Pulse

Privacy Policy

Last updated 8 September 2026

1. Who we are

Pulse is operated by German Autoworks (Pty) Ltd, registration number 2008/002227/07, of 19 Durham Ave, Salt River, Cape Town, 7925, South Africa (“we”, “us”). We are the responsible party under South Africa’s Protection of Personal Information Act (POPIA) and the data controller under the EU General Data Protection Regulation (GDPR) for the personal information described here.

Our Information Officer is the director of the company. For any question about this policy, or to exercise any right described in section 9, contact info@autowork.co.za.

This policy covers the Pulse application at pulsediag.com only. It does not cover the autoWORKS vehicle servicing business, which publishes its own privacy policy.

2. What we collect

Account information, which you give us when you register or are invited:

  • Your name and email address
  • Your job role and, optionally, your workshop or company name and country
  • A profile image, if you provide one
  • Sign-in identifiers from Google, if you choose to sign in with Google

Service information, which is created as you use Pulse:

  • Vehicle records: make, model, year, engine, fuel type, transmission, mileage, and where you enter them, the registration number and VIN
  • Diagnostic cases: the complaint, your observations, every step and answer, messages, fault codes, test results, the confirmed cause and the repair performed
  • Files you attach to a case, and audio you record for transcription
  • Usage records: when you signed in, when you were last active, and the number and cost of AI requests attributed to your account

A vehicle registration number or VIN can identify the vehicle’s owner. Free-text fields can contain anything you type into them. Please do not enter a customer’s name, contact details or other personal information into a case unless you need to.

3. Why we use it, and on what basis

  • To provide the service — running diagnostics, storing your cases, and giving you access to them. Necessary for the performance of our contract with you (GDPR Art. 6(1)(b); POPIA s11(1)(b)).
  • To keep the service working and secure — authentication, abuse prevention, error diagnosis, and metering plan usage. Our legitimate interests (GDPR Art. 6(1)(f); POPIA s11(1)(f)).
  • To improve diagnostic guidance — see section 8. Our legitimate interests, balanced against your rights as described there.
  • To meet legal obligations where one applies (GDPR Art. 6(1)(c); POPIA s11(1)(c)).

4. Who we share it with

We do not sell your information. We share it with the service providers we rely on to run Pulse:

  • OpenAI (United States) — diagnostic case content and recorded audio, for AI processing and transcription. See section 5.
  • Supabase (Ireland) — our database and authentication provider. All account and case data is stored here.
  • Vercel — application hosting and delivery.
  • Google — only if you choose to sign in with Google, and only your basic profile and email address.
  • YouTube (Google) — when repair guidance links to a video, your browser contacts YouTube directly and their terms apply.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

5. AI processing

Pulse uses the OpenAI API to generate diagnostic guidance. The text of your case, and any audio you record for transcription, is sent to OpenAI to produce a response.

  • OpenAI states that data submitted through its API is not used to train its models.
  • OpenAI retains abuse-monitoring logs, which can contain the content sent and returned, for up to 30 days. That copy is outside our control and is not covered by our retention commitment in section 7.

Guidance produced by Pulse is generated by an AI model. It can be incomplete or wrong, and it is not a substitute for the judgement of a qualified technician. Recorded audio may capture the voices of people nearby — please record only what you need.

6. Where your information is stored

Our database is hosted in Ireland (European Union). AI processing takes place in the United States. If you are in South Africa, this means your information is transferred outside the Republic; we rely on section 72(1)(b) of POPIA, as the transfer is necessary to perform the contract with you. If you are in the EU or UK, the transfer to the United States is made under the standard contractual clauses operated by our provider.

7. How long we keep it

  • Account and case information is kept for as long as your account is active, and deleted within 90 days after your account is closed.
  • You can ask us to delete a case, or your whole account, at any time — see section 9.
  • Records we are required to keep by law, and security and audit logs, are kept for as long as that obligation lasts.
  • De-identified diagnostic patterns described in section 8 are kept indefinitely, because they no longer identify you or any vehicle.
  • The copy held in OpenAI’s abuse-monitoring logs expires on their schedule, up to 30 days.

8. How Pulse learns across cases

This section describes something you should understand before you use Pulse.

When a case is closed, Pulse creates a condensed record of what was learned: the vehicle make, model and engine family, the complaint category, the fault codes and symptoms, the confirmed cause, the repair performed and the test that confirmed it. Before that record is stored, we automatically remove the vehicle’s registration number and VIN, email addresses, and long digit sequences.

These records are held in a shared pool. When another user later works on a similar vehicle with a similar complaint, a relevant record may be retrieved and shown to them as precedent. This is what allows Pulse to get better at diagnosis over time, and it means learning derived from your closed cases can inform other users’ work.

  • Your cases themselves are never shared. Only the condensed record is, and only where it is relevant to the vehicle and complaint in front of another user.
  • Your chat messages, uploaded files, audio and account details are never placed in this pool.
  • Automated removal of identifiers is not perfect. Free text you type may survive it, which is why we ask you not to enter customer names or contact details into a case.
  • Contributing to this pool is currently part of using Pulse and cannot be switched off. If you need diagnostic work excluded from it, contact us before you begin.

9. Your rights

You have the right to:

  • Ask what personal information we hold about you, and receive a copy
  • Have inaccurate information corrected
  • Ask us to delete your information, subject to records we must keep by law
  • Object to processing based on our legitimate interests, and to ask us to restrict processing
  • Receive your information in a portable format (GDPR Art. 20)
  • Withdraw any consent you have given, without affecting processing already carried out

To exercise any of these, email info@autowork.co.za. We will respond within 30 days. We may ask you to confirm your identity first.

If you are not satisfied, you can complain to the Information Regulator of South Africa (JD House, 27 Stiemens Street, Braamfontein, Johannesburg; complaints.IR@justice.gov.za). If you are in the EU or UK, you may complain to your local supervisory authority.

10. How we protect it

Access to Pulse requires a verified account. Every request is checked against the current state of your account, and access to a case is checked against its owner on each request — holding a valid session is never on its own enough to reach someone else’s data. Administrative actions are recorded in an audit log that cannot be rewritten.

Connections between your browser, our application and our database are encrypted in transit, and our database and hosting providers encrypt data at rest. Administrators of German Autoworks can access case data where necessary to operate and support the service.

No system is perfectly secure. If a breach occurs that is likely to harm you, we will notify you and the Information Regulator as POPIA section 22 requires.

11. Cookies and browser storage

Pulse sets cookies that keep you signed in and refresh your session. These are strictly necessary for the service to work and cannot be turned off while you are using it. We also use your browser’s local storage to remember interface preferences on your own device.

We do not use advertising cookies, and we do not run third-party analytics or tracking scripts.

12. Children

Pulse is intended for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

If we change this policy we will update the date at the top, and where the change materially affects you we will tell you by email or in the application before it takes effect.