platform.
Because PanelDesk acts as an operator for workshop-entered data, our service providers may process that data on our behalf. This includes application error monitoring and session replay (see sections 2.8 and 6), which can capture information that a workshop enters into the service, including its customers' information. Workshops remain responsible for informing their own customers about this processing and for having a lawful basis for it under applicable law, including POPIA.
Your workshop also authorises PanelDesk to use workshop data to produce combined, de-identified statistics, as described in section 4.1. These statistics never identify your workshop, your staff, or your customers.
2. Information We Collect
2.1 Account and team information
- Email address and profile names
- User role and company role assignments
- Onboarding and account-state metadata
- Impersonation metadata where admin tools are used
2.2 Company profile, trial, and billing information
- Company profile details (including address and tax fields)
- Billing and notification email addresses
- Banking details configured for quote and invoice display
- Subscription and trial metadata (status, limits, billing state, and trial dates where applicable)
- Payment-method setup, trial authorization, and billing metadata returned by Paddle
For customers outside South Africa, payment details are required through Paddle before the 30-day trial begins. Payment-related metadata is collected during trial setup, checkout, billing, and subscription management.
2.3 Customer and vehicle records entered by workshops
- Customer contact and identity fields such as names, emails, phone numbers, ID or business details, and addresses
- Customer communication preferences and consent fields
- Vehicle details such as registration, VIN, engine number, mileage, make and model, and notes
2.4 Workflow and document snapshots
Quotes, invoices, and related documents can include snapshots of customer, vehicle, and company billing information at the time of issue.
2.5 Public-link and interaction data
- Public quote and invoice links are token-validated and may expose selected snapshot data needed for viewing and approval
- Quote accept or decline flows may capture submitter details such as name, email, context text, and request IP metadata
- Quote and invoice view tracking may capture session IDs, visitor IDs, IP addresses, user-agent data, and timestamps
- Audit logs may include actor metadata, action history, IP address, and user-agent data
2.6 Uploaded file metadata
We store metadata for uploaded assets, including object key or URL, content type, original filename, uploader identity, and upload timestamps.
2.7 Website analytics data
PanelDesk uses Vercel Analytics and Speed Insights on website pages for performance and usage measurement.
2.8 Application error monitoring and session replay
When you use the PanelDesk application (the signed-in software, not our marketing websites), we use Sentry to monitor errors and performance and to record session replays that help us debug issues, protect the service, and improve reliability.
Through Sentry we may collect:
- Session replays that reconstruct on-screen activity for a portion of sessions, and for sessions where an error occurs. We configure the tool to hide sensitive fields — such as passwords, security credentials, and banking or payment details — so they are not recorded, though other information shown or entered in the application may appear in a replay
- Technical diagnostic data such as browser type, operating system, approximate location derived from IP address, error and stack-trace details, and log breadcrumbs of recent activity
Session replay and Sentry monitoring run only in the PanelDesk application, not on our marketing websites.
3. Cookies, Local Storage, and Identifiers
- Public quote and invoice flows may store session identifiers in local storage.
- A `paneldesk_visitor_id` cookie may be set for up to one year with `SameSite=Lax`, with a local storage mirror.
- These identifiers help with security, diagnostics, and view tracking on public document links.
- When you use the PanelDesk application, Sentry sets a session identifier in your browser storage to link error-monitoring and session-replay events. This is described further in sections 2.8 and 6.
You can control cookies through browser settings, but some functionality may be reduced.
4. How We Use Information
- Provide and operate the service and customer workflows
- Authenticate users and manage access permissions
- Generate and deliver documents, notices, and audit trails
- Process payment-method setup, trial activation, subscriptions, billing actions, and payment events through Paddle
- Send transactional emails and service communications
- Monitor security, abuse, reliability, and performance
- Detect, diagnose, and fix errors and record session replays for a portion of application sessions to debug issues, protect the service, and improve reliability
- Produce combined, de-identified statistics across workshops, as described in section 4.1
- Comply with legal and regulatory obligations
We do not sell personal information to third parties for their own marketing.
4.1 Combined, de-identified statistics
We may combine information from many workshops to produce statistics, for example the average quote value by region, vehicle type, or month. We use these statistics to improve PanelDesk, to show workshops how they compare with others, and to publish industry insights.
These statistics are built from figures such as amounts, dates, regions, and vehicle types. They never include names, contact details, vehicle registrations or VINs, or anything else that identifies a workshop, its staff, or its customers. We only report a figure when it combines enough workshops that no single workshop can be identified from it, and we never publish or share any workshop's individual quotes, invoices, or customer records.
Because these statistics cannot be linked back to a workshop or a person, they are not personal information. Statistics already produced may continue to be used after an account closes.
5. Legal Basis and POPIA Notice
5.1 Legal basis for processing
We apply a POPIA-first approach with a global baseline for similar privacy rights. Depending on context, processing is based on:
- Performance of a contract
- Legitimate interests in operating, securing, debugging, and improving the service, including application error monitoring, session replay, and producing de-identified statistics
- Consent where required
- Legal obligation
5.2 Mandatory and optional information
Certain information is required for account creation, service delivery, billing, fraud prevention, security, support, and legal compliance. This generally includes core account details, workshop/company details needed to operate the service, and payment or billing information required for global trial activation and paid billing.
If you choose not to provide required information, including the payment details needed for Paddle trial setup where applicable, we may be unable to create or maintain your account, start the trial, activate paid billing, process payments, provide support, or enable certain product features.
5.3 Complaints to the Information Regulator
You may lodge a complaint with the Information Regulator if you believe your personal information has been handled unlawfully or your rights have been infringed. Official guidance and complaint resources are available on the POPIA page and the complaints page published by the Information Regulator.
