Legal
Privacy Policy
Last Updated: 30 October 2026
This Privacy Policy explains how PanelDesk ("PanelDesk", "we", "us", "our") collects, uses, stores, and shares personal information when you use our marketing website and software service.
PanelDesk is operated by PANELDESK (PTY) LTD, a private company registered in South Africa under registration number 2026 / 183378 / 07. This Privacy Policy forms part of the PanelDesk Terms of Service.
For privacy and data-protection matters, Sam Fourie serves as PanelDesk's Director and Information Officer under registration reference 2026-004645.
1. Scope and Roles
PanelDesk provides software for workshop operations, including quotes, job cards, final costing, invoicing, and customer-facing document workflows.
For workshop data entered by your business (for example your customer, vehicle, and document records), your workshop is the responsible party under applicable law, including POPIA, and is responsible for lawful collection and use of that information. PanelDesk acts as an operator for that data when processing it to provide the service.
PanelDesk also acts as the responsible party for account, trial, billing, support, operational security, and service analytics data needed to run the platform, and for the analytics and ad measurement described in section 2.7.
Because PanelDesk acts as an operator for workshop-entered data, our service providers may process that data on our behalf. This includes application error monitoring and session replay (see sections 2.8 and 6), which can capture information that a workshop enters into the service, including its customers' information. Workshops remain responsible for informing their own customers about this processing and for having a lawful basis for it under applicable law, including POPIA.
Your workshop also authorises PanelDesk to use workshop data to produce combined, de-identified statistics, as described in section 4.1. These statistics never identify your workshop, your staff, or your customers.
2. Information We Collect
2.1 Account and team information
- Email address and profile names
- User role and company role assignments
- Onboarding and account-state metadata
- Impersonation metadata where admin tools are used
2.2 Company profile, trial, and billing information
- Company profile details (including address and tax fields)
- Billing and notification email addresses
- Banking details configured for quote and invoice display
- Subscription and trial metadata (status, limits, billing state, and trial dates where applicable)
- Optional payment-method setup and authorization metadata returned by our payment provider
You do not need to provide card details to begin the 30-day trial. Payment-related metadata is collected only if you choose to add a payment method, authorize a refundable verification charge, or continue onto paid billing.
2.3 Customer and vehicle records entered by workshops
- Customer contact and identity fields such as names, emails, phone numbers, ID or business details, and addresses
- Customer communication preferences and consent fields
- Vehicle details such as registration, VIN, engine number, mileage, make and model, and notes
2.4 Workflow and document snapshots
Quotes, invoices, and related documents can include snapshots of customer, vehicle, and company billing information at the time of issue.
2.5 Public-link and interaction data
- Public quote and invoice links are token-validated and may expose selected snapshot data needed for viewing and approval
- Quote accept or decline flows may capture submitter details such as name, email, context text, and request IP metadata
- Quote and invoice view tracking may capture session IDs, visitor IDs, IP addresses, user-agent data, and timestamps
- Audit logs may include actor metadata, action history, IP address, and user-agent data
2.6 Uploaded file metadata
We store metadata for uploaded assets, including object key or URL, content type, original filename, uploader identity, and upload timestamps.
2.7 Analytics and ad measurement
We use Vercel Analytics to count visits to the pages of our websites and the PanelDesk application. On our websites it also counts clicks on some links. In the application we also use Vercel Speed Insights to measure how quickly pages load.
We use Google Analytics on paneldesk.co.za and in the PanelDesk application (app.paneldesk.com). It shows us how people find and use them: which pages are visited and for how long, the website or ad that sent someone to us, the type of browser and device, and an approximate location worked out from the IP address. In the application it also counts steps such as finishing onboarding and sending a quote. These counts do not include the details of your quotes, invoices, or customers. Google Analytics does not run on the pages a workshop's customers open from a link, such as quotes and invoices.
On paneldesk.co.za we also use the Google Ads tag. It remembers when you arrive from one of our Google ads, so that a sign-up in the application can be linked back to that ad.
When you create a PanelDesk account, the application tells Google Ads that a sign-up happened, so we can see which of our ads lead to sign-ups. With it we send the email address you signed up with in hashed form: your browser turns it into a code before it is sent, and Google uses that code to match the sign-up to an ad click by someone signed in to a Google account. Google calls this enhanced conversions. We do not send Google Ads any other account or workshop details.
To see how workshops find PanelDesk, our websites and the PanelDesk sign-up page keep a note of where your visit came from (the visit details):
- Which of our websites you visited, and the page you landed on
- The address of the other website that sent you, if one did, such as a search engine, an AI assistant, or a directory
- Campaign tags on the link you followed (utm_source, utm_medium, utm_campaign, utm_term, and utm_content)
- When you arrive from one of our Google ads, Google's click reference (gclid, gbraid, or wbraid)
Our websites keep the visit details in your browser: your latest visit for up to 90 days and your first visit for up to a year. When you follow a link to the PanelDesk application, we add them to that link. Google's tag also adds a code of its own to those links, so Google can tell it is the same visit.
The PanelDesk sign-up page keeps the visit details in your browser for up to 90 days. If you came to it some other way, it notes the address of the website that sent you instead. When you create an account, we save the visit details with your company's PanelDesk account and in our internal records of workshops we are in touch with, together with your answer to "How did you hear about PanelDesk?" if you choose to give one, so we can see which websites, ads, and campaigns bring in new workshops.
In the PanelDesk application, if you are in the European Economic Area, the United Kingdom, or Switzerland, we ask first: Google Analytics and Google Ads only load, your hashed email is only sent, and the sign-up page only keeps visit details after you agree in our cookie banner (Google's click reference only if you allow Google Ads). You can change your choice at any time with Cookie settings, under the PanelDesk sign-in and sign-up forms and on the My Account page in the application.
We do not use Google Ads for remarketing, so your visits are not used to show you our ads on other websites.
Google explains how it uses information from websites and apps that use its services on its page How Google uses information from sites or apps that use our services. To turn Google Analytics and Google Ads off in the PanelDesk application, use Cookie settings. To stop Google Analytics collecting your visits anywhere, you can install Google's opt-out browser add-on.
2.8 Application error monitoring and session replay
When you use the PanelDesk application (the signed-in software, not our marketing websites), we use Sentry to monitor errors and performance and to record session replays that help us debug issues, protect the service, and improve reliability.
Through Sentry we may collect:
- Session replays that reconstruct on-screen activity for a portion of sessions, and for sessions where an error occurs. We configure the tool to hide sensitive fields — such as passwords, security credentials, and banking or payment details — so they are not recorded, though other information shown or entered in the application may appear in a replay
- Technical diagnostic data such as browser type, operating system, approximate location derived from IP address, error and stack-trace details, and log breadcrumbs of recent activity
Session replay and Sentry monitoring run only in the PanelDesk application, not on our marketing websites.
2.9 Reminder emails you ask for on our website
If you ask us on paneldesk.co.za to email you, for example before MIBCO minimum wages change, we collect:
- Your first name, workshop name, phone number, and email address
- Which reminders you asked for and the exact wording you agreed to
- When you signed up and unsubscribed, and the page you signed up on
- The IP address and browser details used when you signed up
- Delivery events reported by our email provider, such as whether an email was delivered or bounced, and opens and clicks where the provider reports them
When you sign up, we send you one email to say you're on the list. If someone signed you up without asking you, the unsubscribe link in that email stops everything. These emails come from PanelDesk and may mention PanelDesk, and we may phone you about PanelDesk. Every email has a link to unsubscribe, and you can withdraw your consent at any time.
We keep a note of your sign-up, with your name, workshop name and phone number, in our internal records of workshops we are in touch with. We do not add you to any other emails unless you agree to them separately.
3. Cookies, Local Storage, and Identifiers
- Public quote and invoice flows may store session identifiers in local storage.
- A `paneldesk_visitor_id` cookie may be set for up to one year with `SameSite=Lax`, with a local storage mirror.
- These identifiers help with security, diagnostics, and view tracking on public document links.
- When you use the PanelDesk application, Sentry sets a session identifier in your browser storage to link error-monitoring and session-replay events. This is described further in sections 2.8 and 6.
- Google Analytics sets a _ga cookie and a cookie starting with _ga_ on our websites and in the PanelDesk application, to tell visits from the same browser apart. They last up to 2 years.
- The Google Ads tag sets cookies starting with _gcl_ (for example _gcl_au, and _gcl_aw when you arrive from an ad) on paneldesk.co.za and in the PanelDesk application, so that a sign-up can be linked to the ad that led to it. They last up to 90 days.
- On paneldesk.co.za and paneldesk.com, the visit details described in section 2.7 are kept in local storage (pd_visit_source): your latest visit for up to 90 days and your first visit for up to a year. A note in session storage (pd_visit_session) marks the start of each visit.
- The PanelDesk sign-up page keeps the visit details described in section 2.7 in local storage for up to 90 days, and a note that your sign-up was reported to Google Ads, so that it is only counted once.
- On paneldesk.com and in the PanelDesk application, a paneldesk_consent cookie remembers your cookie choice for 6 months, and a paneldesk_consent_region cookie, kept for your browser session, tells those pages whether to ask you first. Turning a choice off deletes the Google cookies that go with it.
- We keep a record of each cookie choice for 3 years to show what was agreed: the random code in the paneldesk_consent cookie, the choices, and your country, without your IP address.
