PSI APP
PRIVACY POLICY

Last updated: 2 September 2026

1. Who we are

The PSI Performance App (the App) is operated by PSI PERFORMANCE PTY LTD, trading as PSI Performance. In this policy, PSI, we, us and our refer to PSI PERFORMANCE PTY LTD.

Privacy enquiries can be sent to info@psiperformance.com.au. You can also call 0433 431 781 or write to PSI Performance, 21 Exchange Drive, Pakenham VIC 3810, Australia.

This policy explains how PSI collects, holds, uses and discloses personal information through the App and its associated customer and staff services. It applies in addition to the separate website and online-store privacy policy at psiperformance.com.au.

2. Our privacy commitments

PSI uses personal information to provide customer accounts, workshop services, vehicle records, booking communications and related support. We do not sell App customer information, use it for third-party advertising or use it to track people across unrelated apps or websites.

The App does not collect payment-card details. Payments and in-app purchases are not currently enabled. If payment functionality is introduced, this policy and the relevant collection notices will be updated before that functionality is activated.

3. Personal information we collect and hold

Depending on how you use the App, PSI may collect and hold the following types of information.

Account and contact information. This includes your verified email address, first and last name, mobile number, customer account identifier, invitation status, account status and optional profile photograph.

Vehicle information. This includes the vehicle make, model, year, registration, nickname, partial VIN where recorded, odometer readings, vehicle photographs and other vehicle details you choose to provide.

Booking and workshop information. This includes the booking type, requested and approved dates, arrival arrangements, request notes, service reminder choices, cancellation information, booking status, staff notes and booking history.

Performance and technical information. This includes modification and tuning details, fuel and drivetrain setup, dyno measurements and graphs, repair and inspection records, recommendations, service summaries and future check-in information.

Invoice and transaction records. This includes the invoice number, date, summary, amount, currency and related documents. The App does not collect or store card or bank account credentials.

Customer content. This includes photographs taken with the device camera, images selected from the photo library, invoices, dyno graphs, repair documents and other supporting files you choose to upload.

Notifications and events. This includes notification preferences, PSI Events reminder choices, in-app notification messages, read status, device platform, push token and whether device alerts are enabled.

Security and operational records. This includes authentication events, account and staff identifiers, staff actions, record change audit information, deletion requests, integration delivery status, error information and other information needed to detect misuse or protect accounts.

Support information. This includes information provided during calls, emails, feedback, complaints or other communications with PSI.

Technical information. Infrastructure providers may process an Internet Protocol address and limited device, operating system, update installation and request information when the App connects to online services, checks for an update, sends an email or delivers a notification.

Please do not upload documents or images containing information that PSI does not need, including payment-card details, passwords, sign-in codes, authenticator secrets or unnecessary information about another person.

4. How we collect personal information

We collect personal information directly from you when you sign in, create or update a profile, add a vehicle, request a booking, choose notification settings, upload a file, request deletion or contact PSI. We also collect information when PSI creates or updates legitimate workshop records, including verified service, repair, dyno, invoice and recommendation information.

Limited technical information is collected automatically when the App securely communicates with our authentication, database, storage, email, update and notification services. We may also receive information from Apple, Google or another service provider where it is necessary to operate a feature you have requested, such as confirming notification delivery.

If required information is not provided, PSI may be unable to create an account, identify the relevant vehicle, assess a booking request, display workshop records or provide the requested feature. Optional photographs, attachments, weather information and device notifications can be left unused.

5. Why we use personal information

PSI uses personal information to verify identity and provide passwordless customer accounts; create, display and protect customer-owned vehicle records; receive, assess and administer workshop booking requests; and communicate proposed dates, approvals, cancellations, reminders and event updates.

We also use personal information to create and display PSI-verified workshop, dyno, invoice, repair and service records; store and display customer-selected photographs and documents; provide customer support; respond to access, correction, complaint and deletion requests; and maintain accurate business, taxation, warranty, safety and dispute records.