5.4 EU and UK users (GDPR)
If you are in the European Union or the United Kingdom, the GDPR and UK GDPR apply to your personal data. Our legal basis for application error monitoring and session replay is our legitimate interest in keeping the service secure, reliable, and debuggable, balanced against your rights and freedoms.
You may request access, correction, erasure, restriction, or portability of your personal data, and you may object to processing based on legitimate interests. You may also lodge a complaint with your local supervisory authority. To exercise these rights, contact us using the details in section 14.
Where your personal data is transferred outside the EU or UK — including to Sentry in the United States for error monitoring and session replay — we rely on Standard Contractual Clauses and the provider's data processing agreement as the safeguard.
6. Sharing and Service Providers
We share information with service providers that support PanelDesk operations, including:
- Firebase (Google) for authentication
- MongoDB for application data storage
- Cloudflare (R2) for file storage and signed upload and download links
- Paddle for payment-method setup, trial activation, payments, and subscriptions
- Resend for transactional email delivery
- Vercel for hosting, analytics, and performance insights
- Sentry (Functional Software, Inc.) for application error and performance monitoring and session replay
- OpenAI for the optional in-app AI assistant: the messages a user types, and the company, customer, vehicle, and quote details the assistant looks up to answer them
- Cal.com for booking the optional onboarding call: the account owner's name and email address
- Your connected accounting provider (for example Sage Business Cloud Accounting or QuickBooks) when you enable accounting sync — selected customer, invoice, credit note, and payment records are shared with that provider at your instruction
Some providers process data outside South Africa. We use reasonable contractual and operational safeguards appropriate to the transfer context.
Sentry stores application error-monitoring and session-replay data in the United States. For that transfer we rely on Sentry's data processing agreement and Standard Contractual Clauses as the safeguard.
7. Public Directory Listings (findapanelbeater.co.za)
PanelDesk operates findapanelbeater.co.za, a public directory of workshops that use PanelDesk. If you hold an active, paying South African workshop subscription, we publish a business listing for your workshop as part of the service.
A listing contains business information: company or trading name, logo, business contact details (telephone, WhatsApp number, and the public email address you designate), business address, trading hours, website link, and the directory profile fields you complete, such as factory approvals and B-BBEE level. If you add key contact people to your profile, their names and roles are published — only add people you have the authority to publish.
Under POPIA, information relating to an identifiable juristic person is personal information. We publish listing information on the basis of performance of a contract (the listing is part of the subscribed service) and our legitimate interest in operating the Directory. Listings are removed automatically when a subscription ends or account access is frozen. You can correct listing details in Settings at any time, or contact us using the details in section 14 with queries or removal requests.
Vehicle owners can submit quote requests on the Directory. Their submission (contact details, vehicle details, damage description, and photos) is delivered to the workshop they selected, which is the responsible party for that information. PanelDesk processes it as an operator, in the same way as leads submitted through your own lead form.
8. Security Controls
Workshop records are stored on PanelDesk's systems, hosted by the service providers listed in section 6. Information is encrypted while it travels between your device and PanelDesk and while it is stored, each workshop can only see its own records, and we keep regular backups.
Access to workshop records by PanelDesk personnel is limited to what is needed to operate, support, secure, and maintain the service.
We also use layered technical controls designed to reduce unauthorized access and misuse, including:
- Authentication checks on API access by default, with limited public endpoint exceptions for tokenized customer flows
- Permission-based authorization for protected actions
- Rate limiting, audit logging, and request validation controls
- Upload restrictions by file type, size, and scoped storage keys
- Webhook signature verification for billing events
- Transport and platform security headers in deployment configuration
No method of transmission or storage is perfectly secure, but we do our best to keep your information safe and apply reasonable safeguards for the service context.
9. Retention and Deletion
We retain information for as long as needed to operate the service, meet legal obligations, resolve disputes, and maintain security and auditability.
Retention can vary by data category and account state. A single, fixed retention period does not apply to all records.
Application error-monitoring and session-replay data held by Sentry is retained for a limited period and then deleted, in line with Sentry's retention controls.
On account closure or deletion requests, we process data removal subject to legal, security, billing, and backup constraints.
10. Your Privacy Rights
Depending on applicable law, you may request access, correction, deletion, objection, or restriction of processing of your personal information.
For customer and vehicle data entered by a workshop, requests should generally be directed to that workshop first.
You can submit privacy and POPIA requests to Sam Fourie, Director and Information Officer, at sam@paneldesk.com or +27 60 282 3056 (WhatsApp calls and messages). We may request identity verification before acting on a request.
11. Children
PanelDesk is a business service and is not intended for use by children under 18.
12. International Transfers
Because our providers operate global infrastructure, personal information may be processed in multiple jurisdictions. We seek to apply suitable safeguards for those transfers.
In particular, our application error-monitoring and session-replay provider, Sentry, stores data in the United States. For that transfer we rely on Sentry's data processing agreement and Standard Contractual Clauses.
13. Changes to this Policy
We may update this Privacy Policy from time to time. If we make material updates, we will publish the revised version and update the "Last Updated" date.
14. Contact
PANELDESK (PTY) LTD is a private company registered in South Africa under registration number 2026 / 183378 / 07.
Public office bearer: Sam Fourie, Director.
Privacy, POPIA, and data protection queries can be sent to Sam Fourie, Director and Information Officer, at sam@paneldesk.com or +27 60 282 3056 (WhatsApp calls and messages). Information Officer registration reference: 2026-004645.
Registered, business, and legal notices address: