Privacy Policy

AutoFront AI is software sold to independent auto-repair shops. That means we handle two different groups of people's information, and our role differs for each:

• Shop users — the owners and staff who sign up for an account. We are the controller of this information and use it to provide and bill for the Service.
• Vehicle owners — people who contact a shop through its request form, chat assistant, or by text or phone. We process this information on the shop's behalf. The shop decides what to collect and how to use it; we act on the shop's instructions as its service provider.

If you are a vehicle owner and want your information corrected or deleted, contact the shop you dealt with. You may also contact us at [YOUR CONTACT EMAIL] and we will assist that shop in responding.

From shop users: name, business name, email address, phone number, business address and hours, services offered, and login credentials (passwords are stored only as salted hashes by our authentication provider, never in readable form).

From vehicle owners, submitted to a shop: name, phone number, email address, vehicle details (year, make, model, mileage), a description of the problem, any photos uploaded, scheduling preferences, and a record of consent to be contacted by text.

Communications: the content of text messages sent and received through the Service, chat-assistant transcripts, and call metadata for missed calls (caller number, time, and whether an automatic reply was sent). We do not record or listen to phone calls.

Technical: IP address, browser and device information, cookies strictly necessary for keeping you signed in, and error diagnostics. We do not use advertising or cross-site tracking cookies.

Payment: subscription payments are processed by Stripe. We receive a subscription status and the last four digits and brand of the card. We never receive or store full card numbers.

• Operate the Service: deliver requests to the right shop, send confirmations and reminders, and keep conversations threaded.
• Authenticate users and keep each shop's data separated from every other shop's.
• Bill for subscriptions and enforce plan limits.
• Detect and prevent spam, fraud, and abuse (including rate limiting by IP address).
• Diagnose errors and improve reliability.
• Send service-related notices, such as billing or security notifications.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Text messages are sent by the shop, using the Service as its tool. The shop is responsible for having proper consent before messaging anyone. We record when and how consent was given (for example, ticking the consent box on a request form) and store it with the customer record.

Recipients can opt out at any time by replying STOP, which takes effect immediately and blocks further messages from that shop. Replying START resumes them. Message and data rates may apply. Message frequency varies based on your interaction with the shop.

The optional chat assistant is powered by Anthropic's Claude API. When a visitor uses it, the conversation and the shop's public business details are sent to Anthropic to generate a reply. Anthropic processes this as our service provider and does not use it to train its models under its commercial terms.

We store chat transcripts so the shop can review conversations. For cost tracking we log a one-way cryptographic hash of the message, not the message text itself.

The assistant is not a mechanic and does not diagnose vehicles. Its answers may be incomplete or wrong and should be confirmed with the shop. It is not for emergencies — if you have an emergency, call your local emergency number.

We share information with a small number of vendors who help run the Service, each bound by contract to protect it:

• Supabase — database, authentication, and file storage
• Vercel — application hosting and delivery
• Twilio — text messaging and call handling
• Stripe — subscription payments
• Anthropic — the chat assistant (only if the shop enables it)
• Sentry — error monitoring
• Resend — transactional email
• Cloudflare — bot and abuse protection

We may also disclose information if required by law, to enforce our agreements, or to protect the rights and safety of any person. If the business is sold or merged, information may transfer as part of that transaction.

We keep shop account information for as long as the account is active and for a reasonable period afterwards for legal, tax, and dispute purposes. Vehicle-owner information is kept for as long as the shop maintains its account, or until the shop deletes it. Consent and opt-out records are retained even after other data is deleted, because we are required to prove that opt-outs were honoured. When a shop closes its account, its data is deleted or anonymised within 90 days unless the law requires otherwise.

All traffic is encrypted in transit (HTTPS). Data is stored with database-level row security so one shop cannot read another shop's records, uploaded photos are held in a private bucket that is not publicly accessible, and administrative credentials are restricted to server-side code. Passwords are hashed. No system is perfectly secure, and we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. Residents of California have rights under the CCPA/CPRA, including the right to know and to delete; we do not sell personal information, so there is nothing to opt out of in that respect. Residents of the EU/UK may have rights under the GDPR.

To exercise a right, contact [YOUR CONTACT EMAIL]. If your request concerns information a shop collected about you, we will refer you to that shop and support it in responding. We will not discriminate against you for exercising a right.

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect their personal information. If you believe a child has provided information, contact us and we will delete it.

We may update this policy from time to time. If we make a material change, we will update the effective date above and, for significant changes, notify shop account holders by email or in the app.