Personal information may also be used to protect customers, PSI, the App and connected services from misuse, unauthorised access, fraud and security incidents; diagnose faults; deliver reviewed App updates; maintain reliable service; comply with legal obligations; and establish, exercise or defend legal rights.

We will not use App information for an unrelated purpose unless you consent or the use is otherwise permitted or required by law.

6. Device permissions and choices

The App may request access to the camera so you can photograph a vehicle or supporting document you choose to upload. It may request photo library access so you can select an existing vehicle image or supporting document. It may also request notification permission so PSI can deliver booking, workshop and PSI Events alerts, sounds and badge counts.

PSI receives only the images or files you actively select or capture for upload. The current App does not request access to your microphone, contacts, address book or precise device location.

You can change camera, photo and notification permissions in the device settings. You can also disable PSI device alerts and individual notification categories within the App. Disabling a permission may prevent the relevant optional feature from working but does not prevent ordinary customer support.

7. Workshop weather

The App may display current and forecast weather for the PSI workshop in Pakenham. It sends the workshop's fixed coordinates, not the customer's device location, to the weather provider. The provider may receive ordinary technical request information such as an IP address and request time for service operation, security and abuse prevention.

Weather information is indicative only and may be delayed or inaccurate. It does not confirm workshop availability or a booking date.

8. When we disclose information

PSI may disclose personal information to authorised PSI personnel who need it to provide workshop or customer services, and to contracted technology providers that operate authentication, storage, email, App updates, weather, notifications and PSI's private booking calendar.

Information may also be disclosed to professional advisers, insurers or service providers who owe appropriate confidentiality obligations; where you request or authorise the disclosure; to investigate misuse or protect safety and security; to establish, exercise or defend legal rights; where required or authorised by law, a court or a regulator; or in connection with a genuine sale, restructure or transfer of the PSI business subject to appropriate confidentiality and privacy safeguards.

Trusted Partner listings and social, map or website buttons open independent third-party services. PSI does not send the customer's private account record to a Trusted Partner merely because a customer opens one of those links. The third party's own privacy terms apply after the customer leaves the App.

9. Service providers and overseas processing

The App uses Supabase for passwordless authentication, database services, Edge Functions and private file storage. PSI's primary project data is configured in the Sydney, Australia region. Supabase and its subprocessors may process limited operational, security and support information in other countries, including the United States.

Resend delivers sign-in codes and transactional booking emails. Email addresses, message content, delivery metadata and logs may be processed and stored in the United States.

Expo provides signed App builds, over-the-air updates, opted-in push tokens and push delivery. Expo and its subprocessors may process technical and notification information outside Australia, including in the United States.

Apple and Google provide operating system distribution and notification delivery. Depending on the device, notification information may be processed outside Australia, including in the United States.

Google Calendar receives limited PSI-internal booking information when a booking reaches the required confirmed state. Customers cannot list or read PSI's calendar contents. Google may process this information in countries in which it operates, including the United States.

Open-Meteo supplies Pakenham workshop weather using fixed workshop coordinates. Open-Meteo is based in Switzerland and may retain technical API logs, which can include IP addresses and requested coordinates, for service operation and abuse prevention.

Providers receive only the information reasonably required for their function. PSI reviews provider terms, security information and contractual protections and takes reasonable steps to require appropriate handling. Internet services may route or process information in additional countries used by a provider or its subprocessors. Contact PSI if you would like more information about current provider arrangements.

10. Security

PSI uses safeguards appropriate to the nature of the information, including passwordless email-code authentication, operating-system protected native session storage, customer-ownership controls, private file storage, limited staff access, authenticator MFA for workshop-wide access, encrypted network connections, audit records and server-only provider credentials.

No online system can guarantee absolute security. Customers should protect their email account and device, use only the newest PSI sign-in code, and never share a sign-in code or authenticator secret. Suspected unauthorised access or privacy incidents should be reported promptly to info@psiperformance.com.au.

11. Retention

PSI retains personal information only for as long as it is reasonably needed for the purposes described in this policy or to satisfy a legal, accounting, taxation, warranty, safety, security or dispute obligation.

Active account, profile, vehicle and notification preference information is retained while the account is active and reviewed when deletion is requested or the account is no longer required. Push tokens are retained while device alerts remain enabled and are disabled or removed when alerts are turned off, the token is invalid or the account is deleted.

Customer-uploaded photographs and documents are retained until they are replaced, removed, no longer required or deleted with the account, unless a copy forms part of a record PSI is legally required to retain.

Booking, invoice and workshop transaction records may be retained for at least five years after the relevant record or transaction, and longer where required for taxation, warranty, safety, a dispute, legal proceedings or another legal obligation. Authentication, audit, delivery, security and complaint records are retained only for the period reasonably needed to protect the service, investigate an issue, demonstrate an action or comply with law.

Restricted backup copies may persist temporarily until they expire through PSI's normal backup rotation. Deleted information in a backup is not returned to ordinary use and will be removed again if a backup must be restored.

When personal information is no longer required, PSI takes reasonable steps to delete it, de-identify it or put it beyond ordinary use.

12. Access, correction and export

You can review and correct editable profile and vehicle information after secure sign-in. PSI-authored workshop records remain read-only in the App to protect the integrity of service history, but you may ask PSI to investigate and correct inaccurate personal information.

You may contact PSI to request access to, correction of or an export of the personal information PSI holds about you. PSI may need to verify your identity before acting and will not ask you to provide a password, sign-in code or authenticator secret. PSI aims to respond within 30 calendar days. Access will ordinarily be provided without charge, although PSI will tell you in advance if a permitted reasonable administrative charge applies.

Some requests may be refused or limited where permitted by law, including to protect another person's privacy, commercially sensitive evaluative material, legal privilege or security. If a request is refused, PSI will explain the reason where required and the available complaint options.

13. Account deletion

Signed-in customers can request account deletion from Account in the App. A pending request can be cancelled until PSI begins processing it. A customer who cannot access the App can use PSI's public account-deletion page or contact PSI from the account email address.

PSI verifies deletion requests and normally completes them within 30 days. Completion removes App login access, the customer profile, customer vehicles, notification registrations and customer-uploaded files, together with other associated App records that PSI is not legally required to keep.

Where PSI must retain a minimum workshop, invoice, taxation, warranty, safety, security or dispute record, that information will be restricted, protected and de-identified where appropriate. PSI will confirm when the account-deletion process is complete. Deleting an App account does not cancel or remove rights or remedies under the Australian Consumer Law.

14. Privacy complaints

To make a privacy complaint, email info@psiperformance.com.au with your name, contact details, a description of the concern and the outcome you are seeking. Do not include a password, sign-in code or authenticator secret.

PSI will acknowledge the complaint, may ask for information needed to verify identity or investigate the issue, and aims to provide a response within 30 calendar days. If additional time is reasonably required, PSI will explain why and provide an updated timeframe.

If you are not satisfied with PSI's response and the Privacy Act 1988 (Cth) applies to the matter, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or by calling 1300 363 992. Other consumer, contractual and legal rights may also apply.

15. Children

The App is intended for PSI customers managing vehicles and workshop services and is not directed to children under 16. If PSI becomes aware that a child has provided personal information without appropriate authority, PSI will review and remove it where required.

16. Data incidents

PSI investigates suspected loss, unauthorised access or unauthorised disclosure of personal information. Where the Notifiable Data Breaches scheme or another law applies, PSI will assess the incident and notify affected people and the relevant regulator when required.

17. Changes to this policy

PSI may update this policy when the App, service providers or legal obligations change. The current version and its effective date will be published on PSI's website and linked from the App. Material changes will be communicated through an appropriate channel where required.

PSI PERFORMANCE PTY LTD