You can control cookies through browser settings, but some functionality may be reduced. Blocking the Google Analytics and Google Ads cookies does not stop our websites or the PanelDesk application from working.
4. How We Use Information
- Provide and operate the service and customer workflows
- Authenticate users and manage access permissions
- Generate and deliver documents, notices, and audit trails
- Process optional payment-method setup, subscriptions, refundable verification charges, billing actions, and payment events
- Send transactional emails and service communications
- Send the reminder emails you ask for on our website (section 2.9)
- Monitor security, abuse, reliability, and performance
- Understand how people find and use our websites and the application, and measure which of our ads lead to sign-ups (section 2.7)
- Detect, diagnose, and fix errors and record session replays for a portion of application sessions to debug issues, protect the service, and improve reliability
- Produce combined, de-identified statistics across workshops, as described in section 4.1
- Comply with legal and regulatory obligations
We do not sell personal information to third parties for their own marketing.
4.1 Combined, de-identified statistics
We may combine information from many workshops to produce statistics, for example the average quote value by region, vehicle type, or month. We use these statistics to improve PanelDesk, to show workshops how they compare with others, and to publish industry insights.
These statistics are built from figures such as amounts, dates, regions, and vehicle types. They never include names, contact details, vehicle registrations or VINs, or anything else that identifies a workshop, its staff, or its customers. We only report a figure when it combines enough workshops that no single workshop can be identified from it, and we never publish or share any workshop's individual quotes, invoices, or customer records.
Because these statistics cannot be linked back to a workshop or a person, they are not personal information. Statistics already produced may continue to be used after an account closes.
5. Legal Basis and POPIA Notice
5.1 Legal basis for processing
We apply a POPIA-first approach with a global baseline for similar privacy rights. Depending on context, processing is based on:
- Performance of a contract
- Legitimate interests in operating, securing, debugging, improving, and promoting the service, including application error monitoring, session replay, website and application analytics, measuring which of our ads lead to sign-ups, and producing de-identified statistics
- Consent where required, for example for the reminder emails you ask for on our website
- Legal obligation
5.2 Mandatory and optional information
Certain information is required for account creation, service delivery, billing, fraud prevention, security, support, and legal compliance. This generally includes core account details, workshop/company details needed to operate the service, and payment or billing information when you choose paid billing or payment-method setup.
Other information is optional, such as adding a payment method during the free trial before you decide to continue onto paid billing. If you choose not to provide required information, we may be unable to create or maintain your account, activate paid billing, process payments, provide support, or enable certain product features.
5.3 Complaints to the Information Regulator
You may lodge a complaint with the Information Regulator if you believe your personal information has been handled unlawfully or your rights have been infringed. Official guidance and complaint resources are available on the POPIA page and the complaints page published by the Information Regulator.
5.4 EU and UK users (GDPR)
If you are in the European Union or the United Kingdom, the GDPR and UK GDPR apply to your personal data. Our legal basis for application error monitoring and session replay is our legitimate interest in keeping the service secure, reliable, and debuggable, balanced against your rights and freedoms.
In the PanelDesk application, our legal basis for Google Analytics, Google Ads, and the visit details described in section 2.7 is your consent, which you can withdraw at any time with Cookie settings.
You may request access, correction, erasure, restriction, or portability of your personal data, and you may object to processing based on legitimate interests. You may also lodge a complaint with your local supervisory authority. To exercise these rights, contact us using the details in section 14.
Where your personal data is transferred outside the EU or UK — including to Sentry in the United States for error monitoring and session replay — we rely on Standard Contractual Clauses and the provider's data processing agreement as the safeguard.
6. Sharing and Service Providers
We share information with service providers that support PanelDesk operations, including:
- Firebase (Google) for authentication
- MongoDB for application data storage
- Cloudflare (R2) for file storage and signed upload and download links
- Paystack for optional payment-method setup, refundable verification charges, payments, and subscriptions
- Resend for email delivery: our transactional emails and the reminder emails you ask for on our website
- SMSPortal for the SMS updates a workshop sends its customers: the customer's mobile number and the message text
- Vercel for hosting, analytics, and performance insights
- Google (Google Analytics and Google Ads) for analytics on our websites and in the application, and for measuring which of our ads lead to sign-ups, including the hashed sign-up email address described in section 2.7
- Sentry (Functional Software, Inc.) for application error and performance monitoring and session replay
- OpenAI for the optional in-app AI assistant: the messages a user types, and the company, customer, vehicle, and quote details the assistant looks up to answer them
- Cal.com for booking the optional onboarding call: the account owner's name and email address
- Your connected accounting provider (for example Sage Business Cloud Accounting or QuickBooks) when you enable accounting sync — selected customer, invoice, credit note, and payment records are shared with that provider at your instruction
- The insurer and manufacturer systems you connect (AutoMX, BAMS, and Lightstone Auto) when you enable those integrations: the job, customer, and vehicle details each one needs are shared with it at your instruction
Some providers process data outside South Africa. We use reasonable contractual and operational safeguards appropriate to the transfer context.
