Privacy Policy
Two kinds of people
Relay holds information about our customers (shops, mechanics and fleets who sign in) and about their customers (the people and companies a shop does work for). For the second group, the shop decides what is collected and why; we hold it on the shop's behalf.
What we collect
- Account: name, email, phone, role, which shop you belong to.
- Work: work orders, units and VINs, inspections, photos, estimates, invoices, parts, time entries, notes.
- Location: a mechanic's location while they are on a road call and have turned sharing on. Shown to their own shop and to the fleet customer waiting for that job.
- Technical: sign-in times, browser error reports, and basic usage needed to keep the service working.
What we do with it
We use it to run Relay: showing your work, sending the repair updates and invoices you ask us to send, supporting you, keeping the service secure, and billing. We do not sell personal information, and we do not use your shop's data to advertise to anyone.
Who else sees it
- Other shops never see your data. Separation is enforced in the database, not only on screen.
- A fleet customer sees only their own units, requests, estimates and invoices, from the shops they are linked to.
- Companies that help us run Relay: [Supabase] for hosting and database, [Resend] for email, [Cloudflare] for the website, [OpenStreetMap] for maps, [NHTSA] for free VIN lookups. They process data for us under their own terms.
- Authorities, if the law requires it.
How long we keep it
While your account is open, and for [X] after it closes, unless the law says longer. Photos uploaded with a service request but never sent are deleted automatically after 24 hours.
Your choices
- A shop's customer can turn off email updates; the shop sets this on the customer's record.
- Mechanics choose when to share location, and can stop at any time.
- You can ask for a copy of your data, or ask us to correct or delete it, by writing to [PRIVACY EMAIL].
- [LAWYER: GDPR and CCPA rights, if they apply, and the lawful basis for each use.]
Security
Data travels encrypted. Passwords are handled by our sign-in provider and we never see them. Photos and files are private and reachable only through short-lived links. Separation between shops is enforced by the database and tested automatically.
Children
Relay is for business use and is not intended for anyone under 16.
Where data is held
Relay runs on servers in [REGION]. [LAWYER: international transfer wording, if needed.]
Changes and contact
We will post changes here and, for material changes, email account holders. Questions: [PRIVACY EMAIL], [LEGAL COMPANY NAME], [COMPANY ADDRESS].