Sentry stores application error-monitoring and session-replay data in the United States. For that transfer we rely on Sentry's data processing agreement and Standard Contractual Clauses as the safeguard.
7. Public Directory Listings (findapanelbeater.co.za)
PanelDesk operates findapanelbeater.co.za, a public directory of workshops that use PanelDesk. If you hold an active, paying South African workshop subscription, we publish a business listing for your workshop as part of the service.
A listing contains business information: company or trading name, logo, business contact details (telephone, WhatsApp number, and the public email address you designate), business address, trading hours, website link, and the directory profile fields you complete, such as factory approvals and B-BBEE level. If you add key contact people to your profile, their names and roles are published — only add people you have the authority to publish.
Under POPIA, information relating to an identifiable juristic person is personal information. We publish listing information on the basis of performance of a contract (the listing is part of the subscribed service) and our legitimate interest in operating the Directory. Listings are removed automatically when a subscription ends or account access is frozen. You can correct listing details in Settings at any time, or contact us using the details in section 14 with queries or removal requests.
Vehicle owners can submit quote requests on the Directory. Their submission (contact details, vehicle details, damage description, and photos) is delivered to the workshop they selected, which is the responsible party for that information. PanelDesk processes it as an operator, in the same way as leads submitted through your own lead form.
8. Security Controls
Workshop records are stored on PanelDesk's systems, hosted by the service providers listed in section 6. Information is encrypted while it travels between your device and PanelDesk and while it is stored, each workshop can only see its own records, and we keep regular backups.
Access to workshop records by PanelDesk personnel is limited to what is needed to operate, support, secure, and maintain the service.
We also use layered technical controls designed to reduce unauthorized access and misuse, including:
- Authentication checks on API access by default, with limited public endpoint exceptions for tokenized customer flows
- Permission-based authorization for protected actions
- Rate limiting, audit logging, and request validation controls
- Upload restrictions by file type, size, and scoped storage keys
- Webhook signature verification for billing events
- Transport and platform security headers in deployment configuration
No method of transmission or storage is perfectly secure, but we do our best to keep your information safe and apply reasonable safeguards for the service context.
9. Retention and Deletion
We retain information for as long as needed to operate the service, meet legal obligations, resolve disputes, and maintain security and auditability.
Retention can vary by data category and account state. A single, fixed retention period does not apply to all records.
Application error-monitoring and session-replay data held by Sentry is retained for a limited period and then deleted, in line with Sentry's retention controls.
Reminder sign-ups are kept while you stay subscribed. After you unsubscribe, we keep the record of your sign-up, your consent, and your unsubscribe for 3 years, and we keep your email address on a do-not-email list so that we do not contact you again.
On account closure or deletion requests, we process data removal subject to legal, security, billing, and backup constraints.
10. Your Privacy Rights
Depending on applicable law, you may request access, correction, deletion, objection, or restriction of processing of your personal information.
For customer and vehicle data entered by a workshop, requests should generally be directed to that workshop first.
You can stop reminder emails at any time with the unsubscribe link in each email.
You can submit privacy and POPIA requests to Sam Fourie, Director and Information Officer, at sam@paneldesk.com or +27 60 282 3056 (WhatsApp calls and messages). We may request identity verification before acting on a request.
11. Children
PanelDesk is a business service and is not intended for use by children under 18.
12. International Transfers
Because our providers operate global infrastructure, personal information may be processed in multiple jurisdictions. We seek to apply suitable safeguards for those transfers.
In particular, our application error-monitoring and session-replay provider, Sentry, stores data in the United States. For that transfer we rely on Sentry's data processing agreement and Standard Contractual Clauses.
Google, which provides Google Analytics and Google Ads, may process the information it receives through them (section 2.7) in the United States and other countries.
13. Changes to this Policy
We may update this Privacy Policy from time to time. If we make material updates, we will publish the revised version and update the "Last Updated" date.
14. Contact
PANELDESK (PTY) LTD is a private company registered in South Africa under registration number 2026 / 183378 / 07.
Public office bearer: Sam Fourie, Director.
Privacy, POPIA, and data protection queries can be sent to Sam Fourie, Director and Information Officer, at sam@paneldesk.com or +27 60 282 3056 (WhatsApp calls and messages). Information Officer registration reference: 2026-004645.
Registered, business, and legal notices address: